GoogleThreatIntelligenceDTMAlerts

This integration allows the creation of incidents based on DTM Alerts from Google Threat Intelligence.

Data Enrichment & Threat Intelligence · GoogleThreatIntelligence

Details

ID	`GoogleThreatIntelligenceDTMAlerts`
Provider	Google
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Google Threat Intelligence - DTM Alerts

This integration allows the creation of incidents based on DTM Alerts from Google Threat Intelligence.

Configure Google Threat Intelligence - DTM Alerts in Cortex

Parameter	Description	Required
API Key		True
Fetch incidents		False
Max Fetch	Maximum number of Alerts to fetch each time. Maximum value is 100.	False
First Fetch Time	The date or relative timestamp from which to begin fetching Alerts. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 May 2025, 01 May 2025 04:45:33, 2025-05-17T14:05:44Z.	False
Mirroring Direction	The mirroring direction in which to mirror the details. You can mirror “Outgoing” (from XSOAR to GTI) direction for DTM Alerts. Cortex XSOAR only parameter.	False
Alert Type	Fetch Alerts by the specified alert types.	False
Alert Monitor ID	Fetch Alerts by the specified monitor IDs.	False
Alert Status	Fetch Alerts by the specified status.	False
Alert Severity	Fetch Alerts by the specified severity.	False
Alert Tags	Fetch Alerts by the specified tags.	False
Alert Match Value	Fetch Alerts by specified match value.	False
Alert mscore	Fetch Alerts with mscore greater than or equal to the given value. Note: Valid range is 0 to 100.	False
Alert Search	Search Alerts and triggering documents using a Lucene query with text values joined by AND/OR.	False
Use system proxy settings		False
Trust any certificate (not secure)		False
Incident type

Acquiring your API key

Your API key can be found in your GoogleThreatIntelligence account user menu, clicking on your avatar:

How to get api key in GoogleThreatIntelligence

Your API key carries all your privileges, so keep it secure and don’t share it with anyone.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

gti-dtm-alert-list

Search the DTM Alerts with provided filter arguments.

Base Command

gti-dtm-alert-list

Input

Argument Name	Description	Required
start_time	Start time of the time range to list alerts. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 May 2025, 01 Mar 2025 04:45:33, 2025-04-17T14:05:44Z.	Optional
end_time	End time of the time range to list alerts. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 May 2025, 01 Mar 2025 04:45:33, 2025-04-17T14:05:44Z.	Optional
order	Filter alerts by the provided sort order. Possible values are: Asc, Desc. Default is Desc.	Optional
sort	Filter alerts by the provided sort field. Possible values are: Created At, Updated At, Monitor ID, ID. Default is Created At.	Optional
page_size	Specify the desired page size for the request. Maximum value is 25. Default is 10.	Optional
monitor_id	Filter alerts by monitor IDs. Supports comma-separated values.	Optional
alert_type	Filters alerts by their alert type. Supports comma-separated values. Possible values are: Compromised Credentials, Domain Discovery, Forum Post, Message, Paste, Shop Listing, Tweet, Web Content.	Optional
tags	Filter alerts by tags value. Supports comma-separated values.	Optional
status	Filter alerts by the provided status. Supports comma-separated values. Possible values are: New, Read, In Progress, Escalated, Closed, No Action Required, Duplicate, Not Relevant, Tracked External.	Optional
severity	Filter alerts by severity. Supports comma-separated values. Possible values are: Low, Medium, High.	Optional
mscore_gte	Filter alerts with mscore greater than or equal to the given value. Note: Valid range is 0 to 100.	Optional
include_more_details	If yes, doc, labels, and topics are returned in the context data. Possible values are: Yes, No. Default is Yes.	Optional
include_monitor_name	If yes, then the monitor’s name that created the alert is returned in the alert response body. Possible values are: Yes, No. Default is No.	Optional
has_analysis	If yes, then only alerts that have analysis are returned. An alert has analysis if it has either analysis text or analysis file attachments. Possible values are: Yes, No.	Optional
search	Filter alert and triggering document contents using a simple Lucene query string with one or more text values separated by AND or OR.	Optional
match_value	Filter alerts by the given match value. Supports comma-separated values.	Optional

