Google Threat Intelligence

Introduction This guide provides a high-level technical overview of GTI's core YARA-based hunting features. It is designed to help analysts understand the application of each tool in a typical threat intelligence workflow.For complete technical specifications, parameters, and API details, refer to the full, version-controlled documentation linked in each section. 1. LiveHunt: Real-Time Ingestion Stream Matching Function: LiveHunt applies a user-defined set of YARA rules against the real-time stream of files ingested and analyzed by Google Threat Intelligence.Mechanism: Rules are applied to every file submitted to GTI, including re-analyzed files. A match triggers an immediate notification, enabling real-time discovery. For PE files, LiveHunt performs automatic unpacking and scans both the packed and unpacked layers to increase dete

Authored by Raimundo Alcazar and myself, this guide is your resource for leveraging Google Threat Intelligence Profiles. Learn the practical steps to create and manage profiles that provide a clear, tailored view of the most relevant cyber threats to your business, helping you make smarter, faster security decisions. The link is live now. Do share with your customers and partners where GTI, Threat Profile topics comes up!

The Google Threat Intelligence API differs in several aspects from the Mandiant API. Nevertheless, the Google Threat Intelligence API encompasses all data available in the Mandiant API, in addition to further information.There are field name changes. There are different endpoints. There are new Google TI API Functionalities. Field Name Changes:It is important to note that while Google Threat Intelligence provides all information found in Mandiant API objects (and more), the JSON response objects have dif

For the best results using Mandiant Attack Surface Management,  add the following IP addresses to your allowlists: 34.68.34.64/27 8.34.210.32/27 Visit the documentation for information on the Mandiant ASM scan rages.    

I’m reaching out to ask if anyone has insights into whether Mandiant has published any Indicators of Compromise (IoCs) for the UNC3886 threat group, particularly those linked to campaigns originating from or targeting Singapore.We’re currently assessing risk exposure related to this group and are interested in any published intelligence, reports, or threat data—especially around custom malware, zero-day exploitation, or region-specific activity.If you're aware of relevant Mandiant publications or datasets (public or available under subscription), I’d greatly appreciate the direction. Also, if anyone can share details about Mandiant's current subscription plans—especially those covering: Real-time IoCs Advanced malware analysis China-nexus espionage reporting Regional threat intelligen

Enhance your Google Threat Intelligence (GTI) expertise with our comprehensive resources and training, designed for both new and experienced users. Our comprehensive playbook will help you build foundational knowledge and apply it directly to your specific use cases, rapidly increasing your proficiency and ensuring effective product adoption. Here's how to get the most out of your GTI experience: Step 1: Kickstart your onboarding with the Google Cloud Security Community. Sign up and access our dedicated GTI onboarding guide to lay the groundwork for your understanding. Step 2: Engage with the GTI community

There has been a process in the GCP system that it is failing to accurately validate the reputation of the domain, and terminating the accounts automatically based on the single false positive reporting.There is absolutely no accountability taken neither by Firebase or GCP Team. Please share some details or stories about its resolution.

Hi all! My organization just signed up for Google Threat Intelligence (GTI) and I'm excited to start using the product. Seems like it has some awesome capabilities. I'd love to start making connections with fellow users so we can share tips, best practices, and other information... Please feel free to reach out!- Mike

This guide outlines three methods for precisely querying Credential Alerts from the Digital Threat Monitoring (DTM) API. Learn how to retrieve alerts by type, a specific monitor ID, or an aggregated bucket ID to build more efficient security integrations. How to Query for Credential Alerts When querying Credential alerts there are multiple methods to receive results. You can query based on the alert type. You can query based on the Credential Monitor ID. You can query based on the aggregated alert bucket ID.  Things to know before starting: Pagination The Digital Threat Monitoring (D

We’re excited to introduce several powerful new capabilities in GTI, all designed to help you investigate threats more efficiently and with deeper context. Below are some of the most impactful new features now available in GTI: Private URL Scanning In addition to file scanning, you can now submit URLs for in-depth analysis. GTI visits the page using a headless Chrome browser and collects a wide range of data—including screenshots, redirection chains, web trackers, downloaded files, JavaScript activity, and HTTP transactions. This rich, dynamic data is fully pivotable across the GTI dataset, helping you connect infrastructure, identify malware families, and attribute threat activity. You also have the option to run the URL in our dynamic analysis environments (sandboxes) to inspect any downloaded files in real time.

  Using the API Documentation to Run API Queries The API documentation offers a valuable feature: directly querying the REST API for Indicators, Reports, Alerts, Actors, Malware, Vulnerabilities, and other data. To get started, obtain your API key by logging into the Google Threat Intelligence (Google TI) portal, navigating to the 'API Key' section on the left side

Hey Community!  We have an upcoming webinar that you won't want to miss on May 21th 10AM EDT / 15:00 BST! This urgent webinar is focused on a critical cybersecurity threat: UNC3944, also known as Scattered Spider. As you may know, UNC3944 has resumed its ransomware and extortion operations, and they are currently targeting US retailers with the same aggressive tactics they used in the UK recently. I wanted to make sure you were aware of this immediate risk. These actors are particularly effective at circumventing mature security programs, using social engineering and third-party access to gain entry. We are hosting a webinar on May 21st at 10:00 AM EDT / 3:00 PM BST,

