GoogleThreatIntelligence

Analyzes suspicious hashes, URLs, domains, and IP addresses.

Data Enrichment & Threat Intelligence · GoogleThreatIntelligence

Configuration parameters

  • credentials — API Key (leave empty. Fill in the API key in the password field.) (required)
  • feedReliability — Source Reliability
  • gti_malicious — GTI Malicious Verdict. Check Google Threat Intelligence verdict to consider the file malicious.
  • gti_suspicious — GTI Suspicious Verdict. Check Google Threat Intelligence verdict to consider the file suspicious.
  • fileThreshold — File Malicious Threshold. Minimum number of positive results from VT scanners to consider the file malicious.
  • fileSuspiciousThreshold — File Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the file suspicious.
  • ipThreshold — IP Malicious Threshold. Minimum number of positive results from VT scanners to consider the IP malicious.
  • ipSuspiciousThreshold — IP Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the IP suspicious.
  • disable_private_ip_lookup — Disable reputation lookups for private IP addresses
  • urlThreshold — URL Malicious Threshold. Minimum number of positive results from VT scanners to consider the URL malicious.
  • urlSuspiciousThreshold — URL Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the URL suspicious.
  • domainThreshold — Domain Malicious Threshold. Minimum number of positive results from VT scanners to consider the Domain malicious.
  • domainSuspiciousThreshold — Domain Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the Domain suspicious.
  • preferredVendors — Preferred Vendors List. CSV list of vendors who are considered more trustworthy.
  • preferredVendorsThreshold — Preferred Vendor Threshold. The minimum number of highly trusted vendors required to consider a domain, IP address, URL, or file as malicious.
  • crowdsourced_yara_rules_enabled — Enable score analyzing by Crowdsourced Yara Rules, Sigma, and IDS.
  • yaraRulesThreshold — Crowdsourced Yara Rules Threshold
  • SigmaIDSThreshold — Sigma and Intrusion Detection Rules Threshold
  • domain_popularity_ranking — Domain Popularity Ranking Threshold
  • ip_relationships — IP Relationships
  • domain_relationships — Domain Relationships
  • url_relationships — URL Relationships
  • file_relationships — File Relationships
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (31)

  • cve

    Retrieves CVE information from Google Threat Intelligence.

  • domain

    Checks the reputation of a domain.

  • file

    Checks the file reputation of the specified hash.

  • file-rescan

    Rescans an already submitted file. This avoids having to upload the file again. Use the gti-analysis-get command to get the scan results.

  • file-scan

    Submits a file for scanning. Use the gti-analysis-get command to get the scan results.

  • gti-analysis-get

    Scan and get the analysis of a file submitted to GoogleThreatIntelligence.

  • gti-assessment-get

    Retrieves GTI assessment for a given resource.

  • gti-comments-add

    Adds comments to files and URLs.

  • gti-comments-delete

    Delete a comment.

  • gti-comments-get

    Retrieves comments for a given resource.

  • gti-comments-get-by-id

    Retrieves a comment by comment ID.

  • gti-curated-campaigns-get

    Retrieves GTI curated campaigns for a given resource.

  • gti-curated-malware-families-get

    Retrieves GTI curated malware families for a given resource.

  • gti-curated-threat-actors-get

    Retrieves GTI curated threat actors for a given resource.

  • gti-file-sandbox-report

    Retrieves a behavioral relationship of the given file hash.

  • gti-file-scan-and-analysis-get

    Scan and get the analysis of a file submitted to GoogleThreatIntelligence.

  • gti-file-scan-upload-url

    Get a special URL for files larger than 32 MB.

  • gti-file-sigma-analysis

    Result of the last Sigma analysis in markdown format.

  • gti-passive-dns-data

    Returns passive DNS records by indicator.

  • gti-private-file-scan-and-analysis-get

    Scan and get the analysis of a private file submitted to GoogleThreatIntelligence.

  • gti-private-url-scan-and-analysis-get

    Scan and get the analysis of a private URL submitted to GoogleThreatIntelligence.

  • gti-privatescanning-analysis-get

    Get analysis of a private file or URL submitted to GoogleThreatIntelligence.

  • gti-privatescanning-file

    Checks the file reputation of the specified private hash.

  • gti-privatescanning-file-scan

    Submits a file for private scanning. Use the gti-privatescanning-analysis-get command to get the scan results.

  • gti-privatescanning-url

    Checks the reputation of a private URL.

  • gti-privatescanning-url-scan

    Submits an URL for private scanning. Use the gti-privatescanning-analysis-get command to get the scan results.

  • gti-search

    Search for an indicator in Google Threat Intelligence.

  • gti-url-scan-and-analysis-get

    Scan and get the analysis of a URL submitted to GoogleThreatIntelligence.

  • ip

    Checks the reputation of an IP address.

  • url

    Checks the reputation of a URL.

  • url-scan

    Scans a specified URL. Use the gti-analysis-get command to get the scan results.