Bring your Mandiant (Google Cloud Threat Intelligence) API key to SignalGuard to enrich the dark-web, Telegram, and news signals with apex-tier threat intelligence — including nation-state and APT coverage relevant to VIP protection and major-venue threat assessment.
What Mandiant adds to SignalGuard
Mandiant enriches three Chatter-pillar signals: dark web, Telegram threats, and news — three of the 50+ signals in SignalGuard's venue model. Mandiant's depth on nation-state activity, APT groups, and analyst-finished intelligence is the reference point for many enterprise security teams, particularly those working VIP protection or major-venue assessments where state-aligned threats are within scope.
For SignalGuard, Mandiant data adds a category of threat context that open-source feeds rarely surface cleanly — actor attribution, campaign linkage, and analyst-vetted source assessments. That sharpens severity scoring when a venue keyword or talent name crosses a Mandiant-tracked actor's reporting.
Most teams that operate in the apex-tier-threat space already have a Mandiant contract through Google Cloud. BYOK lets that investment flow directly into the venue-level threat score alongside weather, traffic, chatter, and context.
How the integration works
Paste your Mandiant API key into the Mandiant tile at /integrations. SignalGuard format-checks the key on submission (Mandiant's API is enterprise-only via Google Cloud) and stores it AES-256-GCM encrypted at rest. Real auth errors surface on first signal-time use.
Common use cases
- VIP-protection threat assessment with nation-state and APT context
- Major-venue threat briefings for high-profile political or diplomatic events
- Defense-industrial venue and corporate-campus event security
- Apex-tier severity weighting on dark-web mentions of executives
- Cross-source confirmation when multiple feeds flag a coordinated threat
- Analyst-vetted context for operator escalation decisions
What you need
A Mandiant Threat Intelligence contract via Google Cloud — typically $30K-100K+/yr. Generate API credentials from the Google Cloud Console under APIs & Services → Mandiant Threat Intelligence API. Reference docs at docs.mandiant.com.
FAQ
Do I need a Mandiant subscription? Yes — Mandiant enrichment is BYOK-only. Without it, SignalGuard's threat signals run on their default open-source aggregations.
Where do I add my key? In your SignalGuard workspace at /integrations. Open the Mandiant tile and paste your API key.
Is my key secure? Yes. Keys are AES-256-GCM encrypted at rest, decrypted only at request time in server memory, and never sent to the browser or written to logs.
Connect Mandiant
Connect Mandiant in your SignalGuard workspace → and review the signal docs for how threat signals feed Chatter.