This is Part 4 (the finale) of the Connecting the Dots to GTI series. After tracing the history of TAG, VirusTotal, and Mandiant (Part 1), the GTIG/GTI intelligence loop and Diamond Model (Part 2), and how DTM and Google SecOps SOAR cut credential-leak noise in the SOC (Part 3), let's tackle one final architectural question: how does GTI fit alongside open-source TIPs like OpenCTI and MISP?
Disclaimer: This series is built entirely on publicly available material. All views, war stories, and opinions here are strictly my own—not Google speaking officially.
OpenCTI and MISP
When an organization has a dedicated CTI team, they frequently maintain two open-source Threat Intelligence Platforms (TIPs)—the CTI equivalent of a SIEM, built to aggregate, normalize, correlate, and distribute threat feeds: OpenCTI as their central STIX 2.1 knowledge graph and source of truth, and MISP to ingest, curate, and share tactical indicators with external partners.
It's cool, and it's the power of open source—with all the pros and cons that come with self-hosting. Maintaining containers, Elasticsearch, workers, and connectors, plus curating objects across multiple consoles, eats up engineering time that is almost always scarce on CTI teams.
Where does Google Threat Intelligence (GTI) fit into this architecture?
- Retiring self-hosted TIP infra: If a team's primary use case for OpenCTI and MISP is curating campaign indicators, mapping relationships visually, sharing collections with peers, and pushing high-confidence IOCs to the SIEM, GTI handles that natively via Collections, Threat Graphs, and IOC Stream. Especially if your partners also use GTI, you can share curated Collections and Threat Graphs directly inside the platform and retire the self-hosted stack.
- Running GTI, OpenCTI, and MISP in conjunction: Many financial institutions and enterprises still want or need to keep MISP (for regulated peer-to-peer sector sharing like FS-ISAC or FEBRABAN) and OpenCTI (to aggregate internal incident data and niche feeds).
One scenario off the top of my head shows how the three tools can work together using Google's native OpenCTI connector and MISP modules to relieve the operational burden. Instead of manually ingesting, curating, and enriching thousands of global observables inside OpenCTI and MISP, everything that already exists in GTI stays managed in GTI—streaming directly to your SIEM via IOC Stream and automatically enriching OpenCTI investigations on demand with sandbox verdicts and UNC/Actor attribution. That leaves OpenCTI and MISP to handle only the delta: proprietary internal IR findings and closed MISP community events that don't exist in GTI. With far fewer STIX objects and attributes to manage locally, CTI analysts are freed up to actually analyze threats, not babysit database objects.
Wrapping Up
Instead of letting past acquisitions sit in silos or rot, Google fused TAG, VirusTotal, and Mandiant into something much stronger than the sum of its parts: an intelligence organization and platform built to track everything from regional eCrime crews to well-resourced, state-sponsored adversaries.
Despite the common criticism that global platforms overlook smaller regional actors, GTIG, GTI, and Mandiant Services don't just sit on the world's largest threat corpus—they actively cluster, attribute, and operationalize that telemetry into UNC intrusion sets and tracked threat actors long before a public report ever drops.
More importantly, in an over-connected world, geography is not a firewall. Nothing stops an operator in North Korea from hitting a company in the Caribbean or a fintech in Brazil on a Tuesday morning. Defenders have to look at the global threat landscape to actually protect their business. It's a huge, asymmetric fight—just like all blue-team work is—but having global telemetry and frontline tradecraft in one loop gives our side a much better shot.
Studying GTI, GTIG, and Mandiant was a great exercise for me. It helped me connect the dots across 15 years of security history, and Google's approach genuinely impressed me. Seeing an intelligence-driven architecture I first read about in Intelligence-Driven Incident Response years ago become an operational reality is exciting—and it's clear there are still plenty of chapters left to be written in this story.