Context Output

Path	Type	Description
GoogleThreatIntelligenceDTMAlerts.Alerts.id	String	Unique identifier for the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_id	String	Identifier of the monitoring source that generated the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__id	String	Unique document ID associated with the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__type	String	Type of document associated with the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.body	String	Full content or message body of the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_id	String	ID of the channel where the alert was observed.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_info.description	String	Description of the channel where the alert was detected.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_url	String	URL of the detected channel.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.invite_url	String	Invite link of the detected channel, if available.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.id	String	Identifier of the messenger platform linked to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.name	String	Name of the messenger platform.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.name	String	Name of the channel where the content was found.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.ingested	Date	Date and time when the document was ingested into the system.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.message_id	String	Identifier of the specific message triggering the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.id	String	Messenger platform ID associated with the message.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.name	String	Name of the messenger platform associated with the message.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.hashes.sha256	String	SHA-256 hash of the sender’s avatar file.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.mime_type	String	MIME type of the sender’s avatar file.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.first_name	String	First name of the sender.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.last_name	String	Last name of the sender.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.name	String	Full name of the sender.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.name	String	Telegram username of the sender.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.user_id	Number	Telegram user ID of the sender.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.source	String	Source of the document or content triggering the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.timestamp	Date	Timestamp when the message or document was created.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.id	String	Unique identifier of the label assigned to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.classifier	String	Classifier name used for label assignment.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.version	String	Version of the classifier or labeling process.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.label	String	Name of the label assigned to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.confidence	Number	Confidence score of the assigned label.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.element_path	String	Path of the element where the label was applied.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.id	String	Unique identifier of the extracted topic.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.type	String	Type of the extracted topic.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.value	String	Value of the extracted topic.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor	String	Name of the topic extraction tool.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor_version	String	Version of the topic extractor used.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.element_path	String	Path of the element where the entity was detected.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.offsets	Number	Character offsets of the detected entity in the document.
GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.topic_id	String	Identifier of the matched topic.
GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.value	String	Matched value for the topic.
GoogleThreatIntelligenceDTMAlerts.Alerts.label_matches	List	List of labels matched for the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.match_path	String	Path within the document where a match occurred.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.offsets	Number	Offset positions of the document match.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.value	String	Value of the matched document content.
GoogleThreatIntelligenceDTMAlerts.Alerts.tags	List	Tags associated with the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.created_at	Date	Date and time when the alert was created.
GoogleThreatIntelligenceDTMAlerts.Alerts.updated_at	Date	Date and time when the alert was last updated.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels_url	String	URL to fetch labels associated with the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics_url	String	URL to fetch topics associated with the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc_url	String	URL of the original document related to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.status	String	Current status of the alert (e.g., open, closed, triaged).
GoogleThreatIntelligenceDTMAlerts.Alerts.alert_type	String	Type or category of the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.alert_summary	String	Summary of the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.title	String	Title of the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.email_sent_at	String	Timestamp when the alert email was sent.
GoogleThreatIntelligenceDTMAlerts.Alerts.indicator_mscore	Number	Malicious score of the indicator related to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.severity	String	Severity level of the alert (e.g., low, medium, high).
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence	Number	Confidence score of the alert detection.
GoogleThreatIntelligenceDTMAlerts.Alerts.aggregated_under_id	String	ID under which the alert has been aggregated.
GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_name	String	Name of the monitoring source that generated the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.analysis	String	Analysis report or details associated with the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.has_analysis	Boolean	Indicates whether the alert has an associated analysis.
GoogleThreatIntelligenceDTMAlerts.Alerts.ai_doc_summary	String	AI-generated summary of the document related to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.similarity_score	Number	Similarity score between this alert and related alerts.
GoogleThreatIntelligenceDTMAlerts.Alerts.severity_reasoning.rule	String	Rule used to determine the severity of the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.version	String	Version of the confidence reasoning model.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.response_count	Number	Number of responses contributing to confidence reasoning.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.malicious_count	Number	Number of malicious detections contributing to confidence.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.benign_count	Number	Number of benign detections contributing to confidence.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.confidence_count	Number	Total number of samples considered for confidence calculation.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.explanation	String	Explanation behind the confidence score.
GoogleThreatIntelligenceDTMAlerts.Alerts.ignore	Boolean	Indicates if the alert should be ignored.
GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_version	Number	Version of the monitoring source generating the alert.

