Mandiant Advantage Reviews

I'm using Mandiant Advantage for digital monitoring of our brand protection and our digital entities, in addition to tracking APT groups, cybercrime groups, and some other threat actors. I use it for intelligence and threat intelligence.

I'm not using Mandiant Advantage's AI-driven analytics.

Mandiant Advantage's effectiveness in providing real-time threat intelligence in my organization is quite good. The indicator feeds are great and the availability of the analyst is also good, making it near to real time.

I don't use Mandiant Advantage for incident response, and fortunately, I haven't had any incidents that needed to be responded to.

I've utilized the YARA rules on VirusTotal, which is the platform of Mandiant Advantage. This is the only automation I use.

The feature of Mandiant Advantage that I have found the most valuable is called AIA. It's not a platform; it's a service they sell. It's a dedicated intelligence analyst that works for the customer several days a week and works very closely to the needs of the customer, which I am.

Mandiant Advantage has helped me enhance operational efficiency overall because it enriched our SIEM, which is Splunk. Additionally, the YARA rules I wrote within the platform help me understand better what my threat landscape is.

I think Mandiant Advantage could be improved regarding their intelligence on fraud and cybercrime. Additionally, their platform should be better.

Mandiant Advantage's platform itself is not good yet. They have many bugs because they changed the platform, so from time to time it's simply not working at all. The UX is not good, and it's somewhat lacking in capabilities because they're counting on you to buy the service of the dedicated intelligence analyst.

Flexibility is another area for improvement in Mandiant Advantage.

I've been working with Mandiant Advantage for six years.

I have never had any outages, downtime, or any problems with Mandiant Advantage.

The level of stability and reliability of Mandiant Advantage so far is very high.

The scalability of Mandiant Advantage is good because the AIA service is flexible, making it quite high. The other solutions are not as scalable.

Since the AIA is a dedicated analyst, it's personal. Some of them are flexible and meet my needs, and some of them are not. So it really depends on the analyst you get. Mandiant's other services that we used in the past from Google and Mandiant were not flexible at all.

I almost never communicate with the technical support of Mandiant Advantage.

I usually use documentation for Mandiant Advantage; the documentation of VirusTotal is one of the best that I've seen.

Before Mandiant Advantage, I used a different solution for the same use cases called Rapid7, which was known as Insight. Now it's a solution of Rapid7. I also used a company called ClearSky, which is a local Israeli company that provides threat intelligence.

I am currently using ClearSky simultaneously with Mandiant Advantage.

I participated in the initial setup and deployment of Mandiant Advantage.

My deployment process with Mandiant Advantage was very simple and comfortable.

I don't recall if I used the help of an integrator, reseller, or consultant for the deployment.

On the Mandiant side, I did everything myself. On my side, I needed to do more work to make it more comfortable and efficient.

Before choosing Mandiant Advantage, I examined other options that I didn't end up choosing, including CrowdStrike. I examined CrowdStrike's AIA team, which is the parallel to the AIA at Google, but I didn't move forward with them because their price was higher than Google's.

I am an end user of Mandiant Advantage.

Mandiant Advantage's intelligence is good, and their service is good, but the price they charge is just too high. It's not that they're not supplying what they're selling; it's simply that the price is high, and putting a tag on that cost is somewhat problematic.

I would rate Mandiant Advantage an 8 out of 10.

I do not consider Mandiant Advantage an affordable solution at all. The prices are very high and very expensive.

The price of Mandiant Advantage is not justified. It's really expensive, and it's so expensive that I'm not sure I will continue next year with their service.

I have a good database of IOCs and behavior analytics. Once I integrate this with EDR on Enfolds, the tool provides in-depth traffic analysis through Mandiant. It also classifies techniques mentioned in Maitre. This becomes handy when I am doing incident response and working on the manual part.

The live IOC feed identifies the type, technique, and tactics used. This becomes handy since then I know what to refer to from the playbook. For instance, if I take a use case of someone with Mimikatz installed on their system, knowing the nature beforehand reduces investigation time. I can quickly apply the playbook to resolve incidents in less time.

I have already given them feedback that their UI needs improvement since sometimes there is a lag. The side-by-side depiction of request response and action clogs the screen. Collaboration of data in my view becomes a bit clogged, requiring effort to understand visually.

I have used the solution for nearly four years.

I have never faced stability issues. They have a proactive team for support.

In support, they give a personal touch. They assign someone from their team when I am going for an investigation to assist me if required. I have personally interacted a few times with them, and they are technically sound. 

They are very cordial in expediting the entire process.

Positive

Prices are on the higher side, however, it justifies the cost. Competitors like CrowdStrike provide competitive pricing, but last year, their Falcon update led to Microsoft-based devices going offline.

If I have to rate this solution, I would put it at eight out of ten.

I would advise others to consider their specific needs when evaluating the tool.

