Skip to main content

Google Threat Intelligence

Let's talk about Google Threat Intelligence! Learn from experts, share your insights, ask questions, and collaborate with peers. Whether you're a seasoned analyst or just starting out, your contributions are valued.

  • 45 Topics
  • 46 Replies
45 Topics
Joseliyo_Jstnk
Staff
Joseliyo_JstnkStaff
posted in Google Threat Intelligence
Supercharging Your Threat Hunts: Join Google Threat Intelligence at Labscon for a Workshop on Automation and LLMs

We are excited to announce that our colleague Joseliyo Sánchez, will be at Labscon to present our workshop: Advanced Threat Hunting: Automating Large-Scale Operations with LLMs. This workshop is a joint effort with SentinelOne and their researcher, Aleksandar Milenkoski.In today's rapidly evolving threat landscape, security professionals face an overwhelming tide of data and increasingly sophisticated adversaries. This hands-on workshop is designed to empower you to move beyond the traditional web interface and harness the full potential of the Google Threat Intelligence API for large-scale, automated threat intelligence and hunting.We will dive deep into how you can use the Google Threat Intelligence API with Python and Google Colab notebooks to automate the consumption of massive datasets. You'll learn how to track the behaviors of advanced persistent threat (APT) actors and cybercrime groups through practical, real-time exercises.A key part of our workshop will focus on leveraging L

441
matthewnichols
Community Manager
Dmitry_Sarakeev
Staff
Dmitry_SarakeevStaff
posted in Google Threat Intelligence
Google Threat Intelligence support transition to Google Cloud console

Hi Google Cloud Security Community Users,We want to use this forum to inform you of upcoming changes to how technical support is provided for the Google Threat Intelligence service.To ensure continuous support, all Google Threat Intelligence customers must transition to receiving technical support through the Google Cloud console no later than December 2, 2025.The transition from submitting Technical Support cases through the VirusTotal Contact Us Form to using the Google Cloud console is expected to take time and we’ve provided additional information below to guide you through this transition.What you need to knowGoogle Threat Intelligence support transition to Google Cloud consoleSeptember 2, 2025 - December 2, 2025: Transition Period: During this timeframe, GTI customers will be enabled to submit technical support cases for their Google Threat Intelligence service directly through the Google Cloud console. Cases submitted in the VirusTotal Contact Us Form will still be honored and

481
mdanowar
Ismahan
Staff
IsmahanStaff
posted in Google Threat Intelligence
How to Migrate from Mandiant’s to Google Threat Intelligence’s API

The Google Threat Intelligence API differs in several aspects from the Mandiant API. Nevertheless, the Google Threat Intelligence API encompasses all data available in the Mandiant API, in addition to further information.There are field name changes. There are different endpoints. There are new Google TI API Functionalities. Field Name Changes:It is important to note that while Google Threat Intelligence provides all information found in Mandiant API objects (and more), the JSON response objects have different structures. The following list shows the most popular objects and links to their respective documentation, where their JSON structure is defined:Indicators of CompromiseFileAdditionally, files can present a Sandbox analysis report represented by the File Behaviour object.URLDomainIP addressDifferent EndpointsAlthough different endpoints exist, Google Threat Intelligence offers comprehensive information equivalent to Mandiant API objects, and more. We have delineated the most comm

1673
mdanowar
L
lexrzasa1Bronze 4
asked in Google Threat Intelligence
New Scan Range to Allowlist

For the best results using Mandiant Attack Surface Management,  add the following IP addresses to your allowlists: 34.68.34.64/27 8.34.210.32/27 Visit the documentation for information on the Mandiant ASM scan rages.    

