Let's talk about Google Threat Intelligence! Learn from experts, share your insights, ask questions, and collaborate with peers. Whether you're a seasoned analyst or just starting out, your contributions are valued.
Recently active
Financial institutions face an ongoing battle against card fraud and credential leaks. A common challenge for security teams is identifying when Bank Identification Numbers (BINs) are leaked across underground channels. To address this, Google Threat Intelligence (GTI) provides advanced, real-time dark web search capabilities to gain direct visibility into illicit communication networks.This article details how to leverage GTI’s advanced dark web search capabilities to automate BIN leak monitoring, transitioning from manual searching to a scalable, automated pipeline. Harnessing Modern Dark Web Search Capabilities Google Threat Intelligence indexes underground communication platforms dynamically, allowing security teams to query massive volumes of raw dark web data using precise, granular filters. For a deeper understanding of these capabilities, you can review the Google Threat Intelligence Dark Web Guide.By interacting with these capabilities via the API, analysts can continuously sc
📣 New Feature Alert: Generate Threat Profile Recommendations directly from Splunk Events! 📣 With our latest release, you can now seamlessly map threat associations from IOC matches in Splunk directly into your Google Threat Intelligence (GTI) Threat Profiles! What’s New?By leveraging the Google Threat Intelligence for Splunk app, your administrators can automatically synchronize observed threats—straight from your Splunk Adversary Intelligence dashboard into your chosen GTI Threat Profile.Key Highlights: 🎯 Accurate & Noise-Free: The integration only sends automatically correlated data. Manual SPL query investigations are excluded to ensure your Threat Profile remains highly relevant and actionable. 🛡️ Comprehensive Coverage: Automatically sync specific threat association types including Threat Actors, Malware Families, Software Toolkits, and Campaigns. 🏷️ Clear Visualization & Filtering: Synchronized collections automatically populate in Google TI with "Observed" and "
Building true operational resilience requires moving faster than the threats you face. That starts with understanding exactly how adversaries are finding success, so you can use that intelligence to stop them.Today, we are proud to announce the release of the M-Trends 2026 report! Distilling insights from over 500k hours of incident investigations executed by Mandiant in 2025, and supporting Google Threat Intelligence Group (GTIG) research, this year’s edition reveals the critical shifts defining today's threat landscape. This post provides a quick preview of the themes from this year's report. Download the M-Trends 2026 report now for a comprehensive dive into our frontline data, and review the supporting resources below for more. The collapse of the "hand-off" window One of the most notable trends identified in Mandiant investigations is the increased specialization within the cybercrime ecosystem. In 2022, the median time between an initial access event and the hand-off to a seconda
Target Technology Watchlists are now in Public Preview for GTI customers. This capability allows you to easily track relevant intelligence based on your specific technology stack, driving focus to the threats that truly matter most.Key Benefits:Flexible Inputs: Simply drop a list of technologies or CPEs into your threat scenario to immediately get vulnerability intelligence alerts through the alert section in the org profile. Customizable Alerts:Receive notifications specifically for CVEs affecting the organization's tech stack. Rich Vulnerability Details: Every alert is enriched with full exploit context, including assigned priority, vulnerability Risk Rating, real-world Exploitation State, and more. Intelligence Context: Leverage direct integration with GTI vulnerability intelligence for full exploit context. Unified View & API Access: Access a unified alerts stream, fully available via API for programmatic and agentic workflows.For more information, please refer to the documenta
Hi Everybody! I’m developing a prompt that can help intelligence analysts and security professionals with assessing the malicousness of a URL or a Domain. I was inspired after working with one of my clients who asked me:“What workflow would you follow or things would you look at to determine if a domain was malicious?”After some back and forth using Gemini, I’ve settled on this current version of the prompt which uses a placeholder variable inside of Google Threat Intelligence to take the URL/Domain as an Input, follow a consistent analysis process, and set a consisten output generation template. Please feel free to use this prompt, or comment below on any recommended changes or things it should include. ### **System Objective & Role**You are an expert **Tier 2 Threat Intelligence Analyst**. Your objective is to conduct a comprehensive, highly accurate investigation on a suspicious domain or URL using *exclusively* Google Threat Intelligence (GTI) capabilities and context.### **
Hi dear community, we're an MSSP evaluating the Digital Threat Monitoring (DTM) module in Google Threat Intelligence as the digital-risk / threat-monitoring capability we offer to our customers. As part of the evaluation, we're benchmarking DTM against Intelligence X (intelx.io), which we currently use for this purpose, and we've run into some results we'd like to sanity-check with the community — and ideally with someone from the GTI/DTM team. ObservationAcross the topics, brands, and companies we research, DTM returns substantially fewer results than we expected — and consistently fewer than Intelligence X for comparable queries. The gap is large enough that we want to confirm whether this reflects how DTM is designed, or whether we're operating the tool incorrectly. Our questions1. Scope / design of the corpus Is DTM intended primarily as a curated, entity- and relevance-driven monitoring capability (optimized to reduce noise) rather than an exhaustive surface/deep/dark-web index li