Command example

!gti-dtm-alert-list alert_type=Message include_monitor_name=Yes include_more_details=Yes mscore_gte=11 order=Desc page_size=2 search=social severity=Low sort="Created At" tags=attempt

Context Example

{
    "GoogleThreatIntelligenceDTMAlerts": {
        "Alerts": [
            {
                "aggregated_under_id": "dummyaggregated_id_01",
                "ai_doc_summary": "This message advertises a service that provides fraudulent Google verification badges for any account. \n",
                "alert_summary": "Google verification badges for any account of the gmail and cloud.",
                "alert_type": "Message",
                "confidence": 0.20271267571752816,
                "confidence_reasoning": {
                    "benign_count": 0,
                    "malicious_count": 0,
                    "response_count": 0,
                    "version": ""
                },
                "created_at": "2025-05-21T11:28:02.646Z",
                "doc": {
                    "__id": "dummy_id_01",
                    "__type": "message",
                    "body": "dummy body for DTM Alerts",
                    "channel": {
                        "channel_id": "channeldummy",
                        "channel_info": {
                            "description": "Surge Market"
                        },
                        "channel_url": "dummyurl",
                        "invite_url": "dummyurl",
                        "messenger": {
                            "id": "Googlechat",
                            "name": "Googlechat"
                        },
                        "name": "social"
                    },
                    "ingested": "2025-05-21T11:27:45Z",
                    "message_id": "dummymessageid01",
                    "messenger": {
                        "id": "Googlechat",
                        "name": "Googlechat"
                    },
                    "sender": {
                        "identity": {
                            "first_name": "Crome Bot",
                            "name": "Crome Bot "
                        },
                        "googlechat": {
                            "name": "gmail",
                            "user_id": 220903062
                        }
                    },
                    "source": "googlw",
                    "timestamp": "2025-05-21T11:27:42Z"
                },
                "doc_matches": [
                    {
                        "locations": [
                            {
                                "offsets": [
                                    688,
                                    692
                                ],
                                "value": "full"
                            },
                            {
                                "offsets": [
                                    693,
                                    699
                                ],
                                "value": "access"
                            }
                        ],
                        "match_path": "body"
                    }
                ],
                "doc_url": "https://www.virustotal.com/v4/dtm/docs/message/dummydocurl01",
                "email_sent_at": "",
                "has_analysis": false,
                "id": "dummy_0000",
                "ignore": false,
                "indicator_mscore": 11,
                "tags": ["attempt","Test"],
                "labels": [
                    {
                        "classifier": "classifier-content",
                        "confidence": 100,
                        "element_path": "body",
                        "id": "dummy_label_id",
                        "label": "prose",
                        "version": "dummy_version"
                    }
                ],
                "labels_url": "https://www.virustotal.com/v4/dtm/docs/message/dummydocurl01/labels",
                "monitor_id": "dummy_monitor_id",
                "monitor_name": "Initial Access Broker",
                "monitor_version": 1,
                "severity": "low",
                "severity_reasoning": {
                    "rule": ""
                },
                "similarity_score": 0.9906103,
                "status": "read",
                "title": "Found topic \"google\" posted by actor \"sevenbump\" on channel \"social\"",
                "topic_matches": [
                    {
                        "offsets": [
                            0,
                            4
                        ],
                        "term": "google",
                        "topic_id": "dummy_topicid_01",
                        "value": "google"
                    },
                    {
                        "topic_id": "dummy_topicid_02",
                        "value": "message"
                    }
                ],
                "topics": [
                    {
                        "confidence": 99,
                        "entity_locations": [
                            {
                                "element_path": "body",
                                "offsets": [
                                    488,
                                    491
                                ]
                            }
                        ],
                        "extractor": "analysis of the message",
                        "extractor_version": "4-0-2",
                        "id": "dummy_topicid_01",
                        "type": "organization",
                        "value": "social"
                    },
                    {
                        "confidence": 94,
                        "entity_locations": [
                            {
                                "element_path": "body",
                                "offsets": [
                                    701,
                                    704
                                ]
                            }
                        ],
                        "extractor": "analysis-pipeline",
                        "extractor_version": "4-0-2",
                        "id": "dummy_topicid_02",
                        "type": "product",
                        "value": "social"
                    }
                ],
                "topics_url": "https://www.virustotal.com/v4/dtm/docs/message/dummydocurl02/topics",
                "updated_at": "2025-05-22T07:09:51.257Z"
