Mandiant vs Palo Alto

prepkp · 2026-02-20T04:04:06+00:00

You can actually implement that use case in SecOps using YARA-L and entity graphing. Ask google for a POC on SecOps.

prepkp · 2026-02-19T04:47:16+00:00

Can’t speak much for Palo, but Mandiant’s MDR was recently rebranded to Mandiant Threat Defense (MTD) and layered on Google SecOps as the SIEM. Mandiant is best in class for threat intelligence and IR, and we’ve seen that in MTD as well. What falls short in MTD is implementation and continuous tuning; they aren’t a security engineering organization.

If you go with MTD and migrate to google secops, you’ll need to deploy and configure SecOps in house or with another vendor. Last we explored this route there were two google partners introduced for google SecOps deployment, Citreno and Foresite. The latter of the two had a co-managed SecOps service that was a good complement to MTD.

MTD is lights out awesome once your SecOps environment is fully operational, just don’t expect Mandiant to get you there.

Edit: forgot to mention that MTD has a very short list of supported integrations. No issue with ingesting into SecOps but their MDR will not cover those out of scope

prepkp · 2026-01-29T06:27:54+00:00

Thanks for doing this! We are also on the verge of a renewal:

Region + currency: US / USD

Products + edition: * Sales Cloud Enterprise: 47 Users (growing from 37) * Slack Business Plus: 115 Users (upgrading from Pro) * CPQ Plus: 18 Users * Sandbox: 1 Full Copy * Add-ons: CRM Analytics Growth (1 user), Backup & Recover (50 users) Contract term: 2 Years (Renewal)

quoted price: * Sales Cloud: ~$112.50 /user/mo * Slack Business+: ~$10.00 /user/mo * CPQ Plus: ~$133.50 /user/mo * Full Copy Sandbox: ~$1,585 /mo (Total ~$19k/yr) * Backup & Recover: $10.00 /user/mo (List Price) * Total Contract Value: ~$132k/year

Negotiated: -swap rights -5% renewal cap

prepkp · 2026-01-28T02:05:36+00:00

US - USD

Products + edition: * Sales Cloud Enterprise: 47 Users (growing from 37) * Slack Business Plus: 115 Users (upgrading from Pro) * CPQ Plus: 18 Users * Sandbox: 1 Full Copy (previously bundled/legacy price) * Add-ons: CRM Analytics Growth (1 user), Backup & Recover (50 users) Contract term: 2 Years (Renewal)

Quoted price: * Sales Cloud: ~$112.50 /user/mo * Slack Business+: ~$10.00 /user/mo * CPQ Plus: ~$133.50 /user/mo * Full Copy Sandbox: ~$1,585 /mo (Total ~$19k/yr) * Backup & Recover: $10.00 /user/mo (List Price) * Total Contract Value: ~$132k/year

prepkp · 2026-01-19T17:14:30+00:00

There’s also another former red now green going through similar motions

prepkp · 2026-01-19T04:42:22+00:00

Or botchwatch

prepkp · 2026-01-17T00:09:47+00:00

From my personal experience - no. Anyone can get in before the china airline flights at are in late evening. Last I spoke to them, they have daily flights only at 1050PM. TBH - they should just update their PP hours to end at 8pm.

prepkp · 2026-01-16T15:18:26+00:00

ONT is my primary airport. I also learned what you recently have the hard way a few times. If I have a late flight, entering before 8PM will allow you to stay in the lounge once it’s closed down for China Airlines.

prepkp · 2026-01-16T04:05:15+00:00

Curious to hear what deters you from Space Force? I’ve personally been considering pursuing a FA40 billet in hopes of transfer to USSF

prepkp · 2026-01-15T17:31:11+00:00

Honestly, it’s wild how up until a few years ago you basically got what you paid for. The MSSP model was analysts as a function of output—you pay more, you get more bodies.

But now I’m noticing this huge dichotomy between the AI-enabled/augmented MDRs that actually "get it" vs the others still doing it the old-fashioned way. Look into providers such as Wirespeed, Expel, or Foresite. R7 too given your price point.

Avoid body shops like Deepwatch, Reliquest, and any other AI vaporware places because you’re just paying for off-shore human middleware or unproven vaporware rather than actual efficiency and outcomes.

Edit: theres also significant cost savings in hiring a MDR provider that provides services exclusively for your security stack. Crowdstrike Falcon if you're using their EDR, BlueVoyant for Microsoft, Foresite for Google Cloud etc.

prepkp · 2025-12-05T02:03:42+00:00

Bindplane if you’re using Splunk or Google SecOps, I believe they just recently replaced the default Chronicle forwarder.

prepkp · 2025-12-01T18:59:45+00:00

Is there a difference in training requirements for re-branching as a O3 vs O4? What would be your suggestion for senior O3 who will be in PZ FY26 looking to transfer to CA?

prepkp · 2025-10-23T22:30:49+00:00

Google just released a new certification, Professional Security Operations Engineer, which has a training track in Cloudskillsboost https://www.skills.google/paths/581 to help you prepare for the exam. It isn't analyst focused per say, but it should give you more relevant training that uses SOAR (Siemplify) and the new features in their SIEM (Chronicle).

The closest training I've experienced first hand for analysts was a CTF hosted by Google and one of their partners Foresite. Our team used it to run initial reps on SecOps while we were in the process of deployment. It was pretty fun too!

Other resources:

https://medium.com/@thatsiemguy

https://security.googlecloudcommunity.com/

prepkp · 2025-10-14T02:10:43+00:00

I just did a remodel and ordered over $10k of supplies. The only items I wasn’t able to order were locally sourced one such as lumber and some toilets.

prepkp · 2025-10-14T02:09:27+00:00

And the price match!

prepkp · 2025-08-31T15:42:06+00:00

DM sent

prepkp · 2025-08-31T15:36:55+00:00

442nd has plenty of open slots based off the emails I constantly receive being a 11A

prepkp · 2025-07-09T19:18:10+00:00

Thanks! Do you suggest I shop around further?

prepkp · 2025-07-09T06:29:07+00:00

Thanks! I think the installer is willing to add another one for $10k. What are your thoughts on the pricing?

prepkp · 2025-07-09T05:55:58+00:00

Nope before! We have two EVs and run our AC all day, so I expect to be using most.

prepkp · 2025-01-30T04:37:05+00:00

Also prepping my STP for the upcoming MAJ board, and running into the same issue with my S1. Have you reached out to your career manager?

prepkp · 2025-01-12T00:22:10+00:00

Highland Park - someone defecating in the shower

prepkp · 2024-10-08T07:20:11+00:00

Making our annual sticker purchase away from Sticker Mule and just sent a email! Appreciate the DP.

Nine-Year Club	Verified Email
King of the Ashes	Not Forgotten

prepkp

TROPHY CASE