In the May 25 release notes for Google Threat Intelligence, we introduced the concept of private knowledge collections, which allow you to create your own private instances of GTI objects like Malware, Campaigns, Threat Actors, and more.Creating these private objects allows GTI teams to blend localized threat intelligence with Google’s global dataset rather than waiting for vendor attribution. Some of the common use cases you might be interested in include creating a private collection based on the contents of a security blog or a PDF document that you are analyzing. An excellent way to implement this workflow is by leveraging the GTI MCP server in combination with “skills” to guide agents through the process of generating private collections based on these external resources.In this post you’ll find two agent skills: One for creating a private collection based on PDFs and another for creating a private collection based on a security blog. You can introduce these skills into your e
Hi, want to report annoying behavior of share.google in hope somebody from Google devs team can hook up and fix this security gap.Right now links to https://share[.]google/EnyBDZiv3ksnQT9xZ would lead to https://www.google.com/share[.]google?q=EnyBDZiv3ksnQT9xZ via 301 redirect by both HEAD & GET, but from that point https://www.google.com/share[.]google?q=EnyBDZiv3ksnQT9xZ - would reply with 302 redirect only on GET, and not HEAD, which is violation of RFC 9110 Section 9.3.2 and breaks automated systems from safely verifying destination link, which in case with share.google in 99% cases now used as obscurity platform to spread phishing, fraud, malware and other not good things.
I’m looking to set up a process that allows me to monitor a list of vendors and whether they show up in breaches - i.e.search a vendor name, website or email in GTI programmatically via API and see if theyre ivolved in breaches. Is that possible via GTI? What coverage for sources does GTI have if thats possible?
Does GTI have the capabilities to provide information on third parties that we specify - i.e. we want to track to see if our vendors have been breached - does GTI provide any capabilities via API to query breach info that is collated from open source feeds and any proprietary feds (e.g. the dark web)?
Hello Google Cloud Community,I am the founder of Meyra Digital Plant Health Clinic (DPHC), an initiative focused on supporting smallholder farmers with accessible, AI-powered plant health services.Our mission is to reduce dependency on chemical pesticides by providing farmers with natural, locally available solutions combined with intelligent diagnosis tools.We are currently exploring how to leverage Google Cloud to build a scalable and impactful system with the following components:Image-based plant disease detection using AI/MLAutomated advisory system for eco-friendly treatment recommendationsMobile-first delivery (Telegram bot / lightweight apps) for rural accessibilityScalable backend infrastructure for future expansionI would greatly appreciate guidance from the community on:The most suitable Google Cloud services for building and scaling this solution (e.g., Vertex AI, Firebase, Cloud Run)Best approaches for training or integrating plant disease detection modelsDesigning cost-ef
My production project is down and suspended for 48h now with no prior notice and no reply for my appeal request. Not sure what to do. We are facing a huge loss. I have audited all my code for any security leak and it is clean. Not sure what happened.
I have a SOAR playbook for investigating emails. As part of the playbook, domain and URL case entities are checked against static lists to see if they are:1 - Free Share Link sites2- Domains for free email services (e.g. gmail.com)3 - URL shorteners4 - A obviously benign entity, belonging to a trusted organisation such as bank e.g. jpmorganchase.comDoes GI check and report back whether submitted domain or URL IOCs belong to any of these categories, if the submission is done via API?
Hello everyone,I hope this is the right place to ask. We (Argos Security) have a question regarding GTI and the API-Usage. Right now our Company is on the plan "Integration Advanced" which gives us certain API-Allowance. Now, what we would like to do, which is impossible according to our Google-Contact, is to change our plan and Daily caps. I can not believe that, even with throwing in more money, it is supposed to be impossible to change our daily caps. Some products we do not need at all (Diff and Private Graph for example) while others we need a way higher cap (ASM for example). Could please someone give me a hint on who to contact to get this sorted out, if possible?
Hi Everyone!In support of my upcoming webinar later this week, I wanted to post the Custom Prompt I developed which I use to help convert Advanced IOC Searches into YARA-X Queries used in Livehunting inside of Google Threat Intelligence. Feel free to use this query and save it as part of your prompts library so you can consistently use this to help you convert IOC Searches and their modifiers into Livehunts. Role: Act as a Senior Threat Intelligence and Malware Analyst and YARA-X Engineering Expert specializing in Google Threat Intelligence and LiveHunting deployments. You have deep expertise in writing highly performant, syntax-perfect rules that scale across massive data streams without causing performance degradation or high false-positive rates. You are a master of converting Advanced IOC Searches from Google Threat Intelligence into Livehunt rules using YARA-X.Action: Translate the provided Advanced IOC Search logic into a fully functional, highly optimized YARA-X rule ready for
How can I forward alerts from My Landscape Organization Profile in GTI to create JIRA tickets.