            },
            {
                "aggregated_under_id": "dummy_aggregated_under_id_02",
                "ai_doc_summary": "This message advertises a service that offers unauthorized google account.\n",
                "alert_summary": "Google account verification service cromeam Stand out your way use any name any username any profile pic or none at all.",
                "alert_type": "Message",
                "confidence": 0.20271267571752816,
                "confidence_reasoning": {
                    "benign_count": 0,
                    "malicious_count": 0,
                    "response_count": 0,
                    "version": ""
                },
                "created_at": "2025-05-21T10:19:04.241Z",
                "doc": {
                    "__id": "dummy_doc_id_02",
                    "__type": "message",
                    "body": "this is body of message",
                    "channel": {
                        "channel_id": "-1001097206146",
                        "channel_info": {
                            "description": "Surge Market"
                        },
                        "channel_url": "https://dummyurl.com",
                        "invite_url": "https://dummyurl.com",
                        "messenger": {
                            "id": "googlechat",
                            "name": "Googlechat"
                        },
                        "name": "social"
                    },
                    "ingested": "2025-05-21T10:19:00Z",
                    "message_id": "dummy_message_id_02",
                    "messenger": {
                        "id": "googlechat",
                        "name": "Googlechat"
                    },
                    "sender": {
                        "identity": {
                            "first_name": "Crome Bot",
                            "name": "Crome Bot "
                        },
                        "telegram": {
                            "name": "sevenbump",
                            "user_id": 220903062
                        }
                    },
                    "source": "google",
                    "timestamp": "2025-05-21T10:18:55Z"
                },
                "doc_matches": [
                    {
                        "locations": [
                            {
                                "offsets": [
                                    688,
                                    692
                                ],
                                "value": "full"
                            },
                            {
                                "offsets": [
                                    693,
                                    699
                                ],
                                "value": "access"
                            }
                        ],
                        "match_path": "body"
                    }
                ],
                "doc_url": "https://www.virustotal.com/v4/dtm/docs/message/dummydocurl03",
                "email_sent_at": "",
                "has_analysis": false,
                "id": "dummy_0001",
                "ignore": false,
                "indicator_mscore": 11,
                "tags": ["attempt"],
                "labels": [
                    {
                        "classifier": "classifier-content",
                        "confidence": 100,
                        "element_path": "body",
                        "id": "dummyid03",
                        "label": "prose",
                        "version": "dummyversion03"
                    }
                ],
                "labels_url": "https://www.virustotal.com/v4/dtm/docs/message/dummydocurl03/labels",
                "monitor_id": "dummy_monitor_id",
                "monitor_name": "Initial Access Broker",
                "monitor_version": 1,
                "severity": "low",
                "severity_reasoning": {
                    "rule": ""
                },
                "similarity_score": 0.9906103,
                "status": "read",
                "title": "Found topic \"Google\" posted by actor \"sevenbump\" on Google channel \"social\"",
                "topic_matches": [
                    {
                        "offsets": [
                            0,
                            4
                        ],
                        "term": "dummyterm03",
                        "topic_id": "dummy_topic_01",
                        "value": "dummyvalue_03"
                    },
                    {
                        "topic_id": "dummay_topic_02",
                        "value": "message"
                    }
                ],
                "topics": [
                    {
                        "entity_locations": [
                            {
                                "element_path": "channel.name",
                                "offsets": [
                                    0,
                                    17
                                ]
                            }
                        ],
                        "extractor": "dtm-ma",
                        "extractor_version": "1.0.595",
                        "id": "dummy_topic_01",
                        "type": "name",
                        "value": "social"
                    },
                    {
                        "entity_locations": [
                            {
                                "element_path": "messenger.name",
                                "offsets": [
                                    0,
                                    8
                                ]
                            },
                            {
                                "element_path": "channel.messenger.name",
                                "offsets": [
                                    0,
                                    8
                                ]
                            }
                        ],
                        "extractor": "dtm-ma",
                        "extractor_version": "1.0.595",
                        "id": "dummay_topic_02",
                        "type": "service_name",
                        "value": "Googlechat"
                    }],
                "topics_url": "https://www.virustotal.com/v4/dtm/docs/message/dummy0001/topics",
                "updated_at": "2025-05-22T07:09:51.257Z"
            }
        ]
    }
}

