Unexpected GTI IOC matches on legitimate domains

Question

Hello,Since Friday evening, we have been receiving more than 400 daily alerts from a custom GTI IOC ( on domain) matching rule.Many detections involve well-known legitimate domains such as Microsoft, Google, GitHub, DigiCert and Windows Update. Before Friday, the alert volume was normal.We also noticed that the graph.metadata.threat field is now marked as deprecated in the YARA-L editor, but we could not find clear documentation about its replacement.Has there been a recent change to GTI GLOBAL_CONTEXT data or entity enrichment?What is the recommended replacement for graph.metadata.threat when matching GTI indicators in YARA-L?Is anyone else experiencing the same issue?Thank you.

hzmndt · Answer

seems i cannot find any document on this field graph.metadata.threat deprecation, i will check internally to confirm

https://docs.cloud.google.com/chronicle/docs/deprecations

From the rule editor:

threat field is deprecated and might not populate as expected.

metadata.threat

Deprecated: Usage of this field is discouraged for indicators of compromise. Use the threat_intel field instead.

Please try graph.metadata.threat → graph.metadata.threat_intel first

Sign up

Login with SSO

Login to the community

Login with SSO