New version
Mandiant Advantage Threat Intelligence (MATI) v5.35.6.3
Enhancement
We updated the Indicator of Compromise (IC) Score in Mandiant Advantage by transitioning to a new scoring engine that is powered by Google Threat Intelligence (GTI).
- Why: To provide you with a more accurate and reliable score based on a wider range of threat data from Google Threat Intelligence.
- What You Need to Do: Nothing. This is an informational update, and no action is required on your part.
Summary of change
We transitioned to a new, more advanced scoring engine. This new engine leverages the power of Google Threat Intelligence (GTI), which means the score will be informed by a much richer and more diverse dataset. The name "IC Score" still remains in the Mandiant Advantage web interface and API.
Why we made this change
Our primary goal is to provide you with the most accurate and actionable threat intelligence. By moving to the GTI-based scoring engine, we can:
- Improve Accuracy: The new scores are based on an advanced model and a broader set of data, resulting in a more precise assessment of threats.
- Consistency: This update helps us create a more unified threat intelligence model, ensuring the score is consistent with the assessments used across Google's security services.
What to expect
- Scores have changed: With the new, more accurate scoring mechanism, you will notice that the numeric value of the IC Score for some Indicators of Compromise (IoCs) has changed. Our testing indicates the new scores more accurately reflect the current threat landscape.
- No Downstream Impact: The way you use the score and the responses you get from our systems will remain the same. The API contract is not changing, so your existing integrations will continue to work without any modifications.
- Some Fields May No Longer Be Populated: In our effort to streamline and modernize, some nested data fields (like certain source information) that existed in the legacy system will no longer be populated. This is because the new system has a different data structure. However, the primary score value will be correct and more accurate.
- No Action Required: This is a backend change, and you do not need to take any action.