Google Threat Intelligence

Esteemed GCSC & GTIG members,This is Shehab Anwer, I am a cardiologist, and a REDCap administrator - with some coding skills - and following the recent GTIG report on UNC6508 and the INFINITERED malware targeting REDCap servers, and an earlier report in February - I would like to share a project I've been independently developing over the past few months:REDACTS (REDCap Arbitrary Code Threat Scan) is a contract-driven static and dynamic forensic toolkit designed to help detect arbitrary code, persistence mechanisms, and INFINITERED-style threats in REDCap deployments without concurrent execution on live servers.Key points:Built specifically for REDCap environments (often handling sensitive research and clinical data) and runs off-server/oof-cloud on packed content of deployment for local/air-tight execution according to user setup. Performs differential analysis against source REDCap releases (only availabe from REDCap consortium) or those verified by the on-site administrators for

In the May 25 release notes for Google Threat Intelligence, we introduced the concept of private knowledge collections, which allow you to create your own private instances of GTI objects like Malware, Campaigns, Threat Actors, and more.Creating these private objects allows GTI teams to blend localized threat intelligence with Google’s global dataset rather than waiting for vendor attribution. Some of the common use cases you might be interested in include creating a private collection based on the contents of a security blog or a PDF document that you are analyzing.   An excellent way to implement this workflow is by leveraging the GTI MCP server in combination with “skills” to guide agents through the process of generating private collections based on these external resources.In this post you’ll find two agent skills:  One for creating a private collection based on PDFs and another for creating a private collection based on a security blog.  You can introduce these skills into your e

Hi, want to report annoying behavior of share.google in hope somebody from Google devs team can hook up and fix this security gap.Right now links to https://share[.]google/EnyBDZiv3ksnQT9xZ would lead to https://www.google.com/share[.]google?q=EnyBDZiv3ksnQT9xZ via 301 redirect by both HEAD & GET, but from that point https://www.google.com/share[.]google?q=EnyBDZiv3ksnQT9xZ - would reply with 302 redirect only on GET, and not HEAD, which is violation of RFC 9110 Section 9.3.2 and breaks automated systems from safely verifying destination link, which in case with share.google in 99% cases now used as obscurity platform to spread phishing, fraud, malware and other not good things.

I’m looking to set up a process that allows me to monitor a list of vendors and whether they show up in breaches - i.e.search a vendor name, website or email in GTI programmatically via API and see if theyre ivolved in breaches. Is that possible via GTI? What coverage for sources does GTI have if thats possible?

Does GTI have the capabilities to provide information on third parties that we specify - i.e. we want to track to see if our vendors have been breached - does GTI provide any capabilities via API to query  breach info that is collated from open source feeds and any proprietary feds (e.g. the dark web)?

Hello Google Cloud Community,I am the founder of Meyra Digital Plant Health Clinic (DPHC), an initiative focused on supporting smallholder farmers with accessible, AI-powered plant health services.Our mission is to reduce dependency on chemical pesticides by providing farmers with natural, locally available solutions combined with intelligent diagnosis tools.We are currently exploring how to leverage Google Cloud to build a scalable and impactful system with the following components:Image-based plant disease detection using AI/MLAutomated advisory system for eco-friendly treatment recommendationsMobile-first delivery (Telegram bot / lightweight apps) for rural accessibilityScalable backend infrastructure for future expansionI would greatly appreciate guidance from the community on:The most suitable Google Cloud services for building and scaling this solution (e.g., Vertex AI, Firebase, Cloud Run)Best approaches for training or integrating plant disease detection modelsDesigning cost-ef

My production project is down and suspended for 48h now with no prior notice and no reply for my appeal request. Not sure what to do.  We are facing a huge loss. I have audited all my code for any security leak and it is clean. Not sure what happened.

I have a SOAR playbook for investigating emails. As part of the playbook, domain and URL case entities are checked against static lists to see if they are:1 - Free Share Link sites2- Domains for free email services (e.g. gmail.com)3 - URL shorteners4 - A obviously benign entity, belonging to a trusted organisation such as bank e.g. jpmorganchase.comDoes GI check and report back whether submitted domain or URL IOCs belong to any of these categories, if the submission is done via API?

Hello everyone,I hope this is the right place to ask. We (Argos Security) have a question regarding GTI and the API-Usage. Right now our Company is on the plan "Integration Advanced" which gives us certain API-Allowance. Now, what we would like to do, which is impossible according to our Google-Contact, is to change our plan and Daily caps. I can not believe that, even with throwing in more money, it is supposed to be impossible to change our daily caps. Some products we do not need at all (Diff and Private Graph for example) while others we need a way higher cap (ASM for example). Could please someone give me a hint on who to contact to get this sorted out, if possible? 

Hi Everyone!In support of my upcoming webinar later this week, I wanted to post the Custom Prompt I developed which I use to help convert Advanced IOC Searches into YARA-X Queries used in Livehunting inside of Google Threat Intelligence.  Feel free to use this query and save it as part of your prompts library so you can consistently use this to help you convert IOC Searches and their modifiers into Livehunts. Role: Act as a Senior Threat Intelligence and Malware Analyst and YARA-X Engineering Expert specializing in Google Threat Intelligence and LiveHunting deployments. You have deep expertise in writing highly performant, syntax-perfect rules that scale across massive data streams without causing performance degradation or high false-positive rates. You are a master of converting Advanced IOC Searches from Google Threat Intelligence into Livehunt rules using YARA-X.Action: Translate the provided Advanced IOC Search logic into a fully functional, highly optimized YARA-X rule ready for

How can I forward alerts from My Landscape Organization Profile in GTI to create JIRA tickets.