1666
jmarts
Staff
Rob_P
Staff
Rob_PStaff
posted in Google Threat Intelligence
How to Better Identify Typo-squatting Domains

Hi Everyone! My name is Robert Parker and I'm a Technical Solutions Consultant with Google Cloud Customer Success.  I work with our customers in deploying and integrating Google Cloud Solutions, including Google Threat Intelligence. Within Google Threat Intelligence, we have a module known as Digital Threat Monitoring, which helps users to protect their organization against activity in the Darknet.  One of its capabilities, is Domain Protection Monitoring, which helps you to identify when threat actors are registering look-alike, or similar domains to your own organizations.  This is often a trick used in phishing campaigns, where threat actors try to trick their victims into visiting a spoofed (fake) copy-cat version of the trusted organization’s website. While DTM is great at identifying potential matches, or ones that do look similar your own domain, it’s not always immediately clear why it returned some of the results.  I often see this when a customer asks me “Why did this domain

1872
CyberMarine
Staff
siva
sivaNew Member
asked in Google Threat Intelligence
:Looking for UNC3886 IoCs & Mandiant Subscription Info (Singapore Focus)

I’m reaching out to ask if anyone has insights into whether Mandiant has published any Indicators of Compromise (IoCs) for the UNC3886 threat group, particularly those linked to campaigns originating from or targeting Singapore.We’re currently assessing risk exposure related to this group and are interested in any published intelligence, reports, or threat data—especially around custom malware, zero-day exploitation, or region-specific activity.If you're aware of relevant Mandiant publications or datasets (public or available under subscription), I’d greatly appreciate the direction. Also, if anyone can share details about Mandiant's current subscription plans—especially those covering: Real-time IoCs Advanced malware analysis China-nexus espionage reporting Regional threat intelligence …please let me know.Happy to jump on a quick call if needed—just drop me a message.

1705
coabaja
Ismahan
Staff
IsmahanStaff
posted in Google Threat Intelligence
The Complete GTI Journey Playbook: Onboarding, Mastery, and Advanced Operations

Enhance your Google Threat Intelligence (GTI) expertise with our comprehensive resources and training, designed for both new and experienced users. Our comprehensive playbook will help you build foundational knowledge and apply it directly to your specific use cases, rapidly increasing your proficiency and ensuring effective product adoption. Here's how to get the most out of your GTI experience: Step 1: Kickstart your onboarding with the Google Cloud Security Community. Sign up and access our dedicated GTI onboarding guide to lay the groundwork for your understanding. Step 2: Engage with the GTI community forums. Participate in discussions on the Google Cloud Security Community to ask questions, share insights, and learn from other GTI users and experts. Step 3: Validate your practical knowledge with Skillboost. Sign up for Skillboost and complete the self-paced GTI training modules to earn badges that demonstrate your proficiency. This hands-on learning approach ensures you gain imm

2422
jmarts
Staff
Veeresh
VeereshNew Member
asked in Google Threat Intelligence
Degree of Domain Reputation and Suspensions

There has been a process in the GCP system that it is failing to accurately validate the reputation of the domain, and terminating the accounts automatically based on the single false positive reporting.There is absolutely no accountability taken neither by Firebase or GCP Team. Please share some details or stories about its resolution.

431
ErikaB
Community Manager
B
blakelpNew Member
posted in Google Threat Intelligence
New Google Threat Intelligence User!

Hi all! My organization just signed up for Google Threat Intelligence (GTI) and I'm excited to start using the product. Seems like it has some awesome capabilities. I'd love to start making connections with fellow users so we can share tips, best practices, and other information... Please feel free to reach out!- Mike

296
matthewnichols
Community Manager
Ismahan
Staff
IsmahanStaff
posted in Google Threat Intelligence
How to Query for Credential Alerts

