Google Threat Intelligence

Artificial Intelligence (AI) is integral to many features within the Google Threat Intelligenceportal. This document consolidates and rephrases existing information, with links to originalsources provided at the beginning of each section. 1.) Gemini is making our Search feature more powerful.2.) Code Insights is creating reports on what malware is attempting to do.3.) Threat Profiles have more insights thanks to the embedded use of AI.Gemini in our Search feature:To simplify search, Gemini in Threat Intelligence redefines search with natural language,allowing users to quickly obtain AI-powered overviews of a topic by asking a naturallanguage question.When you perform a single-term search, such as "what is APT44", you will receive theGemini search summary.Note: Gemini in Threat Intelligence search currently generates summaries exclusively fromGoogle Threat Intelligence reports, threat actor, malware, and campaign data. The Geminisummary is only displayed when relevant informati

How can I provide feedback for GTI when it has misleading, confusing, or inaccurate assessments of IOcs.E.g. Comcast v4 IP addresses are indicated as IOCs. We’re testing some GTI-related rules in the SIEM and the results by volume are mostly nonsense. So filtering on our side is needed.This is to be expected but some IOCs are obviously misleading,

Introduction This guide provides a high-level technical overview of GTI's core YARA-based hunting features. It is designed to help analysts understand the application of each tool in a typical threat intelligence workflow.For complete technical specifications, parameters, and API details, refer to the full, version-controlled documentation linked in each section. 1. LiveHunt: Real-Time Ingestion Stream Matching Function: LiveHunt applies a user-defined set of YARA rules against the real-time stream of files ingested and analyzed by Google Threat Intelligence.Mechanism: Rules are applied to every file submitted to GTI, including re-analyzed files. A match triggers an immediate notification, enabling real-time discovery. For PE files, LiveHunt performs automatic unpacking and scans both the packed and unpacked layers to increase detection efficacy. Primary Use Cases: Discovering novel malware not yet covered by public signatures. Classifying malware families based on custom ruleset

Authored by Raimundo Alcazar and myself, this guide is your resource for leveraging Google Threat Intelligence Profiles. Learn the practical steps to create and manage profiles that provide a clear, tailored view of the most relevant cyber threats to your business, helping you make smarter, faster security decisions. The link is live now. Do share with your customers and partners where GTI, Threat Profile topics comes up!

The Google Threat Intelligence API differs in several aspects from the Mandiant API. Nevertheless, the Google Threat Intelligence API encompasses all data available in the Mandiant API, in addition to further information.There are field name changes. There are different endpoints. There are new Google TI API Functionalities. Field Name Changes:It is important to note that while Google Threat Intelligence provides all information found in Mandiant API objects (and more), the JSON response objects have different structures. The following list shows the most popular objects and links to their respective documentation, where their JSON structure is defined:Indicators of CompromiseFileAdditionally, files can present a Sandbox analysis report represented by the File Behaviour object.URLDomainIP addressDifferent EndpointsAlthough different endpoints exist, Google Threat Intelligence offers comprehensive information equivalent to Mandiant API objects, and more. We have delineated the most comm

For the best results using Mandiant Attack Surface Management,  add the following IP addresses to your allowlists: 34.68.34.64/27 8.34.210.32/27 Visit the documentation for information on the Mandiant ASM scan rages.    

Hi Everyone! My name is Robert Parker and I'm a Technical Solutions Consultant with Google Cloud Customer Success.  I work with our customers in deploying and integrating Google Cloud Solutions, including Google Threat Intelligence. Within Google Threat Intelligence, we have a module known as Digital Threat Monitoring, which helps users to protect their organization against activity in the Darknet.  One of its capabilities, is Domain Protection Monitoring, which helps you to identify when threat actors are registering look-alike, or similar domains to your own organizations.  This is often a trick used in phishing campaigns, where threat actors try to trick their victims into visiting a spoofed (fake) copy-cat version of the trusted organization’s website. While DTM is great at identifying potential matches, or ones that do look similar your own domain, it’s not always immediately clear why it returned some of the results.  I often see this when a customer asks me “Why did this domain

I’m reaching out to ask if anyone has insights into whether Mandiant has published any Indicators of Compromise (IoCs) for the UNC3886 threat group, particularly those linked to campaigns originating from or targeting Singapore.We’re currently assessing risk exposure related to this group and are interested in any published intelligence, reports, or threat data—especially around custom malware, zero-day exploitation, or region-specific activity.If you're aware of relevant Mandiant publications or datasets (public or available under subscription), I’d greatly appreciate the direction. Also, if anyone can share details about Mandiant's current subscription plans—especially those covering: Real-time IoCs Advanced malware analysis China-nexus espionage reporting Regional threat intelligence …please let me know.Happy to jump on a quick call if needed—just drop me a message.

