Prerequisites

Access requires users have access, and a valid authentication. Users must be provided access and authentication from the organization’s administrator(s).

Steps

1. On the main page of Google Threat Intelligence Platform, go to the Left Navbar to select Threat Graph option in the menu.
2. The Threat Graph page will appear. 
3. There will be three options available:
   1. New Graph
   2. Search Query Bar
   3. Access to Graphs
4. Users will need to understand what Nodes and Relationships are. 
5. Each node in the graph represents an entity. There are 5 basic entity types:
   1. Files
   2. Domains
   3. URLs
   4. IP Addresses
   5. Relationship Nodes
6. Nodes and Entities that have one or more detections from any Anti-virus system, will be marked in Red. Onces that do not, will be marked in Gray.
7. Files are represented as a rectangular shape with a representation of the file inside. 
8. Domains are represented using the domain favicon, if available. 
9. URLs are represented using the following icon. 
10. IP Addresses are represented using the flag for its country. If Google TI can’t detect the country from which the IP address is from, it will represent it as a black rectangle. 
11. Relationship Nodes are represented with a circle containing a representative icon inside. 
12. Each Node will have an arrow to link a Relationship Node to another Node. 
13. Once a Node is selected the left panel will show the relevant information related to it.
14. The panel will include information about the Node:
    1. Node Name
    2. Actions list
    3. Add to Collection
    4. Basic Properties
    5. Relations
    6. Detections
    7. Comments
15. The relevant information will assist users to expand relationships, find detection verdicts, comments, etc..
16. Multiple Nodes can be selected at the same time. There are two ways to select Multiple Nodes:
    1. Clicking on Multiple Nodes while pressing the SHIFT key. 
    2. Pressing the SHIFT key and click-dragging in the canvas.
17. There are actions that can be performed over the selected Node. Right-clicking over a Node will show a contextual menu with the same actions that can be performed from the left panel.
18. These actions include:
    1. Add to Collection
    2. Unpin Node
    3. Edit Label
    4. Hide Node Label
    5. Select Children
    6. Select Parents
    7. Highlight
    8. Full Expansion
    9. Add Connected Node
    10. Open Report
    11. Delete Node
19. Relationship Nodes are a single Node that can link to Multiple Nodes. It merges actions from both single and multiple node selection.

Relevant Documentation Links

• All Steps: https://gtidocs.virustotal.com/docs/get-started-threat-graph
• Additional Documentation:  https://gtidocs.virustotal.com/docs/threat-graph-nodes
• Additional Documentation:  https://gtidocs.virustotal.com/docs/threat-graph-nodes#color-coding-of-nodes-and-edges
• Additional Documentation:  https://gtidocs.virustotal.com/docs/threat-graph-nodes#node

Prerequisites

Access requires users have access, and a valid authentication. Users must be provided access and authentication from the organization’s administrator(s).

Steps

1. On the main page of Google Threat Intelligence Platform, go to the Left Navbar to select Threat Graph option in the menu.
2. The Threat Graph page will appear. 
3. There will be an option to Search for Threat Graphs in a Search Query bar at the top of the page. 
4. Users can Search by:
   1. Name
   2. Owner
   3. Description
   4. Tags
5. Multiple entity identifiers can be searched at the same time if users press the space key between each of them.
6. Users can Search through Threat Graphs by selecting the Access to Graphs dropdown menu below the New Graph button. 
7. Users can select between:

1. 1. All Graphs (Public and Private Graphs)
   2. My Graphs
   3. My Group Graphs

Relevant Documentation Links

• All Steps: https://gtidocs.virustotal.com/docs/get-started-threat-graph
• Additional Documentation: https://gtidocs.virustotal.com/docs/threat-graph-search

Prerequisites

Access requires users have access, and a valid authentication. Users must be provided access and authentication from the organization’s administrator(s).

Steps

1. On the main page of Google Threat Intelligence Platform, go to the Left Navbar to select Threat Graph option in the menu.
2. The Threat Graph page will appear. 
3. Users can Start a New Threat Graph by selecting the New Graph button on the top left corner of the page. 
4. Another option to Start a New Threat Graph is by conducting a search for an Entity in the Search Query bar. 
5. Users will see a list of Graphs that matches the query. 
6. When a Graph is open, user can start a New Threat Graph, by selecting an Entity or Threat Graph. Once a selection is made, users will select File tab in the top left corner of the page. 
7. A drop down menu will appear and there will be two options, to select a New Blank Graph or New Graph from Selection.
8. To add Nodes to an existing Threat Graph, users can:
   1. Add New Node (Top of Threat Graph)
   2. Add IOC to Collection (Left-side Panel)
      • Search a Collection
      • Add to a New Collection
   3. Add New Node (Right Click in Threat Graph)
9. New Node Types available in the Add New Node dropdown menu includes:
   1. File
   2. Domain
   3. URL
   4. IP Address
   5. Collections
   6. Threat Actor
   7. Reference
   8. Attack Technique
   9. Attack Tactic
   10. Department
   11. Email
   12. Victim
   13. Device
   14. Port
   15. Service
   16. SSL Cert
   17. Wallet
10. Once a New Node Type is selected, users will enter a Name for the New Node.
11. To add the New Node to the graph, users will select Add Node.

Relevant Documentation Links

• All Steps:  https://gtidocs.virustotal.com/docs/get-started-threat-graph
• Additional Documentation:  https://gtidocs.virustotal.com/docs/threat-graph-search