Skip to main content

Google Threat Intelligence

Let's talk about Google Threat Intelligence! Learn from experts, share your insights, ask questions, and collaborate with peers. Whether you're a seasoned analyst or just starting out, your contributions are valued.

  • 40 Topics
  • 34 Replies
40 Topics
Veeresh
VeereshNew Member
asked in Google Threat Intelligence
Degree of Domain Reputation and Suspensions

There has been a process in the GCP system that it is failing to accurately validate the reputation of the domain, and terminating the accounts automatically based on the single false positive reporting.There is absolutely no accountability taken neither by Firebase or GCP Team. Please share some details or stories about its resolution.

251
ErikaB
Community Manager
B
blakelpNew Member
posted in Google Threat Intelligence
New Google Threat Intelligence User!

Hi all! My organization just signed up for Google Threat Intelligence (GTI) and I'm excited to start using the product. Seems like it has some awesome capabilities. I'd love to start making connections with fellow users so we can share tips, best practices, and other information... Please feel free to reach out!- Mike

96
matthewnichols
Community Manager
Ismahan
Staff
IsmahanStaff
posted in Google Threat Intelligence
How to Query for Credential Alerts

This guide outlines three methods for precisely querying Credential Alerts from the Digital Threat Monitoring (DTM) API. Learn how to retrieve alerts by type, a specific monitor ID, or an aggregated bucket ID to build more efficient security integrations. How to Query for Credential Alerts When querying Credential alerts there are multiple methods to receive results. You can query based on the alert type. You can query based on the Credential Monitor ID. You can query based on the aggregated alert bucket ID.  Things to know before starting: Pagination The Digital Threat Monitoring (DTM) API paginates alert returns, with a default of 10 alerts per page. Users can increase this to 25 alerts per page using the "size" query parameter. For queries exceeding 25 alerts, subsequent pages are accessed via a HTTP Link Header in the API response, which provides the URI for the next results page. This Link URI must be used precisely as provided, as it contains essential pagination context,

70
Ismahan
Staff
Ismahan
Staff
IsmahanStaff
posted in Google Threat Intelligence
The Complete GTI Journey Playbook: Onboarding, Mastery, and Advanced Operations

Enhance your Google Threat Intelligence (GTI) expertise with our comprehensive resources and training, designed for both new and experienced users. Our comprehensive playbook will help you build foundational knowledge and apply it directly to your specific use cases, rapidly increasing your proficiency and ensuring effective product adoption. Here's how to get the most out of your GTI experience: Step 1: Kickstart your onboarding with the Google Cloud Security Community. Sign up and access our dedicated GTI onboarding guide to lay the groundwork for your understanding. Step 2: Engage with the GTI community forums. Participate in discussions on the Google Cloud Security Community to ask questions, share insights, and learn from other GTI users and experts. Step 3: Validate your practical knowledge with Skillboost. Sign up for Skillboost and complete the self-paced GTI training modules to earn badges that demonstrate your proficiency. This hands-on learning approach ensures you gain imm

181
Vik_S
Staff
Ismahan
Staff
IsmahanStaff
posted in Google Threat Intelligence
New in Google Threat Intelligence: Smarter Threat Detection, Deeper Insights

We’re excited to introduce several powerful new capabilities in GTI, all designed to help you investigate threats more efficiently and with deeper context. Below are some of the most impactful new features now available in GTI: Private URL Scanning In addition to file scanning, you can now submit URLs for in-depth analysis. GTI visits the page using a headless Chrome browser and collects a wide range of data—including screenshots, redirection chains, web trackers, downloaded files, JavaScript activity, and HTTP transactions. This rich, dynamic data is fully pivotable across the GTI dataset, helping you connect infrastructure, identify malware families, and attribute threat activity. You also have the option to run the URL in our dynamic analysis environments (sandboxes) to inspect any downloaded files in real time. Semantic SearchWe’ve introduced semantic search across key threat entities including threat actors, malware profiles, campaigns, vulnerabilities, and finished intelligence r

90
Ismahan
Staff
Eric_W
Staff
Eric_WStaff
posted in Google Threat Intelligence
How to use the API Documentation to Run API Queries