Enhance your Google Threat Intelligence (GTI) expertise with our comprehensive resources and training, designed for both new and experienced users. Our comprehensive playbook will help you build foundational knowledge and apply it directly to your specific use cases, rapidly increasing your proficiency and ensuring effective product adoption. Here's how to get the most out of your GTI experience: Step 1: Kickstart your onboarding with the Google Cloud Security Community. Sign up and access our dedicated GTI onboarding guide to lay the groundwork for your understanding. Step 2: Engage with the GTI community forums. Participate in discussions on the Google Cloud Security Community to ask questions, share insights, and learn from other GTI users and experts. Step 3: Validate your practical knowledge with Skillboost. Sign up for Skillboost and complete the self-paced GTI training modules to earn badges that demonstrate your proficiency. This hands-on learning approach ensures you gain imm

There has been a process in the GCP system that it is failing to accurately validate the reputation of the domain, and terminating the accounts automatically based on the single false positive reporting.There is absolutely no accountability taken neither by Firebase or GCP Team. Please share some details or stories about its resolution.

Hi all! My organization just signed up for Google Threat Intelligence (GTI) and I'm excited to start using the product. Seems like it has some awesome capabilities. I'd love to start making connections with fellow users so we can share tips, best practices, and other information... Please feel free to reach out!- Mike

This guide outlines three methods for precisely querying Credential Alerts from the Digital Threat Monitoring (DTM) API. Learn how to retrieve alerts by type, a specific monitor ID, or an aggregated bucket ID to build more efficient security integrations. How to Query for Credential Alerts When querying Credential alerts there are multiple methods to receive results. You can query based on the alert type. You can query based on the Credential Monitor ID. You can query based on the aggregated alert bucket ID.  Things to know before starting: Pagination The Digital Threat Monitoring (DTM) API paginates alert returns, with a default of 10 alerts per page. Users can increase this to 25 alerts per page using the "size" query parameter. For queries exceeding 25 alerts, subsequent pages are accessed via a HTTP Link Header in the API response, which provides the URI for the next results page. This Link URI must be used precisely as provided, as it contains essential pagination context,

We’re excited to introduce several powerful new capabilities in GTI, all designed to help you investigate threats more efficiently and with deeper context. Below are some of the most impactful new features now available in GTI: Private URL Scanning In addition to file scanning, you can now submit URLs for in-depth analysis. GTI visits the page using a headless Chrome browser and collects a wide range of data—including screenshots, redirection chains, web trackers, downloaded files, JavaScript activity, and HTTP transactions. This rich, dynamic data is fully pivotable across the GTI dataset, helping you connect infrastructure, identify malware families, and attribute threat activity. You also have the option to run the URL in our dynamic analysis environments (sandboxes) to inspect any downloaded files in real time. Semantic SearchWe’ve introduced semantic search across key threat entities including threat actors, malware profiles, campaigns, vulnerabilities, and finished intelligence r

  Using the API Documentation to Run API Queries The API documentation offers a valuable feature: directly querying the REST API for Indicators, Reports, Alerts, Actors, Malware, Vulnerabilities, and other data. To get started, obtain your API key by logging into the Google Threat Intelligence (Google TI) portal, navigating to the 'API Key' section on the left side, and then visiting this URL: https://www.virustotal.com/gui/user/<your username>/apikey The key will be used in the x-apikey field in the documentation. To retrieve the Google TI Threat Score, provide a string in the x-tool field within the documentation. This string can be any value, such as “API_Docs_Testing.” Both the x-tool and x-apikey fields are located in the HEADERS section of the documentation’s query builder. The query builder also includes PATH PARAMS and QUERY PARAMS. Path parameters appear before the question mark in the query URL, while query parameters appear after the question mark. After buildin

Hey Community!  We have an upcoming webinar that you won't want to miss on May 21th 10AM EDT / 15:00 BST! This urgent webinar is focused on a critical cybersecurity threat: UNC3944, also known as Scattered Spider. As you may know, UNC3944 has resumed its ransomware and extortion operations, and they are currently targeting US retailers with the same aggressive tactics they used in the UK recently. I wanted to make sure you were aware of this immediate risk. These actors are particularly effective at circumventing mature security programs, using social engineering and third-party access to gain entry. We are hosting a webinar on May 21st at 10:00 AM EDT / 3:00 PM BST, Proactive defense against UNC3944: Hardening your enterprise, where Google Threat Intelligence Group and Mandiant experts will share actionable strategies to proactively defend against UNC3944's evolving tactics. In this webinar, you'll learn how to: Enhance Identity Security Fortify Endpoints & Cloud Strengthen

