Integrations Overview

Use this document to understand integrations for Mandiant Security Validation (MSV):

• MSI Integrations (Supported and recommended for new integration configurations)
• Legacy Integrations (Supported for existing integration configurations)

MSI Integrations

See the following sections for more information:

• Overview
• Video overview
• Prepare your environment
• Supported technologies

Overview

Integrations are a primary component of the Security Validation platform. By integrating with third-party technologies, the platform receives events that let you measure the effectiveness of those solutions. You can integrate with technologies that broadly fall into one of the following main categories:

• SIEM
• Database
• DevOps
• Endpoint
• Network
• Database
• Threat Detection
• Device Management

For Security Validation (Mandiant Advantage Security Validation (MA-SV) and supported releases of MSV), use the Direct and Remote Integrations tables to take advantage of the latest Integrations platform. 

Direct and Remote Integrations Tables in Security Validation

Benefits of MSI integrations

• New and updated Integrations: The Mandiant integrations platform covers an array of integrations and security technology platform versions.
• Frequent updates to Integrations: In addition to updates that occur in Security Validation releases, improvements and bug fixes are released in the latest security update.
• Low-touch configuration: Mandiant provides in-product help that is specific to your integration and a change log showing any relevant updates to the Integrations platform.
• Notification flood protection: On Legacy Integrations, only specific third-party technologies let you control notifications. For Direct/Remote Integrations on the modern platform, regardless of the technology you're integrating into Security Validation, you get control over the limits on event and alert notifications.

Direct and Remote Integrations

• Direct: Any third-party security technology that the Director can connect to directly without having to use the Director to Actor communications.
• Remote: Any third-party security technology that the Director needs to connect to over a Director-to-Actor communication channel.

Adding an integration using the Direct Integration approach doesn't always work because communication is prevented by network boundary issues. In that case, you can configure a Remote Integration. Remote Integrations are integrations that are installed on a Security Validation platform Actor that then communicates over a network boundary through an integrated proxy function.

Video overview

Prepare your environment

Prerequisites

• On-prem only: Direct and Remote MSI Integrations require Mandiant Security Validation (MSV) 4.13.0.0 or later
• Remote Integrations: You must meet the requirements listed in Configure Remote Integrations.
• Network requirements:
  • Standard deployments: If you have a cloud technology behind an access control list (ACL) on a firewall or other network security system, add the following egress IP address to your ACL: 35.184.185.156
  • Hosted Director deployments: If you're on a Hosted Director (https://d01-cxxx.verodin.cloud), your egress IP address is different from standard deployments. Work with your account representative to determine this value and what needs to be opened on your firewall infrastructure for MSI integration support.
• User access: Users require either System Admin or Power User privileges to configure Integrations. For more information, see Security Validation User Groups and Permissions.

Variable mappings

As you move from Legacy Integrations to MSI Integrations, note the following variables that need to be changed:

IPS = "%IPS%"
ACTOR_IPS = IPS
HOSTNAMES = "%HOSTNAMES%"
ACTOR_HOSTNAMES = HOSTNAMES
DOMAINS = "%DOMAINS%"
EMAIL_SENDERS = "%SENDERS%"
EMAIL_RECIPIENTS = "%RECIPIENTS%"
USER_ACCOUNTS = "%USER_ACCOUNTS%"
START_TIME = "%START_TIME%"
END_TIME = "%END_TIME%"
LIMIT = "%LIMIT%" # used for sql integrations
OFFSET = "%OFFSET%" # used for sql integrations

Limitations

• An Integration (Direct or Remote) that includes a proxy cannot be edited. Clicking Save does not save the changes and the Edit Integration dialog remains on the screen. As a workaround:

  1. Temporarily remove the proxy from the integration configuration (For the Proxy field, select None - No Proxy Profile and save the changes to the integration configuration.

  2. Once the changes are saved, edit the integration configuration again to add the proxy information. Save your edit.

Supported technologies

Security Validation provides Integrations for common security technologies. While all integrations have some shared configuration, there are differences. The Integrations user interface walks you through the entire configuration. Differences include available queries, variables that can be used, and fields used in mapping events from your technology to the integration in the platform. Non-SIEM integrations can also be identified as security technologies with prevention and detection settings.  

The Mandiant Advantage App for Splunk and The Mandiant Advantage App for QRadar can also be used with Security Validation. These apps let you view information from Security Validation directly in Splunk and QRadar using the Security Validation Overview and Details Dashboards.

The following tables show important information about all integrations, organized by type. Information, such as the name of an integration and minimum supported version (if applicable), is included. 

SIEM

Database

DevOps

Endpoint

Network

Threat Detection

Device Management

Legacy Integrations

Integrations are a primary component of the Validation Platform. By integrating with security devices, the platform receives events that allow you to measure the effectiveness of those devices. You can integrate with the following types of security devices:

• Security information and event monitoring (SIEM) solutions
• Intrusion detection systems (IDS)
• Intrusion prevention systems (IPS)
• Firewalls
• Data loss prevention solutions (DLP)
• Log management platforms
• Threat Intelligence Platforms (TIPs)
• Threat Intelligence Feeds (TIFs)

The TIPs and TIFs are part of the Threat Actor Assurance Module (TAAM) and are used to pull in information for Threat Actors. For all others, the platform gathers empiric data on detections and event generation when Jobs are processed.

Mandiant Advantage Security Validation (MA-SV) has Integrations for over 50 different technologies. While all integrations have some shared configuration, there are differences. This includes available queries, variables that can be used, and fields used in mapping events from your technology to the integration in the platform. Non-SIEM integrations can also be identified as security technologies with prevention and detection settings.  Mandiant Advantage for Splunk can also be used with Security Validation, allowing you to view information from Security Validation directly in Splunk using the Security Validation Overview and Security Validation Details Dashboards.

This video walks you through configuring integrations in the Mandiant Advantage Security Validation (MA-SV) platform.

Network requirements

If you have a cloud technology behind an access control list (ACL) on a firewall or other network security system, add the following egress IP address to your ACL:

• 34.135.50.52
• 34.41.192.72

Additional resources

To help you with your integration configuration, the following topics are available:

• Integration Queries Overview
• Variables used in Integration Queries
• Integrations - Field Details

Supported technologies

The following tables display important information about all integrations, organized by type (SIEM, Network, Endpoint, and TAAM). Information such as an integration's name, vendor, minimum supported version, remote capability, and proxy support capability, is included. Integration technologies may be listed in more than one table.

If the supported version/API is listed as "N/A", it means that the technology either does not have versions or that a specific version is not needed for the Security Validation integration to work. If the supported version/API is listed as "All", it means that all versions of the technology work with the Security Validation integration.

SIEM

1If you see Yes^* for Proxy support, it does not include Socks and NLTM.

Network

2If you see Yes^* for Proxy support, it does not include Socks and NLTM.

Endpoint

3If you see Yes^* for Proxy support, it does not include Socks and NLTM.