  Using the API Documentation to Run API Queries The API documentation offers a valuable feature: directly querying the REST API for Indicators, Reports, Alerts, Actors, Malware, Vulnerabilities, and other data. To get started, obtain your API key by logging into the Google Threat Intelligence (Google TI) portal, navigating to the 'API Key' section on the left side, and then visiting this URL: https://www.virustotal.com/gui/user/<your username>/apikey The key will be used in the x-apikey field in the documentation. To retrieve the Google TI Threat Score, provide a string in the x-tool field within the documentation. This string can be any value, such as “API_Docs_Testing.” Both the x-tool and x-apikey fields are located in the HEADERS section of the documentation’s query builder. The query builder also includes PATH PARAMS and QUERY PARAMS. Path parameters appear before the question mark in the query URL, while query parameters appear after the question mark. After buildin

50
Eric_W
Staff
TJA
Staff
TJAStaff
posted in Google Threat Intelligence
Hardening guidance from the resurgent UNC3944 (Scattered Spider) threat

Hey Community!  We have an upcoming webinar that you won't want to miss on May 21th 10AM EDT / 15:00 BST! This urgent webinar is focused on a critical cybersecurity threat: UNC3944, also known as Scattered Spider. As you may know, UNC3944 has resumed its ransomware and extortion operations, and they are currently targeting US retailers with the same aggressive tactics they used in the UK recently. I wanted to make sure you were aware of this immediate risk. These actors are particularly effective at circumventing mature security programs, using social engineering and third-party access to gain entry. We are hosting a webinar on May 21st at 10:00 AM EDT / 3:00 PM BST, Proactive defense against UNC3944: Hardening your enterprise, where Google Threat Intelligence Group and Mandiant experts will share actionable strategies to proactively defend against UNC3944's evolving tactics. In this webinar, you'll learn how to: Enhance Identity Security Fortify Endpoints & Cloud Strengthen

20
TJA
Staff
chrisproudley
Staff
chrisproudleyStaff
posted in Google Threat Intelligence
Why can't I view plaintext passwords in DTM?

This is a question that has come up more than once, particularly when DTM Research Tools is being used. It can also occur when viewing Compromised Credential Monitor Alerts. tl;dr this is by design, to protect any entity whose compromised credentials appear in DTM. There are steps you can take to view your own compromised credentials in a safe, controlled way.   First, a word on Research Tools: Research Tools enables users to safely explore open-source, dark web, and raw data that Google Threat Intelligence has collected for Digital Threat Monitoring. Providing raw threat and related data in an easy interface, Research Tools helps you find what matters, see what is happening in the cyber realm, and thus better protect your business. We recommend you use Research Tools as a precursor to creating a Monitor. This will help you create Monitors focused on what matters and reduce false positives. Source: https://gtidocs.virustotal.com/docs/research-tools &nbsp

10
chrisproudley
Staff
matthewnichols
Community Manager
matthewnicholsCommunity Manager
posted in Google Threat Intelligence
Unmasking the "Ghost in the Router": Deep Dive into UNC3886's Juniper Attacks

Hey Community!  We have an upcoming webinar that you won't want to miss on March 25th 8AM PDT! Mandiant's recent discovery of UNC3886's sophisticated campaign targeting Juniper routers has exposed a critical vulnerability. This China-nexus espionage actor is leveraging end-of-life device vulnerabilities to deploy custom backdoors, potentially compromising sensitive data. Want to understand the full scope of this threat and learn actionable steps to mitigate this threat?  Join our upcoming webinar, where Austin Larsen, Principal Threat Analyst, and Punsaen Boonyakarn, Cyber Security Consultant, will provide an in-depth analysis of UNC3886's tactics and the implications for your organization. We'll move beyond the headlines to explore: The technical details of UNC3886's router compromise techniques. The broader context of China-nexus actors targeting Juniper devices, including insights on UNC4841. Real-world impact scenarios and potential organizational consequences. Actionabl

100
matthewnichols
Community Manager
J
JeewanBronze 1
asked in Google Threat Intelligence
is GTI is replacing Virus Total ?

We are using VirusTotal Enterprise and I heard GTI is replacing Virus Total now from 2026. if this is true how this will impact us as an existing customer? Will I lose any functionality? price changes ?VT api will shut down next year and will be replaced by GTI API ? 

195
kentphelps
Staff
matthewnichols
Community Manager
matthewnicholsCommunity Manager
posted in Google Threat Intelligence
Threat Intel Webinar Jan 14th!

