Mandiant ASM issue and its threat intel association

[ganeshsunkari]

When we have any issue or exposure as an alert from Mandiant ASM, can't we get details like threat intel association with specific ASM issue when we integrate this to secops.

[ylandovskyy]

Hey @ganeshsunkari ,

Can you elaborate what you meant by "threat intel association"? Also, can you share an example of Issue, which highlights your situation

[ganeshsunkari]

Lets say I have CVE exposure on the one of the public facing asset, when I am looking into the same log in secops, need to again look up in GTI manually to understand if this vulnerability is actively being exploited by any threat actor. Thinking it would be great if you can provide that enrichment in the secops like how you do it VT enrichment for files.

[ylandovskyy · Accepted solution]

@ganeshsunkari that makes sense. Soon we will release GTI integration, so you will be able to enrich CVEs that are a part of Alert using that integration.

Currently, you can use Mandiant Threat Intelligence integration for it. There is a useful widget.