Skip to main content
Question

Unexpected GTI IOC matches on legitimate domains

  • August 31, 2026
  • 3 replies
  • 74 views
melissagr
Forum|alt.badge.img+4

Hello,

Since Friday evening, we have been receiving more than 400 daily alerts from a custom GTI IOC ( on domain) matching rule.

Many detections involve well-known legitimate domains such as Microsoft, Google, GitHub, DigiCert and Windows Update. Before Friday, the alert volume was normal.

We also noticed that the graph.metadata.threat field is now marked as deprecated in the YARA-L editor, but we could not find clear documentation about its replacement.

Has there been a recent change to GTI GLOBAL_CONTEXT data or entity enrichment?

What is the recommended replacement for graph.metadata.threat when matching GTI indicators in YARA-L?

Is anyone else experiencing the same issue?

Thank you.

3 replies

hzmndt
Staff
Forum|alt.badge.img+12
  • hzmndt
  • Staff
  • September 1, 2026

seems i cannot find any document on this field graph.metadata.threat deprecation, i will check internally to confirm 

https://docs.cloud.google.com/chronicle/docs/deprecations

 

From the rule editor: 

threat field is deprecated and might not populate as expected.

metadata.threat

Deprecated: Usage of this field is discouraged for indicators of compromise. Use the threat_intel field instead.

 

Please try graph.metadata.threat → graph.metadata.threat_intel first 

    melissagr
    Forum|alt.badge.img+4
    • melissagrBronze 5
    • Author
    • Bronze 5
    • September 1, 2026

    hi ​@hzmndt , Thank you 
    I tested the new field successfully. The valid syntax for High severity is:
    graph.metadata.threat_intel.severity = "SEVERITY_HIGH".
    However, "SEVERITY_CRITICAL" is rejected, so it appears that High is now the maximum severity level. Could you please confirm the complete list of valid enum values?

    hzmndt
    Staff
    Forum|alt.badge.img+12
    • hzmndt
    • Staff
    • September 1, 2026

    ​@melissagr Confirmed internally, please ignore the deprecated fields warning and continue to use the graph.metadata.threat field for now. We’re going to revert the changes for now. 

    Terms & ConditionsAccessibility statement
    Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

    © 2025 Google. All rights reserved.