Hey Security & Google Threat Intel enthusiast! We have a great webinar coming out next week on January 14th at 17:30CEST. It’s an exclusive live briefing on valuable insights into the threat landscape specific facing financial institutions, inferred from the curated real-time actionable threat intel from Google Threat Intelligence. Topics to be covered are… emerging threats and attack trends, and applying this intel to strengthen your orgs security posture. Check it out here to register. Enjoy!Matt

11
R
Staff
Sivasundar
SivasundarNew Member
posted in Google Threat Intelligence
Request for submitting an IDEA

With all new technologies in place, we still see latency across the board with medium scale servers and at times large scales too. Competitive business in the IT domain demands continuous server service. The present load balancers do balance the incoming load. But, has a threshold in balancing the load.Identifying a load controller and placing the device in the CLOUD infrastructure/ or for an independent server and configuring a logical way to streamline the ingress load (ensuring the source is alerted) and kept the queue to avoid further damage will ensure latency is avoided.With versatile load balancers and elasticized server methodologies for an application, we still witness and discuss about throughput/latency issues caused by an ad hoc load across the physical /cloud servers.Having critical sources invoking a complex server/application, an unpredictable load from various interfaces, the elasticity of server/application will always be in stake. Identifying a solution within the clo

01
kentphelps
Staff
ScienceCat
Staff
ScienceCatStaff
posted in Google Threat Intelligence
Skill Up With Google Threat Intelligence

Hello GTI Learners,  As a cloud security professional, you and your team need the right skills with the right tools to answer the critical questions. Is that a threat? How do we respond to threats? Where can we get deeper with cloud native threat intelligence? How can AI help us be faster and smarter? Just in time for the holidays and resolutions, Google Cloud would like to showcase our Google Threat Intelligence course, available now on Cloud Skills Boost. This intermediate level course is a fantastic way to skill up on what Google Threat Intelligence can do for enterprises working at cloud scale.  Whether a security team is big or small, multiplying their intelligence insights and responses is critical to a secure cloud. Our Google Threat Intelligence course will take you through the key topics and workflows of the tool set such as: What is Google Threat Intelligence? Incident Response  Gemini in Threat Intelligence Advanced Threat Hunting Digital Threat Monitoring At

62
C
L
lexrzasa1Bronze 4
asked in Google Threat Intelligence
New Scan Range to Allowlist

For the best results using Mandiant Attack Surface Management,  add the following IP addresses to your allowlists: 34.68.34.64/27 8.34.210.32/27 Visit the documentation for information on the Mandiant ASM scan rages.    

115
hzmndt
Staff
matthewnichols
Community Manager
matthewnicholsCommunity Manager
posted in Google Threat Intelligence
Analysis of 2023 Time-to-Exploit Trends

Hey Intel Enthusiasts!  You're not going to want to miss this. Come check out the latest Mandiant exploited vulnerabilities disclosed in 2023 Mandiant analyzed 138 vulnerabilities that were disclosed in 2023 and that we tracked as exploited in the wild. Consistent with past analyses, the majority (97) of these vulnerabilities were exploited as zero-days (vulnerabilities exploited before patches are made available, excluding end-of-life technologies). Forty-one vulnerabilities were exploited as n-days (vulnerabilities first exploited after patches are available). While we have previously seen and continue to expect a growing use of zero-days over time, 2023 saw an even larger discrepancy grow between zero-day and n-day exploitation as zero-day exploitation outpaced n-day exploitation more heavily than we have previously observed.

10
matthewnichols
Community Manager
BrianK
Staff
BrianKStaff
posted in Google Threat Intelligence
Discovery Context type internet_archive_database

Recently questions have come up related to the discovery context entry of internet archive database and what that represents.  This information is being pulled from the internet archive / wayback machine API.  Sometimes you will find there are references here that still point to your organization's domains.    

00
BrianK
Staff
BrianK
Staff
BrianKStaff
posted in Google Threat Intelligence
Using Keyword Seeds with ASM

Since keywords may find things not related to your actual organization entities found are marked out of scope and displayed.  This means when using keyword seeds with ASM you will need to take any entities found that you are interested in being in scope and create or add to a collection with the appropriate seed type (domain or IP).      

