Skip to main content

Google Threat Intelligence

Let's talk about Google Threat Intelligence! Learn from experts, share your insights, ask questions, and collaborate with peers. Whether you're a seasoned analyst or just starting out, your contributions are valued.

  • 45 Topics
  • 46 Replies
45 Topics
E
emilyjsNew Member
posted in Google Threat Intelligence
Impact of GTI to VT+MATI customer

Hey everyone,I'm a long-time user of both VirusTotal Enterprise and Mandiant Advantage Threat Intelligence. I just heard about Google Threat Intelligence and am wondering how this will impact me as an existing customer? Will I lose any functionality? What about the other Mandiant Advantage products I use? Any insight would be appreciated!

171
fperdomo
Staff
S
skellerNew Member
asked in Google Threat Intelligence
Delete private file

i accidentally uploaded a confidential file to Google threat inteligence. How do I request to delete it?

51
fperdomo
Staff
A
Ammar-AbdullahNew Member
asked in Google Threat Intelligence
How do I recover AWS resources that were affected by the CrowdStrike Falcon agent?

ver AWS resources that were affected by the CrowdStrike Falcon agent?On July 18th 2024, an update to the CrowdStrike Falcon agent (csagent.sys) caused Windows based devices to experience unplanned stop errors or blue screen. This includes Amazon Elastic Compute Cloud (Amazon EC2) instances and Amazon WorkSpaces. This issue only affects Windows Amazon EC2 instances with CrowdStrike installed.Note:If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.If your root Amazon Elastic Block Store (Amazon EBS) volume is encrypted, then make sure the encryption key exists in your account and that you have permission to use it.Identify impaired instancesTo identify failed instances, run the AWS CLI command describe-instance-status similar to the following:Note: Replace your-region with your AWS Region.CMD/TERMINALaws ec2 describe-ins

22
A
L
lexrzasa1Bronze 4
posted in Google Threat Intelligence
Important Notice: Mandiant ASM Discovery Engine Scanner Expansion

To enhance the scalability and performance of the Mandiant ASM Discovery Engine, we are expanding our scanner network. Please allowlist the following new scan ranges in preparation for their release later this quarter: 34.19.127.192/28 34.19.116.48/28 34.19.127.208/28 34.19.127.176/28 34.68.34.64/27 8.34.210.32/27 Allowlisting these ranges will ensure uninterrupted scanning and optimal performance of the Mandiant ASM Discovery Engine. We appreciate your cooperation as we continue to improve our services. Visit the documentation for information on the Mandiant ASM scan rages.

230
L
chrisproudley
Staff
chrisproudleyStaff
posted in Google Threat Intelligence
API /v1/search/entities/ changes to include all entities without filtering

Previously, when performing API calls to capture entities (/v1/search/entities/), there were two filters which were always enabled with default values, shown in bold below: hidden:false|true scoped:true|false This meant that building API queries to capture all or both required multiple lookups to capture all entities, and some way of concatenating the resultant data. If building an integration with a third-party product, for example, this added significant complexity. Since late May 2024, we have added options to capture 'both' within a single API call (or search within the UI). How these parameters look in a direct API request (without URI encoding): /v1/stats/entities/ips_by_network/last_seen_after:configured_scan_count scoped:both hidden:both How these parameters look within the UI search: We hope that these changes to the API will prove valuable and welcome feedback on their usefulness.