This is a question that has come up more than once, particularly when DTM Research Tools is being used. It can also occur when viewing Compromised Credential Monitor Alerts. tl;dr this is by design, to protect any entity whose compromised credentials appear in DTM. There are steps you can take to view your own compromised credentials in a safe, controlled way.   First, a word on Research Tools: Research Tools enables users to safely explore open-source, dark web, and raw data that Google Threat Intelligence has collected for Digital Threat Monitoring. Providing raw threat and related data in an easy interface, Research Tools helps you find what matters, see what is happening in the cyber realm, and thus better protect your business. We recommend you use Research Tools as a precursor to creating a Monitor. This will help you create Monitors focused on what matters and reduce false positives. Source: https://gtidocs.virustotal.com/docs/research-tools &nbsp

Hey Community!  We have an upcoming webinar that you won't want to miss on March 25th 8AM PDT! Mandiant's recent discovery of UNC3886's sophisticated campaign targeting Juniper routers has exposed a critical vulnerability. This China-nexus espionage actor is leveraging end-of-life device vulnerabilities to deploy custom backdoors, potentially compromising sensitive data. Want to understand the full scope of this threat and learn actionable steps to mitigate this threat?  Join our upcoming webinar, where Austin Larsen, Principal Threat Analyst, and Punsaen Boonyakarn, Cyber Security Consultant, will provide an in-depth analysis of UNC3886's tactics and the implications for your organization. We'll move beyond the headlines to explore: The technical details of UNC3886's router compromise techniques. The broader context of China-nexus actors targeting Juniper devices, including insights on UNC4841. Real-world impact scenarios and potential organizational consequences. Actionabl

We are using VirusTotal Enterprise and I heard GTI is replacing Virus Total now from 2026. if this is true how this will impact us as an existing customer? Will I lose any functionality? price changes ?VT api will shut down next year and will be replaced by GTI API ? 

Hey Security & Google Threat Intel enthusiast! We have a great webinar coming out next week on January 14th at 17:30CEST. It’s an exclusive live briefing on valuable insights into the threat landscape specific facing financial institutions, inferred from the curated real-time actionable threat intel from Google Threat Intelligence. Topics to be covered are… emerging threats and attack trends, and applying this intel to strengthen your orgs security posture. Check it out here to register. Enjoy!Matt

With all new technologies in place, we still see latency across the board with medium scale servers and at times large scales too. Competitive business in the IT domain demands continuous server service. The present load balancers do balance the incoming load. But, has a threshold in balancing the load.Identifying a load controller and placing the device in the CLOUD infrastructure/ or for an independent server and configuring a logical way to streamline the ingress load (ensuring the source is alerted) and kept the queue to avoid further damage will ensure latency is avoided.With versatile load balancers and elasticized server methodologies for an application, we still witness and discuss about throughput/latency issues caused by an ad hoc load across the physical /cloud servers.Having critical sources invoking a complex server/application, an unpredictable load from various interfaces, the elasticity of server/application will always be in stake. Identifying a solution within the clo

Hello GTI Learners,  As a cloud security professional, you and your team need the right skills with the right tools to answer the critical questions. Is that a threat? How do we respond to threats? Where can we get deeper with cloud native threat intelligence? How can AI help us be faster and smarter? Just in time for the holidays and resolutions, Google Cloud would like to showcase our Google Threat Intelligence course, available now on Cloud Skills Boost. This intermediate level course is a fantastic way to skill up on what Google Threat Intelligence can do for enterprises working at cloud scale.  Whether a security team is big or small, multiplying their intelligence insights and responses is critical to a secure cloud. Our Google Threat Intelligence course will take you through the key topics and workflows of the tool set such as: What is Google Threat Intelligence? Incident Response  Gemini in Threat Intelligence Advanced Threat Hunting Digital Threat Monitoring At

Hey Intel Enthusiasts!  You're not going to want to miss this. Come check out the latest Mandiant exploited vulnerabilities disclosed in 2023 Mandiant analyzed 138 vulnerabilities that were disclosed in 2023 and that we tracked as exploited in the wild. Consistent with past analyses, the majority (97) of these vulnerabilities were exploited as zero-days (vulnerabilities exploited before patches are made available, excluding end-of-life technologies). Forty-one vulnerabilities were exploited as n-days (vulnerabilities first exploited after patches are available). While we have previously seen and continue to expect a growing use of zero-days over time, 2023 saw an even larger discrepancy grow between zero-day and n-day exploitation as zero-day exploitation outpaced n-day exploitation more heavily than we have previously observed.

Recently questions have come up related to the discovery context entry of internet archive database and what that represents.  This information is being pulled from the internet archive / wayback machine API.  Sometimes you will find there are references here that still point to your organization's domains.