Skip to main content

Google Threat Intelligence

Let's talk about Google Threat Intelligence! Learn from experts, share your insights, ask questions, and collaborate with peers. Whether you're a seasoned analyst or just starting out, your contributions are valued.

  • 40 Topics
  • 34 Replies
40 Topics
BrianK
Staff
BrianKStaff
posted in Google Threat Intelligence
How to use a technology policy

If you have a collection where you expect not to find a specific technology you can create a technology policy for this collection. Let's say your organization does not allow Apache HTTP servers and you want to be notified when one is found in a collection. You can go to the collection setting and add a technology policy and set the appropriate severity based on the risk to your organization.   Here what the configuration would look like.   For more information on technology policies you can find documentation here

00
BrianK
Staff
BrianK
Staff
BrianKStaff
posted in Google Threat Intelligence
Changing the severity of issues within a collection

In order to change the severity of an issue for a collection you can go to the collection settings and under issue settings select the appropriate severity for the issue.   Some documentation on examples of severity in ASM can be found here  

00
BrianK
Staff
ionutm
Staff
ionutmStaff
posted in Google Threat Intelligence
Disabling Issues from reoccuring

After an Issue has been seen in a scan it will show in the collection settings. Only after that, an Issue can be disabled. Right now we are not able to turn off checks that have not been seen for that Collection. You can find the configuration under the Collection Settings.  

00
ionutm
Staff
ionutm
Staff
ionutmStaff
posted in Google Threat Intelligence
WAF rate-limiting ASM Scanning Ranges

For Collections configured with high number of seeds and resulting in many entities, there will be a big number of scans to be initiated by ASM. This means that WAF rate-limiting might kick in and stop some of these scans coming from the ASM ranges. The library in the UI will show you all the tasks that are ran. They are not run all on every entity, but depending on entity type and number of entities behind the WAF it is possible to hit 30k or more scans. ASM also has over 100 ports that are being scannned, IPv4 for by default. ASM Customers can also add custom ports that may add to events seen.

00
ionutm
Staff
ionutm
Staff
ionutmStaff
posted in Google Threat Intelligence
Broad Scoping vs Non-broad scoping in ASM

By default, Mandiant ASM (Attack Surface Management) has a focused approach to identifying assets for testing. This is great for minimizing false positives, but penetration testers who want a wider net can enable "broad scoping." While this feature helps uncover more potential targets, it might also lead to some inaccuracies in asset ownership identification due to the broader DNS entity scoping. The above can be found here: https://docs.mandiant.com/home/asm-collections-overview Enabling broad scoping:    

00
ionutm
Staff
vaskenh
Staff
vaskenhStaff
posted in Google Threat Intelligence
Using the ASM Library - Overview

In this brief post, we'll take a closer look at the Library in Attack Surface Management (ASM). In ASM you have the ability to browse a listing of all available Issue Definitions, Technology Definitions, and Task Definitions.  This can be useful if you're interested in reviewing the various checks that ASM performs while scanning or the various technologies that ASM can identify.   The ASM Library can be accessed via the following URL, or by clicking your profile drop-down menu in ASM and selecting Library. https://asm.advantage.mandiant.com/library/ On the Library page, we can see that the library is composed of the same three definition types mentioned above, and that we can click through these to browse through the different Issues, Technologies, and Tasks that go into an ASM scan. For example, we might be interested in knowing which proxy technologies ASM is able to identify during a scan.  We can search for all Technology definitions with the term 'Proxy

00
vaskenh
Staff
S
secops123New Member
posted in Google Threat Intelligence
Help with deleting a project

I have created a project and was wondering how I delete it?

02
rafaelramirez
Staff
rafaelramirez
Staff
rafaelramirezStaff
posted in Google Threat Intelligence
Create & Delete An ASM Project Using API & Python

This guide will use Python to connect to ASM via API to create and/or delete. The script will contain a menu with 3 options List current projects and project ID Create New Project Delete Project Step 1: Import "request" Module & Create Main Function     import requests def main(): try: # Input API key and Secret via api_credentials.json file with open('api_credentials.json', 'r') as file: credentials = json.load(file) api_key = credentials.get('api_key') api_secret = credentials.get('api_secret') except FileNotFoundError: # Error message if api_credentials.json file is not found print("Error: api_credentials.json not found.") exit(1) except json.JSONDecodeError: # Error message if api_credentials.json is not formated correctly print("Error: Unable to parse api_credentials.json.") exit(1)     The main function will look for file api_credentials.json to be in the same directory of the script. This file will contain the API Key and