I use it for cyber threat intelligence. I gather information about newly created domains around the Internet that can be related to my managed company. I monitor these domains for any phishing activities. 

Additionally, I monitor the dark web and hacker forums for any mention of my serviced company or its users. I also check leaked databases on the Internet and dark web for any leaks of sensitive information.

Mandiant Advantage is excellent at providing the full context and all the information, where the information was found, and the full data, including the raw data that was uploaded onto the Internet. 

It identifies exposed fields like passwords and personal information during attacks. The algorithm efficiently detects domains with slight variations, which might otherwise be overlooked.

Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives. More fine-tuning is required to handle famous company names. 

It also handles alerts slowly when there are many open incidents, and sometimes it opens the wrong incident. Optimization on the browser would be very nice.

I have been working with Mandiant Advantage for around one year and a half.

On the UI side, it deserves a six out of ten for stability. Operationally, I have not faced any issues. On the UI side, exploring information and writing queries can be unstable.

The scalability of Mandiant Advantage deserves a ten out of ten. There's no roof, and it can be scaled as needed without limitations.

I would rate the initial setup as seven out of ten. It requires data to be formatted in a certain way and provide the entire user database, which can be challenging. 

However, it's a smooth installation once the correct information is provided.

I would advise exploring multiple functions because there are many different capabilities of Mandiant Advantage. For small organizations, try every feature included in the package. Use known sources like Mandiant to improve the health of the organization, and automate security to reduce the need for many analysts. 

I rate the solution an eight out of ten overall. It has very good functionality, though stability in particular aspects can be improved.

We have an international workforce that spans 17 countries, but our centralized IT support is based on the East Coast of the United States. We can only respond to a compromised device or network system during our normal business hours. Mandiant gives us a SOC that's open 24 hours 365 days a year, so they can respond to any issue without us being involved.

Mandiant gives us peace of mind that their SOC will resolve issues when our core IT team is not online.

Mandiant's on-prem client is too processor-intensive, so it's putting a strain on the local device's CPU. When a scan is running on the device, the other processing tasks slow to a crawl. We're still trying to figure out the correct settings for the client. 

I have only been using Mandiant for about a month, but we have it deployed to half our organization. 

Deploying Mandiant Advantage was straightforward because the vendor did all the technical configuration. We only needed to deploy the client to our staff devices. It was pretty seamless. 

Mandiant's pricing seems to be on par with their competitors.

I rate Mandiant Advantage eight out of 10. It is so valuable to have someone performing these functions outside of our business hours when we don't have staff in the building. We've seen a lot of solid metrics on the amount of malware that it's detecting and resolving. We're pleased with it so far. 

Our biggest concern is that the client can be a resource hog and will slow things a bit while scanning if your computer doesn't have enough processing power. It works for us because we've spent the past few years upgrading our hardware. Our typical workstation has an i7 processor, at least 16 gigs of ram, and an SSD. However, if your computers aren't that robust, you might have issues when Mandiant is scanning your device. 

We use the solution for threat detection.

We initially worked primarily with Recorded Future, but now we're investigating the significant shift caused by Google's involvement. Google's involvement has provided Mandiant with more resources and increased its presence in a market previously dominated by CrowdStrike and Recorded Future.

Mandiant Advantage appears more modern than the two competitors, which seemed less agile. With funding from Google, Mandiant has significantly improved its flexibility and pricing options in the market.

Mandiant Advantage has focused on making their services more accessible for customers by simplifying the purchasing process. Their approach accommodates various customer needs, especially for those with complex requirements. This simplicity in buying is a significant advantage.

Threat intelligence remains fairly consistent across different providers, but Mandiant offers more capabilities in certain areas than competitors like Google, CrowdStrike, and Recorded Future. While my knowledge of their technology is not exhaustive, Mandiant appears to provide more comprehensive solutions in specific aspects.

To effectively utilize threat intelligence, it's important to have a clear plan for translating that information into actions. This involves defining what actions need to be taken, such as escalation procedures, reporting, and further workflows.

Mandiant Advantage can integrate with various systems, such as SIEM or SOC tools. For instance, integration with ServiceNow or similar platforms allows SOC teams to receive actionable alerts and response suggestions. This ensures that relevant teams can act promptly when potential threats are detected, streamlining the response process and enhancing overall security operations.

We recommend Mandiant Advantage for large industries, including the top fifty companies in Norway. For example, the national railroad system and one of the largest accounting firms in Europe—second only to SAP—have recently reviewed this system. The system is relevant to financial and software companies, including those handling financial transactions and railroad services.

Only the largest organizations used such systems earlier, but now smaller companies are also exploring this option. We believe that affordability will improve, primarily as we work with a large public client negotiating agreements for the public sector. This move is expected to make these systems more accessible to smaller organizations.

The product is expensive.