00
BrianK
Staff
matthewnichols
Community Manager
matthewnicholsCommunity Manager
posted in Google Threat Intelligence
I Spy With My Little Eye: Uncovering an Iranian Counterintelligence Operation

Today Mandiant is releasing details of a suspected Iran-nexus counterintelligence operation aimed at collecting data on Iranians and domestic threats who may be collaborating with intelligence and security agencies abroad, particularly in Israel.  The data collected by this campaign may support the Iranian intelligence apparatus in pinpointing individuals who are interested in collaborating with Iran’s perceived adversarial countries. The collected data may be leveraged to uncover human intelligence (HUMINT) operations conducted against Iran and to persecute any Iranians suspected to be involved in these operations. These may include Iranian dissidents, activists, human rights advocates, and Farsi speakers living in and outside Iran.   Read More

00
matthewnichols
Community Manager
J
jjimenezNew Member
posted in Google Threat Intelligence
User management question

Hello, I am a the administrator of a new Google Threat Intelligence group, my question is how many users can we have in a group? and how can I add them?

01
fperdomo
Staff
D
davidjandersonNew Member
posted in Google Threat Intelligence
Migration from MATI to GTI

I'm a current MATI customer. What will the migration process to Google TI look like? Will there be any downtime or interruption to my service?

01
fperdomo
Staff
E
emilyjsNew Member
posted in Google Threat Intelligence
Impact of GTI to VT+MATI customer

Hey everyone,I'm a long-time user of both VirusTotal Enterprise and Mandiant Advantage Threat Intelligence. I just heard about Google Threat Intelligence and am wondering how this will impact me as an existing customer? Will I lose any functionality? What about the other Mandiant Advantage products I use? Any insight would be appreciated!

21
fperdomo
Staff
S
skellerNew Member
asked in Google Threat Intelligence
Delete private file

i accidentally uploaded a confidential file to Google threat inteligence. How do I request to delete it?

01
fperdomo
Staff
A
Ammar-AbdullahNew Member
asked in Google Threat Intelligence
How do I recover AWS resources that were affected by the CrowdStrike Falcon agent?

ver AWS resources that were affected by the CrowdStrike Falcon agent?On July 18th 2024, an update to the CrowdStrike Falcon agent (csagent.sys) caused Windows based devices to experience unplanned stop errors or blue screen. This includes Amazon Elastic Compute Cloud (Amazon EC2) instances and Amazon WorkSpaces. This issue only affects Windows Amazon EC2 instances with CrowdStrike installed.Note:If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.If your root Amazon Elastic Block Store (Amazon EBS) volume is encrypted, then make sure the encryption key exists in your account and that you have permission to use it.Identify impaired instancesTo identify failed instances, run the AWS CLI command describe-instance-status similar to the following:Note: Replace your-region with your AWS Region.CMD/TERMINALaws ec2 describe-ins

02
A
L
lexrzasa1Bronze 4
posted in Google Threat Intelligence
Important Notice: Mandiant ASM Discovery Engine Scanner Expansion

To enhance the scalability and performance of the Mandiant ASM Discovery Engine, we are expanding our scanner network. Please allowlist the following new scan ranges in preparation for their release later this quarter: 34.19.127.192/28 34.19.116.48/28 34.19.127.208/28 34.19.127.176/28 34.68.34.64/27 8.34.210.32/27 Allowlisting these ranges will ensure uninterrupted scanning and optimal performance of the Mandiant ASM Discovery Engine. We appreciate your cooperation as we continue to improve our services. Visit the documentation for information on the Mandiant ASM scan rages.

40
L
chrisproudley
Staff
chrisproudleyStaff
posted in Google Threat Intelligence
API /v1/search/entities/ changes to include all entities without filtering

Previously, when performing API calls to capture entities (/v1/search/entities/), there were two filters which were always enabled with default values, shown in bold below: hidden:false|true scoped:true|false This meant that building API queries to capture all or both required multiple lookups to capture all entities, and some way of concatenating the resultant data. If building an integration with a third-party product, for example, this added significant complexity. Since late May 2024, we have added options to capture 'both' within a single API call (or search within the UI). How these parameters look in a direct API request (without URI encoding): /v1/stats/entities/ips_by_network/last_seen_after:configured_scan_count scoped:both hidden:both How these parameters look within the UI search: We hope that these changes to the API will prove valuable and welcome feedback on their usefulness.

00
chrisproudley
Staff

Badge winners

  • Authored Posts 5
    leodashas earned the badge Authored Posts 5
  • Authored Posts 5
    delstonhas earned the badge Authored Posts 5
  • Authored Posts 1
    SaDaVFhas earned the badge Authored Posts 1
  • Authored Posts 5
    hzmndthas earned the badge Authored Posts 5
  • Solution 10
    hzmndthas earned the badge Solution 10
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.