00
rafaelramirez
Staff
vaskenh
Staff
vaskenhStaff
posted in Google Threat Intelligence
API Examples - List ASM Projects using PowerShell and cURL

The following two examples can be used as a reference for basic calls to the ASM API.   In both examples, the keys are fabricated and shown for the purpose of demonstrating how to correctly set the headers for each call.     curl https://asm-api.advantage.mandiant.com/api/v1/projects -H 'INTRIGUE_ACCESS_KEY: myaccesskey' -H 'INTRIGUE_SECRET_KEY: mysecretkey'     Invoke-WebRequest http://asm-api.advantage.mandiant.com/api/v1/projects -Headers @{'INTRIGUE_ACCESS_KEY' = 'myaccesskey'; 'INTRIGUE_SECRET_KEY' = 'mysecretkey'} -UseBasicParsing          

10
vaskenh
Staff
S
skadavBronze 5
asked in Google Threat Intelligence
How to enable SSO on Mandiant?

How to enable SSO on Mandiant?

01
Rob_P
Staff
S
secops123New Member
posted in Google Threat Intelligence
Is ASM SaaS vulnerable to critical vulnerabilities?

I'd like to know if ASM SaaS is vulnerable to the following critical vulnerabilities(specifically, if ASM utilizes WS_FTP or Confluence Data Center or Servers)?On September 14, 2023, Progress Software released a security advisory for a remote code execution (RCE) vulnerability in the WinSock File Transfer Protocol (WS_FTP) Server, which Mandiant Intelligence rates as High-risk. The vulnerability tracked as CVE-2023-40044 caused by a flaw in how the WS_FTP Server handles ad-hoc commands, which an attacker can exploit by sending a specially crafted request to the server to execute arbitrary code on the system. (CVSSv3.1 Base 9.8)On October 4, 2023, Atlassian published a security advisory on a critical vulnerability (CVE-2023-22515) in publicly accessible Confluence Data Center and Server instances where an attacker could create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites not affected by this vulnerability. (CVSSv3.0 Base: 10)Any g

02
ionutm
Staff
S
Staff
scottennisStaff
posted in Google Threat Intelligence
New Google Cloud Security Customer Success Services Available!

  We are excited to announce the availability of Google Cloud Security Customer Success subscriptions.   Optimize your Google Cloud Security experience to achieve desired business outcomes together with a team of security experts. Choose the right success offering that best fits your organizational objectives and acquired security subscriptions. Standard: Offers digital and self-service resources, including onboarding, subscription walkthroughs, documentation, and access to knowledge base with product trainings. Expert: Offers a designated Customer Success Manager and Technical Solutions Consultants, providing customized success plans, and strategic guidance. Expert+: Includes everything from Expert and more, including a designated Security Advisor (SA) focused on advanced adoption and helping your security operations. Learn more about Cloud Security Customer Success on the Google Cloud site.

00
S
Staff
S
Staff
scottennisStaff
posted in Google Threat Intelligence
Join our Webinar: Living on the Edge: Investigating Ivanti Connect Secure VPN Zero-Day Exploits

We have a webinar, Living on the Edge: Investigating Ivanti Connect Secure VPN Zero-Day Exploits coming up this Thursday January 18, 2024. It is a free webinar. Click here to sign up.   

00
S
Staff
S
secops123New Member
posted in Google Threat Intelligence
Why are some inferred CVEs come without a reference to (MA)TI Threat?

Is there a good explanation why some inferred CVEs come without a reference to (MA)TI Threat Intelligence when the vuln exists in MATI Vulns?For instance CVE-2022-36760 had been detected by ASM, but the link to MATI is missing even so so it seems the CVE had been added to MATI early 2023.help please?

11
S
Staff
hzmndt
Staff
hzmndtStaff
posted in Google Threat Intelligence
Mandiant Attack Surface Management 30-day free trial

Mandiant Attack Surface Management 30-day free trial https://www.mandiant.com/attack-surface-management-free-trial  

10
hzmndt
Staff

Badge winners

  • Authored Posts 5
    leodashas earned the badge Authored Posts 5
  • Authored Posts 5
    delstonhas earned the badge Authored Posts 5
  • Authored Posts 1
    SaDaVFhas earned the badge Authored Posts 1
  • Authored Posts 5
    hzmndthas earned the badge Authored Posts 5
  • Solution 10
    hzmndthas earned the badge Solution 10
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.