Hello all,Can GTI be used to determine whether a certain IP or domain is linked to bulletproof hosting or commercial VPN services?Alternatively, is it possible to enrich IPs or domains with any ports or services being run/open on them? Akin to what this Microsoft endpoint would do - https://learn.microsoft.com/en-us/graph/api/resources/security-hostport?view=graph-rest-1.0
Hello everyone,I’m exploring Google Threat Intelligence capabilities and I want to understand if it’s possible to set up custom rules or alerts that specifically track vulnerabilities for particular products (e.g., a certain software or hardware vendor).For example, I’d like to be notified whenever a new CVE affecting a specific product is reported, rather than monitoring general threat feeds.Is there a way to configure Google Threat Intelligence to focus on selected products? Are there any best practices or limitations I should be aware of?Thanks in advance for any guidance!
While ingesting the GTI ioc’s to secops observed a below where we are able to fetch the logs from the GTI and unable to ingest to secops.textPayload: "Error occurred while fetching and ingesting malware data. Error: SSLError(MaxRetryError("HTTPSConnectionPool(host='chronicle.asia-south1.rep.googleapis.com', port=443): Max retries exceeded with url: /v1beta/projects/ [removed by moderator] /locations/asia-south1/instances/1eae0894-b5ea-4413-85de-42aaf69dc3233/logTypes/GCP_THREATINTEL/logs:import (Caused by SSLError(SSLEOFError(8, 'EOF occurred in violation of protocol (_ssl.c:2427)')))"))"
We recently deployed an automated Health‑ISAC → Google SecOps (Chronicle) ingestion pipeline using the following components:Health‑ISAC STIX/TAXII 2.1 collections Cloud Run (Python 3.9) for TAXII polling, indicator transformation, and Chronicle ingestion Cloud Scheduler (cron: */60 * * * *) Secret Manager for Chronicle API Auth JSON + HITS_PASSWORD Terraform for provisioning (Cloud Run, Scheduler, IAM, WIF)The ingestion pipeline successfully executes every hour, Chronicle returns success response codes, and indicators are visible in the GCS export logs.IssueWhile ingestion logs/reporting confirm indicators are successfully pushed to Chronicle, indicators do not appear in the Chronicle UI:They are visible in Cloud Logging + GCS export Chronicle ingest API responds with 200 But the same indicators cannot be found in Chronicle (IOC Search, Entity Search, IOC Feed UI, or via UDM Search)
I’m looking for explanations, recommendations, or general guidance to help us achieve a more consistent and reliable experience when using the Research Tools and Monitors within Google Threat Intelligence.We regularly search for intelligence related to specific organizations using Digital Threat Monitoring Research Tools. A simplified example of a query we commonly use is below (in practice, we often include additional AND conditions to narrow the scope):domain:"company.com" OR group_brand:"Company"However, we’ve encountered several recurring issues and inconsistencies that make it challenging to reliably search for and analyze intelligence. I’ve outlined the primary concerns below.Observed Issues Inconsistent query execution The same query may time out multiple times before eventually succeeding. For example, running the same search five times may result in four timeouts followed by one successful execution. In other cases, a query will work without issue, but when rerun later (with
Hello Google Threat Intelligence Team,I would like clarification on how indicators are represented in the Active Threat Intelligence Feed within Google SecOps.Specifically, does the feed differentiate between: Primary (directly observed) indicators Associated (related infrastructure) indicators To clarify what I mean:A primary indicator would be an artifact that was directly observed in confirmed malicious activity. For example: A specific phishing URL used in an intrusion (e.g., hxxps://login-example[.]com/auth) A C2 domain actively used by malware in a breach A hash of malware recovered during incident response An associated indicator, however, might include: The IP address hosting that phishing domain (which may also host other benign domains) Additional domains resolving to the same infrastructure but not directly observed in the campaign Infrastructure sharing WHOIS, SSL certificate, ASN, or registration artifacts with the malicious domain A CDN IP address (e.g., infra
I have reported the domain to Google Safe Browsing multiple times and checked VirusTotal for malware or C2 botnet infection, but when I report it on https://safebrowsing.google.com/, I don't see any results indicating the domain is restricted.
Hello Cloudflare Sales Team,We are a cybersecurity company operating in Türkiye and actively provide services to multiple corporate brands.There are numerous phishing websites currently impersonating the brands we protect. Our request is specifically for Cloudflare to apply warning/interstitial notices to these malicious websites in order to protect end users.If this warning service can be provided quickly and efficiently, we would like to proceed with a commercial collaboration and purchase this service from Cloudflare.For your reference, screenshots of sample phishing websites are included in the attached file.We kindly ask you to share further details regarding: Service scope and availability Commercial terms Onboarding and next steps We look forward to your response.Kind regards,
Why does Mandiant make it so hard to opt-out from their attacks? They do not provide any reverse DNS for their attack points, thus hiding their identity behind fake or hosted whois data
Already have an account? Login
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
