When a high-severity alert fires, the clock starts. Pulling the trigger on a high-priority incident response is also expensive. It pulls people off other work, can disrupt the business, and costs real money. A bare number isn't enough to justify that. This deck covers Google Threat Intelligence (GTI) Score Explainability. It details a new feature that shows the evidence behind every 0-100 score, so we can remove doubt about whether to pull the trigger.
Evidence Instead of a Black Box
The Explainability Drawer pins the highest-impact factor at the top, such as malware family attribution, an active actor, or capabilities. That saves us from pivoting across multiple tabs. Below it, clickable evidence cards group human-verified Mandiant intelligence, sandbox results, YARA rules, and mitigating signals. Each card links to the underlying reports.
Matching the Response to the Score
GTI weighs confidence and impact across more than 100 telemetry signals and sorts threats into three tiers:
- Active Threats (80-100): Verified, high-severity items like active C2 or ransomware. These justify immediate blocking and IR escalation.
- Early Delivery (30-79): Droppers and early attack-chain tools. These call for alerts and log hunting, not full IR activation.
- Aged-Off and Tools (capped at 29): Decayed indicators, like dormant C2s older than 30 days, and dual-use admin tools.
Automating with Confidence
Through the GTI API, our SIEM and SOAR playbooks can pull the gti_assessment JSON for files, domains, IPs, or URLs. They can then add evidence cards to SOC tickets or trigger containment based on verified context. Mitigating factors, such as trusted signers and global traffic popularity, act as guardrails against false positives.
Why It Matters for Us
A high score tells us something is wrong. The evidence tells us whether it's worth escalating. As you go through the deck, think about how we validate automated scores today. Where could this transparency give us more confidence in that call?
For more detailed information go to: Google Threat Intelligence Indicator Score
