Mandiant Incident Response
By Google Cloud
Google Cloud's incident response and investigation service, acquired with Mandiant in 2022 and still sold under the Mandiant brand. Organizations can retain the team before an incident, and findings from investigations also inform Google's threat intelligence products.
Verified Source: 1
- Product type
- Managed service
- Deployment
- Hybrid
- Organization size
- Mid-marketEnterprise
- Pricing tier
- $$$
Capability checklist
DFIRHow Mandiant Incident Response measures up against the full Digital Forensics & Incident Response taxonomy.
- Endpoint & memory forensic acquisition — supported
- Captures disk, memory, and system artifacts for detailed forensic analysis.
- Timeline reconstruction — not supported
- Rebuilds the sequence of attacker actions across affected systems.
- Malware analysis — supported
- Analyzes malicious files to understand their behavior and origin.
- Incident response playbooks & retainer — supported
- Provides pre-built response procedures and on-call expert support during a breach.
- Evidence chain-of-custody — not supported
- Maintains legally defensible handling of evidence for potential litigation.
- Root-cause & scope analysis — supported
- Determines how an attacker got in and how far they reached.
Alternatives
Other Digital Forensics & Incident Response tools with overlapping capabilities, sized for similar teams.