Google Threat Intelligence

Hello Google Cloud Community,I would like to clarify a point regarding Google SecOps licensing.I have been reviewing the official documentation, including the "Applied Threat Intelligence overview" and "Emerging Threats overview." The documentation states that the Applied Threat Intelligence (ATI) and Emerging Threats features are available with the Google SecOps Enterprise Plus license.However, it is not entirely clear whether these features are excluded from the Enterprise license.Could someone please confirm my understanding?Is it correct that the Applied Threat Intelligence and Emerging Threats features are unavailable with the Enterprise license? Is the Enterprise Plus license strictly required to use them?Thank you in advance for your help.

Hi TeamAm looking to create outbound rule  from firewall to the GCTI IP.  So using the below lines in my rule as suggested by the SECOPS. Expecting your support on this for better understanding.    $feed.graph.metadata.entity_type = "IP_ADDRESS"    $feed.graph.metadata.product_name = "GCTI Feed"    $feed.graph.metadata.source_type = "GLOBAL_CONTEXT" 1. I would like to know how to validate the above lines and its values. If i do the UDM search i can able to see the   graph.metadata.source_type = "DERIVED_CONTEXT" and not the graph.metadata.source_type = "GLOBAL_CONTEXT"Since i have the source type : Mandiant Threat Intelligence. (Refer : Below Snap-2)  3. How i can confirm GCTI feeds are integrated. 4. Is the feeds are updated at any frequency or feeds are updated live. Snap:1

 Day 4: Hunting Gamaredon-Related Document Activity This Google Threat Intelligence search query is designed to find files that match a specific set of characteristics, generally indicative of a particular type of malware or activity. (type:document) and (behavior_processes:*.ru* and behavior_processes:*DavSetCookie* and behavior_processes:*http*) and (behavior_network:*.ru* or embedded_domain:*.ru* or embedded_url:*.ru*)  

 Day 1: Google Threat Intelligence search a day keeps the phishing away… This Google Threat Intelligence search query is designed to find potentially malicious or misleading domains that are similar to netflix.com but are not the official domain itself. entity:domain fuzzy_domain:netflix.com and not domain:netflix.com creation_date:90d+  Query Breakdown: The query uses specific search modifiers (

 This query is designed to identify and block the Command and Control (C2) domains used by the Gamaredon (also known as Primitive Bear or UAC-0010) threat actor, a highly persistent group with reported ties to Russia, often targeting entities in Ukraine. entity:url tld:ru path:"/DESKTOP-*" (have:communicating_file or have:refer

 This sophisticated search is designed to unmask active file delivery domains used by threat actors in targeted espionage campaigns against sensitive UK sectors like the Ministry of Defence (MOD), National Health Service (NHS), and His Majesty's Revenue and Customs (HMRC). entity:url (hostname:"*-govuk*" or hostname:"*mod-uk*"

 This search is designed to identify files that use a specific, hardcoded User-Agent string during their dynamic analysis, which is the tell-tale signature of a Cobalt Strike beacon attempting covert Command and Control (C2) communication. entity:file behavior:"Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2)

 This targeted search is designed to hunt for files that are high-conviction malware but still rely on a valid, non-revoked digital signature. This often points directly to newly stolen code-signing certificates or fresh, high-trust payloads. tag:signed not tag:revoked-cert not tag:invalid-signature p:5+

 This search identifies files whose malware configuration contains SMTP or IMAP fields, which typically indicates the malware uses an email-based mechanism for communication or data exfiltration. malware_config:"smtp" or malware_config:"imap" Quer

 This targeted search is designed to provide an efficient, daily list of files that are newly uploaded, validated with multiple antivirus detections and high-quality sandbox reports, yet currently lack Sigma rule matches. This allows detection engineers to prioritize coverage gaps in their security monitoring infrastructure. p:5+ (sandbox_name:

 This search query is designed to hunt for newly created or emerging malware that specifically targets information (stealers) by leveraging Program Database (PDB) file metadata which is often overlooked but can contain revealing developer-left strings. entity:file metadata:".pdb" metadata:"stealer" p:5+ fs:30d+

 This Google Threat Intelligence search query is designed to identify newly created, algorithmically generated domains (DGA) with multiple positive detections, which were registered through a registrar frequently abused by threat actors. entity:domain p:5+ tag:dga registrar:"NICENIC INTERNATIONAL GROUP CO., LIMITED" creation_da

 This VirusTotal Intelligence search query is designed to identify IP addresses acting as potential Command and Control (C2) servers. It specifically targets infrastructure that is serving or being contacted by a small number of malicious files and uses newly issued self-signed SSL certificates—a strong signal of newly deployed or low-profile C2 infrastructure. 