This guide outlines three methods for precisely querying Credential Alerts from the Digital Threat Monitoring (DTM) API. Learn how to retrieve alerts by type, a specific monitor ID, or an aggregated bucket ID to build more efficient security integrations. How to Query for Credential Alerts When querying Credential alerts there are multiple methods to receive results. You can query based on the alert type. You can query based on the Credential Monitor ID. You can query based on the aggregated alert bucket ID.  Things to know before starting: Pagination The Digital Threat Monitoring (DTM) API paginates alert returns, with a default of 10 alerts per page. Users can increase this to 25 alerts per page using the "size" query parameter. For queries exceeding 25 alerts, subsequent pages are accessed via a HTTP Link Header in the API response, which provides the URI for the next results page. This Link URI must be used precisely as provided, as it contains essential pagination context,

680
Ismahan
Staff
Ismahan
Staff
IsmahanStaff
posted in Google Threat Intelligence
New in Google Threat Intelligence: Smarter Threat Detection, Deeper Insights

We’re excited to introduce several powerful new capabilities in GTI, all designed to help you investigate threats more efficiently and with deeper context. Below are some of the most impactful new features now available in GTI: Private URL Scanning In addition to file scanning, you can now submit URLs for in-depth analysis. GTI visits the page using a headless Chrome browser and collects a wide range of data—including screenshots, redirection chains, web trackers, downloaded files, JavaScript activity, and HTTP transactions. This rich, dynamic data is fully pivotable across the GTI dataset, helping you connect infrastructure, identify malware families, and attribute threat activity. You also have the option to run the URL in our dynamic analysis environments (sandboxes) to inspect any downloaded files in real time. Semantic SearchWe’ve introduced semantic search across key threat entities including threat actors, malware profiles, campaigns, vulnerabilities, and finished intelligence r

620
test_123_123
Eric_W
Staff
Eric_WStaff
posted in Google Threat Intelligence
How to use the API Documentation to Run API Queries

  Using the API Documentation to Run API Queries The API documentation offers a valuable feature: directly querying the REST API for Indicators, Reports, Alerts, Actors, Malware, Vulnerabilities, and other data. To get started, obtain your API key by logging into the Google Threat Intelligence (Google TI) portal, navigating to the 'API Key' section on the left side, and then visiting this URL: https://www.virustotal.com/gui/user/<your username>/apikey The key will be used in the x-apikey field in the documentation. To retrieve the Google TI Threat Score, provide a string in the x-tool field within the documentation. This string can be any value, such as “API_Docs_Testing.” Both the x-tool and x-apikey fields are located in the HEADERS section of the documentation’s query builder. The query builder also includes PATH PARAMS and QUERY PARAMS. Path parameters appear before the question mark in the query URL, while query parameters appear after the question mark. After buildin

410
Eric_W
Staff
TJA
Staff
TJAStaff
posted in Google Threat Intelligence
Hardening guidance from the resurgent UNC3944 (Scattered Spider) threat

Hey Community!  We have an upcoming webinar that you won't want to miss on May 21th 10AM EDT / 15:00 BST! This urgent webinar is focused on a critical cybersecurity threat: UNC3944, also known as Scattered Spider. As you may know, UNC3944 has resumed its ransomware and extortion operations, and they are currently targeting US retailers with the same aggressive tactics they used in the UK recently. I wanted to make sure you were aware of this immediate risk. These actors are particularly effective at circumventing mature security programs, using social engineering and third-party access to gain entry. We are hosting a webinar on May 21st at 10:00 AM EDT / 3:00 PM BST, Proactive defense against UNC3944: Hardening your enterprise, where Google Threat Intelligence Group and Mandiant experts will share actionable strategies to proactively defend against UNC3944's evolving tactics. In this webinar, you'll learn how to: Enhance Identity Security Fortify Endpoints & Cloud Strengthen

200
TJA
Staff
chrisproudley
Staff
chrisproudleyStaff
posted in Google Threat Intelligence
Why can't I view plaintext passwords in DTM?

