Am I reading the right user guide?
Am I reading the right user guide?
Certain connectors have more than one user guide. It depends on the environment's setup and on the connector's available releases (new vs. older revisions).
To access the user guide that is relevant to your environment, simply click on the "How to connect" button located on the connector's setup page. By doing so, you will be directed to the user guide that aligns with your specific environment, ensuring relevancy and accuracy.
Why Mandiant?
The Mandiant connector is a TI (Threat Intelligence) connector that enriches the existing threat intelligence data in your Vulcan Platform. Mandiant adds another layer of intelligence to the CVE severity based on extensive vulnerability research.
Vulcan Cyber acknowledges the high reliability of Mandiant TI, as well as the dependency of many Security Engineers and CISOs on it as their primary source of Cyber Threat Intelligence. Therefore, we offer a dedicated connector that consolidates and aggregates the TI data from Mandiant.
Why integrate Threat Intelligence tools into the Vulcan platform?
Read all about the value you gain out of this integration here.
What do you get as a CISO/Security Engineer?
Actively seek critical new vulnerabilities that need attention today:
Filter to view the most recent vulnerabilities which have the highest Mandiant risk-rating and assign tasks by taking a remediation action on a vulnerability
Identify vulnerabilities that also exist in Mandiant TI
There is a dedicated Threat tag for the Mandiant risk score so you can identify if there is TI info from Mandiant and assess the related risk.
Explore CVE analysis comprehensively and take action
Look into CVE analysis by accessing the Mandiant TI data, the Vulcan TI data, available fixes, and related assets. Then, take your next-step remediation action based on the consolidated data in the Vulcan Platform.
Access aggregated and correlated CVE Threat Intelligence reports collected from Mandiant
Go to Vulnerabilities > Enter a vulnerability that has the Mandiant Risk tag > Click on the Threat Intelligence tab > Explore the Mandiant Reports:
Expand a report to get valuable details on the such as description, related CVE, attacking ease, and more.
The Reports are organized from the most recent and highest risk score to the oldest and lowest risk score
You are exposed to the most valuable cyber-related information from Mandiant consolidated into a concise block of information (Description, Risk rating, Exploit rating, Attaching ease, Exploitation consequence, Exploits, and related CVEs)
Configure the Mandiant connector
Prerequisites
To establish a sync between your Vulcan Platform and your Mandiant subscription, you will require Mandiant *v2 API credentials and must have a API audience subscription type in Mandiant.
*Note: Mandiant v2 API credentials are not currently available from the Mandiant user portal, so you will need to contact Mandiant customer support and request v2 API credentials for your Mandiant subscription.
Steps
In your Vulcan Platform, go to Connectors, and click Add a Connector.
Select the Mandiant connector.
Fill in the Public and Private keys of Mandiant.
Set the number of days to fetch past reports from Mandiant.
Enable / Disable Mandiant risk rating adjusted score. (Not sure what it means? See Mandiant Risk Score, Threat tags, and Risk Calculation)
Note: After the initial sync is complete (it might take some time), the connector will sync once a day to bring new TI reports from Mandiant.
Taking Action and Automating Remediation on Vulnerabilities
Large environments quickly become unmanageable if constant manual attention and effort are necessary to remediate vulnerabilities. You can take advantage of the automation capabilities of Vulcan Cyber and the Mandiant Connector.
Use the Threats condition to create automation based on Threat Tags and Attack Vectors, such as Threat Intelligence tags by Mandiant or Recorded Future.
Click here to learn how to create automation in the Vulcan Cyber Platform.
Mandiant Risk Score, Threat tags, and Risk Calculation
How is the risk score calculated when integrating with Mandiant?
The risk calculation in the Vulcan Cyber Platform might change only if you enable the "Mandiant risk rating adjusted score" option on the configuration page of the connector.
When enabled, the vulnerabilities that have the "Mandiant risk" threat tag will have a custom risk calculation as described in the table below:
Mandiant Threat tags | Risk calculation and score |
| 100 |
| 85 + 0.15 (15%) Tags score |
| The risk score in the Vulcan Cyber platform isn't affected |
| 10 + 0.3 (30%) Tags score + 0.2 (20%) Threat tags |
If a vulnerability has several CVEs and some of them have different Mandiant risk scores, what determines the Mandiant risk threat tag?
The CVE that has the higher Mandiant risk score determines the Mandiant risk tag the vulnerability gets.
For example, if there is a vulnerability that has 4 CVEs, 2 of which have a Mandiant risk score of Medium and one has Critical, the vulnerability will have the threat tag of Mandiant risk: CRITICAL.
What if I don't enable the "Mandiant risk rating adjusted score" configuration?
If not enabled, you'll still be able to see Threat Intelligence info as collected by Mandiant including the Mandiant dedicated risk tags on the relevant vulnerabilities. However, the MAX RISK score won't be affected by Mandiant TI at all. The MAX RISK score will be based on Vulcan TI and risk calculations.
What happens if a vulnerability is identified as Medium by the Vulcan Platform and High/Critical by Mandiant TI?
It means that the Mandiant research team has done some further research on the vulnerability and came to the conclusion that the risk is higher than we thought (i.e., higher than what the official threat intel sources report).