Integrating Custom IOC Collection from Google Threat Intelligence into SecOps

Hello ​@desertfalcon,

I am not sure starting at which Secops license it is working, but for Ent+ I know that we have logs enrichment for file hash (under principal,src,target,observer fields) based on VT (https://docs.cloud.google.com/chronicle/docs/event-processing/data-enrichment#enrich-events-with-VirusTotal-file-metadata). This enrichment is automatically done during log ingestion process.

If you  want to use a custom threat indicators to enrich your logs it is also possible.

You will have to configure your log source feed with your TI source and if not existing, do a parser that will map the data from your TI to the relevant UDM using entity graph.

It is dependent on the tier of Secops you are using:

For Enterprise+ it is automatic, take a look here: Applied Threat Intelligence Overview

For Standard and Enterprise take a look here: GTI BYOL Integration Guide

HI ​@kentphelps , Thank you for your response. My question is specifically related to custom IOC collections we made inside google threat intelligence solution. Custom IOC collections include the IOCs we manually add inside google threat intelligence solution. My question is do we have a option to integrate those custom IOCs collections ?