CrowdStrike and Recorded Future had the largest market share. I've been working with Recorded Future for some years. Based on the install base, Mandiant has been a market leader and likely still is. However, with both Google and CrowdStrike gaining ground, these three will compete more frequently for larger tenders.

We've noticed that Recorded Future offers numerous modules, making it confusing for customers to determine what they need to purchase. Up to nine modules are available, and since each one comes with a significant cost, customers are concerned about the complexity of the pricing model. They are unsure whether their current model covers all their needs and are worried about potential scope creep if they add too many modules, which could lead to high costs.

While having multiple modules was useful in the past, it might now be more practical for providers to bundle these modules into packages, similar to what Google is doing. This approach could simplify the process and make pricing more transparent for customers.

The customer may want many features, but they likely don't need all of them. Earlier, it made sense to offer various modules, as not all customers require every option. For example, if Google bundles its services into fewer packages—say, three instead of six or nine. It simplifies customer decisions and helps avoid future pricing uncertainty. From a commercial and technological perspective, these options are similar, with all three highly rated reports. However, Google has an advantage due to its extensive network infrastructure, which provides superior intelligence from its networks.

Everyone is talking about AI and its applications. For instance, Microsoft's Copilot was highly praised and tested in large organizations, but the hype seems to have settled down a bit. On the other hand, Mandiant appears to be effective in triggering actions based on specific events. 

Overall, I rate the solution an eight or nine out of ten.

Our primary use case was monitoring the threat actors that our clients were concerned about. We also used Mandiant Advantage to map the infrastructure that the threat experts were using and monitor all the discussions involving the customer originating from these threat actors.

The feature I have found most valuable is directory monitoring. We experienced an instance of threat actors trying to ensure a complex and massive attack against our customer's infrastructure on the forum. That is, they were animating people on a formum. The solution alerted us to this two days ahead of the attack, which gave us plenty of time to prepare for it.

I think that the data query that is used for data cloud language should be improved. It's really hard to query actual data from the platform. The free tech search is also super slow and sometimes you have to wait for 20 or 30 minutes to get results. Because of this, I have to use a cloud language that is similar to the SQL language, both of which are quite hard to use.

I also think that the user experience is a bit damaged and can be improved since the platform is not as intuitive as it should be.

I have personally been using this solution for eight months. At my organization, it has been deployed in two instances, each lasting for four months. Both instances were part of a temporary contract with customers.

I have never had any issues with the solution's stability.

When it comes to the number of users, our clients had around 10,000 to 12,000 servers.

I would say that the initial setup process is straightforward. It's an easy setup since all you need to deploy is just an API key. There are three people involved in the deployment process. It's not difficult to maintain this solution.

When it comes to the pricing, I think Mandiant Advantage is cheaper than some regular features but more expensive than others. The attack surface and monitoring module is licensed depending on how many domains and IP addresses you want to monitor.

I would recommend this solution to other people especially when it comes to the monitoring feature.

Overall, I would rate this solution an eight, on a scale from one to 10, with one being the worst and 10 being the best.

They're in the process of rebranding with Google. I get access to Mandiant Advantage as well as Manage Defense with our subscription. What they do is they go over, and they grab all the events out of Helix, do all the level one, two, and three checks on it, and then send over whatever is left over, which is typically very little.

I utilize it sparingly. The Managed Defense uses that information already and does a lot of the grunt work on the incidents that come in.

The advantage of the solution is being able to go look up threat actors and get a lot of detailed information about different attacks and different tactics and general information about threats. If I want to know what the biggest current threat is that they're seeing, I can go look. It's right there, and there's a good article on it, and it explains to me how to mitigate and how to look for stuff.

There are a lot of articles. I can just go into the interface and read what I need. 

It's stable.

The initial setup is straightforward.

The solution can scale. 

I don't use the solution very often, and therefore it is hard to say if areas are lacking. 

They could have better support. Now that they've merged, they are moving towards a portal system, which isn't very helpful. You used to get support via email, which was better. 

I use the solution occasionally. 

The stability is awesome. 

The solution is absolutely scalable. 

Technical support could be better. They ar removing toward offering support via a portal, which I do not like. 

While I wasn't at the company for the initial setup, we do have a very good representative who is amazing, and therefore the installation likely was flawless. 

We had a representative, who is highly skilled, handle the implementation, and their services are always excellent. 

I'm an end-user. I'd recommend the solution to others. 

They're now part of Google. They're going to start with integration and have 360-degree integration with QRadar, where all of the grunt work and analysis will happen elsewhere, and the security protocols will be with Mandiant. 

Everything is threat intelligence to me. If a company is going to use it and that's all they're going to use, they need to make sure they have enough time to read the articles. That's the big thing about the advantage. All of the information is there. You've got to just gotta go get it.

I'd rate the solution ten out of ten.