 This Google Threat Intelligence search query is designed to find files that execute specific obfuscated PowerShell commands to download malicious payloads. This query relies on sandboxed behavioral analysis to detect the command at runtime, bypassing static obfuscation that can often evade simple scanners. behavior:"'; &('

 This Google Threat Intelligence search query is designed to identify currently active Dropbox URLs that directly download files and are already confirmed to be suspicious by multiple antivirus engines. entity:url url:dropboxusercontent response_code:200 have:downloaded_file p:3+ fs:7d+ Quer

Obtaining Google Threat Intelligence's unique attributes from the APITo successfully obtain the gti_assessment attribute within the JSON response, the inclusion of the x-tool header in your request is a critical requirement. This header is essential for uniquely identifying your specific tool or service. Without this vital component, the API will be unable to process your request correctly and, consequently, the gti_assessment attribute will not be returned in the JSON payload. Ensure that the x-tool header accurately reflects the identifier of your application or service to guarantee proper API functionality and data retrieval. The x-tool headerThe "x-tool" header is a critical component for authenticating and identifyi

 I have had a lot of trouble getting Lucene Text Queries to work in DTM Monitors. I have referenced the below pages and still have issues finding the info I need. I discovered you can search for individual Monitor Topic entity types (ex. “domain” entity type instead of entire Network Information), but this was from trial and error, the documentation does not write out this capability or the syntax it needs to be in. Also sections like “doc_type” values are not documented (ex. Shop Listings must be “shop_list”). There is also the Conditionals like “must contain” and many more, I cannot find how to add these values into Lucene Text Queries.Your Adoption Guide uses examples like:__type:"shop_listing" AND item_type:"CC"  messenger.name:telegram AND sender.telegram.user_id:6273****** email.headers.value:"@os-kh.de"I cannot find where these syntax requirements come from or the key values (why __type and where does item_type come fro

Hi Everyone! My name is Robert Parker and I'm a Technical Solutions Consultant with Google Cloud Customer Success.  I work with our customers in deploying and integrating Google Cloud Solutions, including Google Threat Intelligence. Within Google Threat Intelligence, we have a module known as Digital Threat Monitoring, which helps users to protect their organization against activity in the Darknet.  One of its capabilities, is Domain Protection Monitoring, which helps you to identify when threat actors are registering look-alike, or similar domains to your own organizations.  This is often a trick used in phishing campaigns, where threat actors try to trick their victims into visiting a spoofed (fake) copy-cat version of the trusted organization’s website. While DTM is great at identifying potential matches, or ones that do look similar your own domain, it’s not always immediately clear why it returned some of the results.  I often see this when a

OSINT (community/industry) articles in Google TI are automatically ingested from a set of trusted sources. They act as a powerful source of Threat Intelligence, transforming vast amounts of public threat data into actionable, contextualized insights that security teams can use for proactive defense and strategic planning. Users can now use the Submit your OSINT button in the Reports & Analysis left navbar menu option to share the URL. Upon submission, the system automatically processes the article to: Extract Categorization Fields (e.g., associated threat actor, malware families, targeted region, and industry) for reports where this information can be confidently identified Generate a Summary of the content via Gemini Extract All Mentioned IoCs (files, URLs, domains, IPs) Generate Relationships between the new report ob

Hi all, fairly frequent user of GTI seeking to understand how best to use it for Strategic level threat intelligence (generating product for execs, C-suite, business areas in order to inform high level decision making). At the moment, I consume the “strategic” or similarly tagged reports, create profiles for managing and track reports on a particular topic and use threat profiles to give a birds eye view of the threats to my organisation. I can then leverage the API to pull these into a threat matrix off platform when needed. I have three questions:1.) Am I missing anything? Does anyone have any creative uses for the platform in the strategic domain?2.) I like the industry and country threat assessments within GTI but have a question re the methodology, as the explainer does not seem to make sense. In theory, the methodology should spit out a score between 0 and 10. But when experimenting with the methodology, I can see the score going way beyond that. Fo

Artificial Intelligence (AI) is integral to many features within the Google Threat Intelligenceportal. This document consolidates and rephrases existing information, with links to originalsources provided at the beginning of each section. 1.) Gemini is making our Search feature more powerful.2.) Code Insights is creating reports on what malware is attempting to do.3.) Threat Profiles have more insights thanks to the embedded use of AI.Gemini in our Search feature:To simplify search, Gemini in Threat Intelligence redefines search with natural language,allowing users to quickly obtain AI-powered overviews of a topic by asking a naturallanguage question.When you perform a single-term search, such as "what is APT44", you will receive theGemini search summary

How can I provide feedback for GTI when it has misleading, confusing, or inaccurate assessments of IOcs.E.g. Comcast v4 IP addresses are indicated as IOCs. We’re testing some GTI-related rules in the SIEM and the results by volume are mostly nonsense. So filtering on our side is needed.This is to be expected but some IOCs are obviously misleading,