30
chrisproudley
Staff
BrianK
Staff
BrianKStaff
posted in Google Threat Intelligence
How to use a technology policy

If you have a collection where you expect not to find a specific technology you can create a technology policy for this collection. Let's say your organization does not allow Apache HTTP servers and you want to be notified when one is found in a collection. You can go to the collection setting and add a technology policy and set the appropriate severity based on the risk to your organization.   Here what the configuration would look like.   For more information on technology policies you can find documentation here

00
BrianK
Staff
BrianK
Staff
BrianKStaff
posted in Google Threat Intelligence
Changing the severity of issues within a collection

In order to change the severity of an issue for a collection you can go to the collection settings and under issue settings select the appropriate severity for the issue.   Some documentation on examples of severity in ASM can be found here  

10
BrianK
Staff
ionutm
Staff
ionutmStaff
posted in Google Threat Intelligence
Disabling Issues from reoccuring

After an Issue has been seen in a scan it will show in the collection settings. Only after that, an Issue can be disabled. Right now we are not able to turn off checks that have not been seen for that Collection. You can find the configuration under the Collection Settings.  

00
ionutm
Staff
ionutm
Staff
ionutmStaff
posted in Google Threat Intelligence
WAF rate-limiting ASM Scanning Ranges

For Collections configured with high number of seeds and resulting in many entities, there will be a big number of scans to be initiated by ASM. This means that WAF rate-limiting might kick in and stop some of these scans coming from the ASM ranges. The library in the UI will show you all the tasks that are ran. They are not run all on every entity, but depending on entity type and number of entities behind the WAF it is possible to hit 30k or more scans. ASM also has over 100 ports that are being scannned, IPv4 for by default. ASM Customers can also add custom ports that may add to events seen.

20
ionutm
Staff
ionutm
Staff
ionutmStaff
posted in Google Threat Intelligence
Broad Scoping vs Non-broad scoping in ASM

By default, Mandiant ASM (Attack Surface Management) has a focused approach to identifying assets for testing. This is great for minimizing false positives, but penetration testers who want a wider net can enable "broad scoping." While this feature helps uncover more potential targets, it might also lead to some inaccuracies in asset ownership identification due to the broader DNS entity scoping. The above can be found here: https://docs.mandiant.com/home/asm-collections-overview Enabling broad scoping:    

50
ionutm
Staff
vaskenh
Staff
vaskenhStaff
posted in Google Threat Intelligence
Using the ASM Library - Overview

In this brief post, we'll take a closer look at the Library in Attack Surface Management (ASM). In ASM you have the ability to browse a listing of all available Issue Definitions, Technology Definitions, and Task Definitions.  This can be useful if you're interested in reviewing the various checks that ASM performs while scanning or the various technologies that ASM can identify.   The ASM Library can be accessed via the following URL, or by clicking your profile drop-down menu in ASM and selecting Library. https://asm.advantage.mandiant.com/library/ On the Library page, we can see that the library is composed of the same three definition types mentioned above, and that we can click through these to browse through the different Issues, Technologies, and Tasks that go into an ASM scan. For example, we might be interested in knowing which proxy technologies ASM is able to identify during a scan.  We can search for all Technology definitions with the term 'Proxy

10
vaskenh
Staff
S
secops123New Member
posted in Google Threat Intelligence
Help with deleting a project

I have created a project and was wondering how I delete it?

02
rafaelramirez
Staff
rafaelramirez
Staff
rafaelramirezStaff
posted in Google Threat Intelligence
Create & Delete An ASM Project Using API & Python

This guide will use Python to connect to ASM via API to create and/or delete. The script will contain a menu with 3 options List current projects and project ID Create New Project Delete Project Step 1: Import "request" Module & Create Main Function     import requests def main(): try: # Input API key and Secret via api_credentials.json file with open('api_credentials.json', 'r') as file: credentials = json.load(file) api_key = credentials.get('api_key') api_secret = credentials.get('api_secret') except FileNotFoundError: # Error message if api_credentials.json file is not found print("Error: api_credentials.json not found.") exit(1) except json.JSONDecodeError: # Error message if api_credentials.json is not formated correctly print("Error: Unable to parse api_credentials.json.") exit(1)     The main function will look for file api_credentials.json to be in the same directory of the script. This file will contain the API Key and

20
rafaelramirez
Staff
vaskenh
Staff
vaskenhStaff
posted in Google Threat Intelligence
API Examples - List ASM Projects using PowerShell and cURL

