Mandiant

Mandiant Alert Analysis API

The Alert Analysis API from Mandiant — 4 operation(s) for alert analysis.

Documentation GitHub OpenAPI

Business capability

Threat Detection & Response Management BC-620.30

Operations 5

PUT /alerts/{id}/analysis Update the analysis text on an alert #

GET /alerts/{id}/attachments List the file attachments for the alert #

POST /alerts/{id}/attachments Upload attachments to an alert's analysis #

DELETE /alerts/{id}/attachments/{attachment_id} Delete a file attachment from an alert #

GET /alerts/{id}/attachments/{attachment_id}/download Download a file attachment from an alert #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/mandiant:mandiant-alert-analysis-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Mandiant Alert Analysis API
  version: '1.0'
  contact: {}
  description: 'Operations tagged Alert Analysis across 2 of this provider''s published API definitions: mandiant-dtm-openapi.yml, mandiant-dtm-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.intelligence.mandiant.com/v4/dtm
security:
- My_API_Key: []
tags:
- name: Alert Analysis
paths:
  /alerts/{id}/analysis:
    put:
      description: Update the analysis text on an alert object. The empty string will clear out existing analysis. Markdown format can be used.
      operationId: put-alert-analysis
      parameters:
      - description: The content type of the body.
        in: header
        name: Content-Type
        required: true
        schema:
          enum:
          - application/json
          type: string
      - description: The ID of the alert to update the analysis on.
        in: path
        name: id
        required: true
        schema:
          example: c4huif0mhcmiku5g7jsg
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AlertAnalysisOp'
      responses:
        '200':
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Bad Request
          headers:
            Content-Type:
              description: Response body content type
              schema:
                type: string
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    message: unauthorized
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Unauthorized
          headers:
            Content-Type:
              description: Response body content type
              schema:
                type: string
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    message: forbidden
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Forbidden
          headers:
            Content-Type:
              description: Response body content type
              schema:
                type: string
        '500':
          content:
            application/json:
              examples:
                internal-server-error:
                  value:
                    message: internal server error
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Internal Server Error
          headers:
            Content-Type:
              description: Response body content type
              schema:
                type: string
      summary: Update the analysis text on an alert
      tags:
      - Alert Analysis
    servers:
    - url: https://api.intelligence.mandiant.com/v4/dtm
  /alerts/{id}/attachments:
    get:
      description: List the file attachments for a given alert.
      operationId: get-alert-analysis-attachments
      parameters:
      - description: The content type.
        in: header
        name: Content-Type
        required: true
        schema:
          enum:
          - application/json
          type: string
      - description: The ID of the alert to list attachments for.
        in: path
        name: id
        required: true
        schema:
          example: c4huif0mhcmiku5g7jsg
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FileAttachments'
          description: OK
          headers:
            Content-Type:
              description: The content type of the response body.
              schema:
                default: application/json
                example: application/json
                type: string
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Bad Request
          headers:
            Content-Type:
              description: Response body content type
              schema:
                type: string
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    message: unauthorized
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Unauthorized
          headers:
            Content-Type:
              description: Response body content type
              schema:
                type: string
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    message: forbidden
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Forbidden
          headers:
            Content-Type:
              description: Response body content type
              schema:
                type: string
        '500':
          content:
            application/json:
              examples:
                internal-server-error:
                  value:
                    message: internal server error
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Internal Server Error
          headers:
            Content-Type:
              description: Response body content type
              schema:
                type: string
      summary: List the file attachments for the alert
      tags:
      - Alert Analysis
    post:
      description: Upload one or more files to the alert's analysis. The following file type extensions are supported; doc, docx, xls, xlsx, pdf, png, zip, csv, txt
      operationId: post-alert-analysis-attachment
      parameters:
      - description: Multipart form data is used to upload one or more files to an alert analysis.
        in: header
        name: Content-Type
        required: true
        schema:
          enum:
          - multipart/form-data
          type: string
      - description: The ID of the alert to add the attachment to.
        in: path
        name: id
        required: true
        schema:
          example: c4huif0mhcmiku5g7jsg
          type: string
      responses:
        '200':
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Bad Request
          headers:
            Content-Type:
              description: Response body content type
              schema:
                type: string
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    message: unauthorized
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Unauthorized
          headers:
            Content-Type:
              description: Response body content type
              schema:
                type: string
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    message: forbidden
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Forbidden
          headers:
            Content-Type:
              description: Response body content type
              schema:
                type: string
        '500':
          content:
            application/json:
              examples:
                internal-server-error:
                  value:
                    message: internal server error
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Internal Server Error
          headers:
            Content-Type:
              description: Response body content type
              schema:
                type: string
      summary: Upload attachments to an alert's analysis
      tags:
      - Alert Analysis
    servers:
    - url: https://api.intelligence.mandiant.com/v4/dtm
  /alerts/{id}/attachments/{attachment_id}:
    delete:
      description: Delete an existing file attachment from an alert.
      operationId: delete-alert-attachment
      parameters:
      - description: The ID of the alert to delete the attachment for.
        in: path
        name: id
        required: true
        schema:
          example: c4huif0mhcmiku5g7jsg
          type: string
      - description: The ID of file attachment to delete.
        in: path
        name: attachment_id
        required: true
        schema:
          example: c4huif0mhcmiku5g7jsg
          type: string
      responses:
        '204':
          description: No Content
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    message: Unauthorized
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Unauthorized
        '404':
          content:
            application/json:
              examples:
                not-found:
                  value:
                    message: Not Found
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Not Found
        '500':
          content:
            application/json:
              examples:
                internal-error:
                  value:
                    message: Internal Server Error
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Internal Server Error
      summary: Delete a file attachment from an alert
      tags:
      - Alert Analysis
    servers:
    - url: https://api.intelligence.mandiant.com/v4/dtm
  /alerts/{id}/attachments/{attachment_id}/download:
    get:
      description: Download the file attachment from an alert.
      operationId: download-alert-analysis-attachment
      parameters:
      - description: The ID of the alert.
        in: path
        name: id
        required: true
        schema:
          example: c4huif0mhcmiku5g7jsg
          type: string
      - description: The ID of the file attachment to download.
        in: path
        name: attachment_id
        required: true
        schema:
          example: c4huif0mhcmiku5g7jsg
          type: string
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              description: The content type of the file attachment which is determined from the file upload itself.
              schema:
                type: string
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Bad Request
          headers:
            Content-Type:
              description: Response body content type
              schema:
                type: string
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    message: unauthorized
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Unauthorized
          headers:
            Content-Type:
              description: Response body content type
              schema:
                type: string
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    message: forbidden
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Forbidden
          headers:
            Content-Type:
              description: Response body content type
              schema:
                type: string
        '500':
          content:
            application/json:
              examples:
                internal-server-error:
                  value:
                    message: internal server error
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Internal Server Error
          headers:
            Content-Type:
              description: Response body content type
              schema:
                type: string
      summary: Download a file attachment from an alert
      tags:
      - Alert Analysis
    servers:
    - url: https://api.intelligence.mandiant.com/v4/dtm
components:
  schemas:
    AlertAnalysisOp:
      description: The analysis text for an alert. This can be in markdown format.
      properties:
        analysis:
          description: The analysis text that can be in markdown format.
          readOnly: false
          type: string
      title: Alert Analysis Operation
      type: object
    Response-message:
      description: Error response message.
      properties:
        message:
          description: The response message.
          type: string
      title: Error Response
      type: object
    FileAttachments:
      description: List of file attachments.
      properties:
        attachments:
          description: The list of file attachments.
          items:
            $ref: '#/components/schemas/FileAttachment'
          type: array
      title: File Attachments
      type: object
    FileAttachment:
      description: Metadata describing a file attachment.
      properties:
        content_type:
          description: The content type of the file attachment.
          readOnly: true
          type: string
        created_at:
          description: The time the file attachment was created.
          format: date-time
          readOnly: true
          type: string
        created_by_user_id:
          description: The user ID that created the attachment.
          readOnly: true
          type: string
        filesize_bytes:
          description: The size of the attachment measured in bytes.
          readOnly: true
          type: integer
        id:
          description: The ID of the file attachment.
          readOnly: true
          type: string
        name:
          description: The file name of the attachment.
          readOnly: true
          type: string
      title: File Attachment
      type: object
  securitySchemes:
    My_API_Key:
      scheme: bearer
      type: http
x-refined-from:
- mandiant-dtm-openapi.yml
- mandiant-dtm-openapi.yml