Google Threat Intelligence Threat Lists

Use this feed integration to fetch Google Threat Intelligence Threat Lists matches as indicators.

Data Enrichment & Threat Intelligence · GoogleThreatIntelligence · Feed

Details

IDGoogle Threat Intelligence Threat Lists
ProviderGoogle
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Use this feed integration to fetch Google Threat Intelligence Threat Lists matches as indicators. It processes the latest finished job retrieving its matches based on the limit parameter (10 by default) in every fetch until there are no more matches for that job.

Configure Google Threat Intelligence Threat Lists on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Google Threat Intelligence Threat Lists.
  3. Click Add instance to create and configure a new integration instance.
Parameter Description Required
feed The fetch indicators. False
credentials API Key. True
feed_type Feed type. True
filter Filter your Threat Lists (e.g., “gti_score:70+ positives:10- has:campaigns”). Leave empty to receive all. False
limit The maximum number of results to return. Default is 10. False
feedReputation The indicator reputation. False
feedReliability The source’s reliability. True
tlp_color The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed. More information about the protocol can be found at https://us-cert.cisa.gov/tlp False
feedExpirationPolicy The feed’s expiration policy. False
feedFetchInterval The feed fetch interval. False
feedBypassExclusionList Whether to bypass exclusion list. False
  1. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

gti-threatlists-get-indicators

Gets the matches from Google Threat Intelligence Threat Lists.

Base Command

gti-threatlists-get-indicators

Input

Argument Name Description Required
feed_type Feed type. Required
package Package in ‘%Y%m%d%H’ format. If not given, the latest package is taken. Optional
filter Filter your Threat Lists (e.g., “gti_score:70+ positives:10- has:campaigns”). Leave empty to receive all. Optional
limit The maximum number of results to return. Default is 10. Optional

Context Output

There is no context output for this command.

Command Example

!gti-threatlists-get-indicators
!gti-threatlists-get-indicators feed=malware package=2025021910 filter="gti_score:70+" limit=10

Human Readable Output

Indicators from Google Threat Intelligence Threat Lists

Id Detections Gti Threat Score Gti Severity Gti Verdict Malware Families Threat Actors
f221425286c9073cbb2168f73120b6… 59/69 80 SEVERITY_LOW VERDICT_MALICIOUS beacon SWEED

Configuration parameters

  • credentials — API Key (leave empty. Fill in the API key in the password field.) (required)
  • feed_type — Feed type.
  • filter — Filter
  • limit — The maximum number of results to return. If 0 all results will be returned.
  • feed — Fetch indicators
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedFetchInterval — Feed Fetch Interval
  • feedBypassExclusionList — Bypass exclusion list
  • feedTags — Tags
  • tlp_color — Traffic Light Protocol Color

Commands (1)

  • gti-threatlists-get-indicators

    Gets the matches from the latest Feed.

Source

FeedThreatLists.py FeedThreatLists_test.py FeedThreatLists.yml FeedThreatLists_description.md
Download History Raw 
### Authorization:
Your API key can be found in your Google Threat Intelligence account user menu.
Your API key carries all your privileges, so keep it secure and don't share it with anyone.

### Feed types:
Currently there are 14 feed types: cryptominer, first-stage-delivery-vectors, infostealer, iot, linux, malicious-network-infrastructure, malware, mobile, osx, phishing, ransomware, threat-actor, trending and vulnerability-weaponization.

### Cortex XSOAR version 6.0.0 and below:
Fill anything in the "Username" fill box. Use you API key in the password fill box.