This is a question that has come up more than once, particularly when DTM Research Tools is being used. It can also occur when viewing Compromised Credential Monitor Alerts. tl;dr this is by design, to protect any entity whose compromised credentials appear in DTM. There are steps you can take to view your own compromised credentials in a safe, controlled way.   First, a word on Research Tools: Research Tools enables users to safely explore open-source, dark web, and raw data that Google Threat Intelligence has collected for Digital Threat Monitoring. Providing raw threat and related data in an easy interface, Research Tools helps you find what matters, see what is happening in the cyber realm, and thus better protect your business. We recommend you use Research Tools as a precursor to creating a Monitor. This will help you create Monitors focused on what matters and reduce false positives. Source: https://gtidocs.virustotal.com/docs/research-tools &nbsp

150
chrisproudley
Staff
matthewnichols
Community Manager
matthewnicholsCommunity Manager
posted in Google Threat Intelligence
Unmasking the "Ghost in the Router": Deep Dive into UNC3886's Juniper Attacks

Hey Community!  We have an upcoming webinar that you won't want to miss on March 25th 8AM PDT! Mandiant's recent discovery of UNC3886's sophisticated campaign targeting Juniper routers has exposed a critical vulnerability. This China-nexus espionage actor is leveraging end-of-life device vulnerabilities to deploy custom backdoors, potentially compromising sensitive data. Want to understand the full scope of this threat and learn actionable steps to mitigate this threat?  Join our upcoming webinar, where Austin Larsen, Principal Threat Analyst, and Punsaen Boonyakarn, Cyber Security Consultant, will provide an in-depth analysis of UNC3886's tactics and the implications for your organization. We'll move beyond the headlines to explore: The technical details of UNC3886's router compromise techniques. The broader context of China-nexus actors targeting Juniper devices, including insights on UNC4841. Real-world impact scenarios and potential organizational consequences. Actionabl

440
matthewnichols
Community Manager
J
JeewanBronze 1
asked in Google Threat Intelligence
is GTI is replacing Virus Total ?

We are using VirusTotal Enterprise and I heard GTI is replacing Virus Total now from 2026. if this is true how this will impact us as an existing customer? Will I lose any functionality? price changes ?VT api will shut down next year and will be replaced by GTI API ? 

2155
kentphelps
Staff
matthewnichols
Community Manager
matthewnicholsCommunity Manager
posted in Google Threat Intelligence
Threat Intel Webinar Jan 14th!

Hey Security & Google Threat Intel enthusiast! We have a great webinar coming out next week on January 14th at 17:30CEST. It’s an exclusive live briefing on valuable insights into the threat landscape specific facing financial institutions, inferred from the curated real-time actionable threat intel from Google Threat Intelligence. Topics to be covered are… emerging threats and attack trends, and applying this intel to strengthen your orgs security posture. Check it out here to register. Enjoy!Matt

31
Rosemary_J
Staff
Sivasundar
SivasundarNew Member
posted in Google Threat Intelligence
Request for submitting an IDEA

With all new technologies in place, we still see latency across the board with medium scale servers and at times large scales too. Competitive business in the IT domain demands continuous server service. The present load balancers do balance the incoming load. But, has a threshold in balancing the load.Identifying a load controller and placing the device in the CLOUD infrastructure/ or for an independent server and configuring a logical way to streamline the ingress load (ensuring the source is alerted) and kept the queue to avoid further damage will ensure latency is avoided.With versatile load balancers and elasticized server methodologies for an application, we still witness and discuss about throughput/latency issues caused by an ad hoc load across the physical /cloud servers.Having critical sources invoking a complex server/application, an unpredictable load from various interfaces, the elasticity of server/application will always be in stake. Identifying a solution within the clo

11
kentphelps
Staff
ScienceCat
Staff
ScienceCatStaff
posted in Google Threat Intelligence
Skill Up With Google Threat Intelligence