This is a question that has come up more than once, particularly when DTM Research Tools is being used. It can also occur when viewing Compromised Credential Monitor Alerts. tl;dr this is by design, to protect any entity whose compromised credentials appear in DTM. There are steps you can take to view your own compromised credentials in a safe, controlled way.   First, a word on Research Tools: Research Tools enables users to safely explore open-source, dark web, and raw data that Google Threat Intelligence has collected for Digital Threat Monitoring. Providing raw threat and related data in an easy interface, Research Tools helps you find what matters, see what is happening in the cyber realm, and thus better protect your business. We recommend you use Research Tools as a precursor to creating a Monitor. This will help you create

Hey Community!  We have an upcoming webinar that you won't want to miss on March 25th 8AM PDT! Mandiant's recent discovery of UNC3886's sophisticated campaign targeting Juniper routers has exposed a critical vulnerability. This China-nexus espionage actor is leveraging end-of-life device vulnerabilities to deploy custom backdoors, potentially compromising sensitive data. Want to understand the full scope of this threat and learn actionable steps to mitigate this threat?  Join our upcoming webinar, where Austin Larsen, Principal Threat Analyst, and Punsaen Boonyakarn, Cyber Security Consultant, will provide an in-depth analysis of UNC3886's tactics and the implications for your organization. We'll move beyond the headlines to explore: The technical details of UNC3886's router compromise

We are using VirusTotal Enterprise and I heard GTI is replacing Virus Total now from 2026. if this is true how this will impact us as an existing customer? Will I lose any functionality? price changes ?VT api will shut down next year and will be replaced by GTI API ? 

Hey Security & Google Threat Intel enthusiast! We have a great webinar coming out next week on January 14th at 17:30CEST. It’s an exclusive live briefing on valuable insights into the threat landscape specific facing financial institutions, inferred from the curated real-time actionable threat intel from Google Threat Intelligence. Topics to be covered are… emerging threats and attack trends, and applying this intel to strengthen your orgs security posture. Check it out here to register. Enjoy!Matt

With all new technologies in place, we still see latency across the board with medium scale servers and at times large scales too. Competitive business in the IT domain demands continuous server service. The present load balancers do balance the incoming load. But, has a threshold in balancing the load.Identifying a load controller and placing the device in the CLOUD infrastructure/ or for an independent server and configuring a logical way to streamline the ingress load (ensuring the source is alerted) and kept the queue to avoid further damage will ensure latency is avoided.With versatile load balancers and elasticized server methodologies for an application, we still witness and discuss about throughput/latency issues caused by an ad hoc load across the physical /cloud servers.Having critical sources invoking a complex server/application, an unpredictable load from various interfaces, the elasticity of server/application will always be in stake. Identifying a

Hello GTI Learners,  As a cloud security professional, you and your team need the right skills with the right tools to answer the critical questions. Is that a threat? How do we respond to threats? Where can we get deeper with cloud native threat intelligence? How can AI help us be faster and smarter? Just in time for the holidays and resolutions, Google Cloud would like to showcase our Google Threat Intelligence course, ava

Hey Intel Enthusiasts!  You're not going to want to miss this. Come check out the latest Mandiant exploited vulnerabilities disclosed in 2023 Mandiant analyzed 138 vulnerabilities that were disclosed in 2023 and that we tracked as exploited in the wild. Consistent with past analyses, the majority (97) of these vulnerabilities were exploited as zero-days (vulnerabilities exploited before patches are made available, excluding end-of-life technologies). Forty-one vulnerabilities were exploited as n-days (vulnerabilities first exploited after patches are available). While we have previously seen and continue to expect a growing use of zero-days over time, 2023 saw an even larger discrepancy grow between zero-day and n-day exploitation as zero-day exploitation outpaced n-day exploitation more heavily than we have previo

Recently questions have come up related to the discovery context entry of internet archive database and what that represents.  This information is being pulled from the internet archive / wayback machine API.  Sometimes you will find there are references here that still point to your organization's domains.    

Since keywords may find things not related to your actual organization entities found are marked out of scope and displayed.  This means when using keyword seeds with ASM you will need to take any entities found that you are interested in being in scope and create or add to a collection with the appropriate seed type (domain or IP).      

Today Mandiant is releasing details of a suspected Iran-nexus counterintelligence operation aimed at collecting data on Iranians and domestic threats who may be collaborating with intelligence and security agencies abroad, particularly in Israel.  The data collected by this campaign may support the Iranian intelligence apparatus in pinpointing individuals who are interested in collaborating with Iran’s perceived adversarial countries. The collected data may be leveraged to uncover human intelligence (HUMINT) operations conducted against Iran and to persecute any Iranians suspected to be involved in these operations. These may include Iranian dissidents, activists, human rights advocates, and Farsi speakers living in and outside Iran.  

Hello, I am a the administrator of a new Google Threat Intelligence group, my question is how many users can we have in a group? and how can I add them?

I'm a current MATI customer. What will the migration process to Google TI look like? Will there be any downtime or interruption to my service?

Hey everyone,I'm a long-time user of both VirusTotal Enterprise and Mandiant Advantage Threat Intelligence. I just heard about Google Threat Intelligence and am wondering how this will impact me as an existing customer? Will I lose any functionality? What about the other Mandiant Advantage products I use? Any insight would be appreciated!