Hello all,Can GTI be used to determine whether a certain IP or domain is linked to bulletproof hosting or commercial VPN services?Alternatively, is it possible to enrich IPs or domains with any ports or services being run/open on them? Akin to what this Microsoft endpoint would do - https://learn.microsoft.com/en-us/graph/api/resources/security-hostport?view=graph-rest-1.0

Hello everyone,I’m exploring Google Threat Intelligence capabilities and I want to understand if it’s possible to set up custom rules or alerts that specifically track vulnerabilities for particular products (e.g., a certain software or hardware vendor).For example, I’d like to be notified whenever a new CVE affecting a specific product is reported, rather than monitoring general threat feeds.Is there a way to configure Google Threat Intelligence to focus on selected products? Are there any best practices or limitations I should be aware of?Thanks in advance for any guidance!

While ingesting the GTI ioc’s to secops observed a below where we are able to fetch the logs from the GTI and unable to ingest to secops.textPayload: "Error occurred while fetching and ingesting malware data. Error: SSLError(MaxRetryError("HTTPSConnectionPool(host='chronicle.asia-south1.rep.googleapis.com', port=443): Max retries exceeded with url: /v1beta/projects/ [removed by moderator] /locations/asia-south1/instances/1eae0894-b5ea-4413-85de-42aaf69dc3233/logTypes/GCP_THREATINTEL/logs:import (Caused by SSLError(SSLEOFError(8, 'EOF occurred in violation of protocol (_ssl.c:2427)')))"))"

We recently deployed an automated Health‑ISAC → Google SecOps (Chronicle) ingestion pipeline using the following components:Health‑ISAC STIX/TAXII 2.1 collections Cloud Run (Python 3.9) for TAXII polling, indicator transformation, and Chronicle ingestion Cloud Scheduler (cron: */60 * * * *) Secret Manager for Chronicle API Auth JSON + HITS_PASSWORD Terraform for provisioning (Cloud Run, Scheduler, IAM, WIF)The ingestion pipeline successfully executes every hour, Chronicle returns success response codes, and indicators are visible in the GCS export logs.IssueWhile ingestion logs/reporting confirm indicators are successfully pushed to Chronicle, indicators do not appear in the Chronicle UI:They are visible in Cloud Logging + GCS export Chronicle ingest API responds with 200 But the same indicators cannot be found in Chronicle (IOC Search, Entity Search, IOC Feed UI, or via UDM Search)

I’m looking for explanations, recommendations, or general guidance to help us achieve a more consistent and reliable experience when using the Research Tools and Monitors within Google Threat Intelligence.We regularly search for intelligence related to specific organizations using Digital Threat Monitoring Research Tools. A simplified example of a query we commonly use is below (in practice, we often include additional AND conditions to narrow the scope):domain:"company.com" OR group_brand:"Company"However, we’ve encountered several recurring issues and inconsistencies that make it challenging to reliably search for and analyze intelligence. I’ve outlined the primary concerns below.Observed Issues Inconsistent query execution The same query may time out multiple times before eventually succeeding. For example, running the same search five times may result in four timeouts followed by one successful execution. In other cases, a query will work without issue, but when rerun later (with

Hello Google Threat Intelligence Team,I would like clarification on how indicators are represented in the Active Threat Intelligence Feed within Google SecOps.Specifically, does the feed differentiate between: Primary (directly observed) indicators Associated (related infrastructure) indicators To clarify what I mean:A primary indicator would be an artifact that was directly observed in confirmed malicious activity. For example: A specific phishing URL used in an intrusion (e.g., hxxps://login-example[.]com/auth) A C2 domain actively used by malware in a breach A hash of malware recovered during incident response An associated indicator, however, might include: The IP address hosting that phishing domain (which may also host other benign domains) Additional domains resolving to the same infrastructure but not directly observed in the campaign Infrastructure sharing WHOIS, SSL certificate, ASN, or registration artifacts with the malicious domain A CDN IP address (e.g., infra

I have reported the domain to Google Safe Browsing multiple times and checked VirusTotal for malware or C2 botnet infection, but when I report it on https://safebrowsing.google.com/, I don't see any results indicating the domain is restricted.

Hello Cloudflare Sales Team,We are a cybersecurity company operating in Türkiye and actively provide services to multiple corporate brands.There are numerous phishing websites currently impersonating the brands we protect. Our request is specifically for Cloudflare to apply warning/interstitial notices to these malicious websites in order to protect end users.If this warning service can be provided quickly and efficiently, we would like to proceed with a commercial collaboration and purchase this service from Cloudflare.For your reference, screenshots of sample phishing websites are included in the attached file.We kindly ask you to share further details regarding: Service scope and availability Commercial terms Onboarding and next steps We look forward to your response.Kind regards,

Why does Mandiant make it so hard to opt-out from their attacks? They do not provide any reverse DNS for their attack points, thus hiding their identity behind fake or hosted whois data

AI agents and agentic browsers are starting to act as full participants in the digital economy - discovering products, comparing prices, even initiating transactions on their own.If this becomes the norm, our threat models are about to shift fast.Google’s SAIF framework calls for extending detection and response to AI systems, automating defenses at machine speed, and harmonizing controls across platforms.But here’s the tension: most organizations today can’t even see when an AI agent is the one interacting with their site, applications or API.That raises some big questions for this community: How should we distinguish legitimate agentic browsing from automated abuse? What happens when agentic browsers start exploiting business logic or scraping at scale, intentionally or not? How do we build consistent policies across web, employee desktops, mobile, and APIs when AI agents don’t stay in one channel? Who owns governance of AI agents inside an org, security or product? SAIF gives