Hello GTI Learners,  As a cloud security professional, you and your team need the right skills with the right tools to answer the critical questions. Is that a threat? How do we respond to threats? Where can we get deeper with cloud native threat intelligence? How can AI help us be faster and smarter? Just in time for the holidays and resolutions, Google Cloud would like to showcase our Google Threat Intelligence course, available now on Cloud Skills Boost. This intermediate level course is a fantastic way to skill up on what Google Threat Intelligence can do for enterprises working at cloud scale.  Whether a security team is big or small, multiplying their intelligence insights and responses is critical to a secure cloud. Our Google Threat Intelligence course will take you through the key topics and workflows of the tool set such as: What is Google Threat Intelligence? Incident Response  Gemini in Threat Intelligence Advanced Threat Hunting Digital Threat Monitoring At

372
cincyohio
matthewnichols
Community Manager
matthewnicholsCommunity Manager
posted in Google Threat Intelligence
Analysis of 2023 Time-to-Exploit Trends

Hey Intel Enthusiasts!  You're not going to want to miss this. Come check out the latest Mandiant exploited vulnerabilities disclosed in 2023 Mandiant analyzed 138 vulnerabilities that were disclosed in 2023 and that we tracked as exploited in the wild. Consistent with past analyses, the majority (97) of these vulnerabilities were exploited as zero-days (vulnerabilities exploited before patches are made available, excluding end-of-life technologies). Forty-one vulnerabilities were exploited as n-days (vulnerabilities first exploited after patches are available). While we have previously seen and continue to expect a growing use of zero-days over time, 2023 saw an even larger discrepancy grow between zero-day and n-day exploitation as zero-day exploitation outpaced n-day exploitation more heavily than we have previously observed.

10
matthewnichols
Community Manager
BrianK
Staff
BrianKStaff
posted in Google Threat Intelligence
Discovery Context type internet_archive_database

Recently questions have come up related to the discovery context entry of internet archive database and what that represents.  This information is being pulled from the internet archive / wayback machine API.  Sometimes you will find there are references here that still point to your organization's domains.    

20
BrianK
Staff
BrianK
Staff
BrianKStaff
posted in Google Threat Intelligence
Using Keyword Seeds with ASM

Since keywords may find things not related to your actual organization entities found are marked out of scope and displayed.  This means when using keyword seeds with ASM you will need to take any entities found that you are interested in being in scope and create or add to a collection with the appropriate seed type (domain or IP).      

70
BrianK
Staff
matthewnichols
Community Manager
matthewnicholsCommunity Manager
posted in Google Threat Intelligence
I Spy With My Little Eye: Uncovering an Iranian Counterintelligence Operation

Today Mandiant is releasing details of a suspected Iran-nexus counterintelligence operation aimed at collecting data on Iranians and domestic threats who may be collaborating with intelligence and security agencies abroad, particularly in Israel.  The data collected by this campaign may support the Iranian intelligence apparatus in pinpointing individuals who are interested in collaborating with Iran’s perceived adversarial countries. The collected data may be leveraged to uncover human intelligence (HUMINT) operations conducted against Iran and to persecute any Iranians suspected to be involved in these operations. These may include Iranian dissidents, activists, human rights advocates, and Farsi speakers living in and outside Iran.   Read More

20
matthewnichols
Community Manager
J
jjimenezNew Member
posted in Google Threat Intelligence
User management question

Hello, I am a the administrator of a new Google Threat Intelligence group, my question is how many users can we have in a group? and how can I add them?

81
fperdomo
Staff
D
davidjandersonNew Member
posted in Google Threat Intelligence
Migration from MATI to GTI

I'm a current MATI customer. What will the migration process to Google TI look like? Will there be any downtime or interruption to my service?

121
fperdomo
Staff

Badge winners

  • Comments Posted 5
    spanugantihas earned the badge Comments Posted 5
  • Authored Posts 1
    Cook942has earned the badge Authored Posts 1
  • Comments Posted 25
    bsalvatorehas earned the badge Comments Posted 25
  • Comments Posted 1
    masaya.gotouhas earned the badge Comments Posted 1
  • Comments Posted 5
    keiShas earned the badge Comments Posted 5
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.