The following two examples can be used as a reference for basic calls to the ASM API.   In both examples, the keys are fabricated and shown for the purpose of demonstrating how to correctly set the headers for each call.     curl https://asm-api.advantage.mandiant.com/api/v1/projects -H 'INTRIGUE_ACCESS_KEY: myaccesskey' -H 'INTRIGUE_SECRET_KEY: mysecretkey'     Invoke-WebRequest http://asm-api.advantage.mandiant.com/api/v1/projects -Headers @{'INTRIGUE_ACCESS_KEY' = 'myaccesskey'; 'INTRIGUE_SECRET_KEY' = 'mysecretkey'} -UseBasicParsing          

70
vaskenh
Staff
S
skadavBronze 5
asked in Google Threat Intelligence
How to enable SSO on Mandiant?

How to enable SSO on Mandiant?

211
Rob_P
Staff
S
secops123New Member
posted in Google Threat Intelligence
Is ASM SaaS vulnerable to critical vulnerabilities?

I'd like to know if ASM SaaS is vulnerable to the following critical vulnerabilities(specifically, if ASM utilizes WS_FTP or Confluence Data Center or Servers)?On September 14, 2023, Progress Software released a security advisory for a remote code execution (RCE) vulnerability in the WinSock File Transfer Protocol (WS_FTP) Server, which Mandiant Intelligence rates as High-risk. The vulnerability tracked as CVE-2023-40044 caused by a flaw in how the WS_FTP Server handles ad-hoc commands, which an attacker can exploit by sending a specially crafted request to the server to execute arbitrary code on the system. (CVSSv3.1 Base 9.8)On October 4, 2023, Atlassian published a security advisory on a critical vulnerability (CVE-2023-22515) in publicly accessible Confluence Data Center and Server instances where an attacker could create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites not affected by this vulnerability. (CVSSv3.0 Base: 10)Any g

02
ionutm
Staff
S
Staff
scottennisStaff
posted in Google Threat Intelligence
New Google Cloud Security Customer Success Services Available!

  We are excited to announce the availability of Google Cloud Security Customer Success subscriptions.   Optimize your Google Cloud Security experience to achieve desired business outcomes together with a team of security experts. Choose the right success offering that best fits your organizational objectives and acquired security subscriptions. Standard: Offers digital and self-service resources, including onboarding, subscription walkthroughs, documentation, and access to knowledge base with product trainings. Expert: Offers a designated Customer Success Manager and Technical Solutions Consultants, providing customized success plans, and strategic guidance. Expert+: Includes everything from Expert and more, including a designated Security Advisor (SA) focused on advanced adoption and helping your security operations. Learn more about Cloud Security Customer Success on the Google Cloud site.

00
S
Staff
S
Staff
scottennisStaff
posted in Google Threat Intelligence
Join our Webinar: Living on the Edge: Investigating Ivanti Connect Secure VPN Zero-Day Exploits

We have a webinar, Living on the Edge: Investigating Ivanti Connect Secure VPN Zero-Day Exploits coming up this Thursday January 18, 2024. It is a free webinar. Click here to sign up.   

00
S
Staff
S
secops123New Member
posted in Google Threat Intelligence
Why are some inferred CVEs come without a reference to (MA)TI Threat?

Is there a good explanation why some inferred CVEs come without a reference to (MA)TI Threat Intelligence when the vuln exists in MATI Vulns?For instance CVE-2022-36760 had been detected by ASM, but the link to MATI is missing even so so it seems the CVE had been added to MATI early 2023.help please?

11
S
Staff
hzmndt
Staff
hzmndtStaff
posted in Google Threat Intelligence
Mandiant Attack Surface Management 30-day free trial

Mandiant Attack Surface Management 30-day free trial https://www.mandiant.com/attack-surface-management-free-trial  

60
hzmndt
Staff

Badge winners

Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.