Human Readable Output

DTM Alerts

Alert ID Title Alert Summary Alert Type Severity Status Monitor ID Monitor Name Indicator Score Created At Updated At Tags

dummy_0000 Found topic “google” posted by actor “sevenbump” on channel “social” This message advertises a service that provides fraudulent Google verification badges for any account.
Message Low Read dummy_monitor_id Initial Access Broker 11 2025-05-21T11:28:02.646Z 2025-05-22T07:09:51.257Z attempt,
Test

dummy_0001 Found topic “Google” posted by actor “sevenbump” on Google channel “social” This message advertises a service that offers unauthorized google account.
Message Low Read dummy_monitor_id Initial Access Broker 11 2025-05-21T10:19:04.241Z 2025-05-22T07:09:51.257Z attempt

Alert ID	Title	Alert Summary	Alert Type	Severity	Status	Monitor ID	Monitor Name	Indicator Score	Created At	Updated At	Tags
dummy_0000	Found topic “google” posted by actor “sevenbump” on channel “social”	This message advertises a service that provides fraudulent Google verification badges for any account.	Message	Low	Read	dummy_monitor_id	Initial Access Broker	11	2025-05-21T11:28:02.646Z	2025-05-22T07:09:51.257Z	attempt, Test
dummy_0001	Found topic “Google” posted by actor “sevenbump” on Google channel “social”	This message advertises a service that offers unauthorized google account.	Message	Low	Read	dummy_monitor_id	Initial Access Broker	11	2025-05-21T10:19:04.241Z	2025-05-22T07:09:51.257Z	attempt

gti-dtm-alert-get

Get a particular DTM Alert by ID.

Base Command

gti-dtm-alert-get

Input

Argument Name	Description	Required
alert_id	Specify ID of the alert. Note: Use gti-dtm-alert-list to retrive the Alert ID.	Required
include_more_details	If yes, doc, labels, and topics are returned in the context data. Possible values are: Yes, No. Default is Yes.	Optional
sanitize	If yes, any HTML content in the alert is sanitized to ensure it does not contain malicious tags. Possible values are: Yes, No.	Optional
truncate	Specify whether to truncate document fields to the given length. Note: A Unicode ellipsis (\x2026) is used to indicate truncation.	Optional

Context Output

Path	Type	Description
GoogleThreatIntelligenceDTMAlerts.Alerts.id	String	Unique identifier for the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_id	String	Identifier of the monitoring source that generated the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__id	String	Unique document ID associated with the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__type	String	Type of document associated with the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.body	String	Full content or message body of the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_id	String	ID of the channel where the alert was observed.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_info.description	String	Description of the channel where the alert was detected.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_url	String	URL of the detected channel.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.invite_url	String	Invite link of the detected channel, if available.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.id	String	Identifier of the messenger platform linked to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.name	String	Name of the messenger platform.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.name	String	Name of the channel where the content was found.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.ingested	Date	Date and time when the document was ingested into the system.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.message_id	String	Identifier of the specific message triggering the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.id	String	Messenger platform ID associated with the message.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.name	String	Name of the messenger platform associated with the message.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.hashes.sha256	String	SHA-256 hash of the sender’s avatar file.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.mime_type	String	MIME type of the sender’s avatar file.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.first_name	String	First name of the sender.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.last_name	String	Last name of the sender.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.name	String	Full name of the sender.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.name	String	Telegram username of the sender.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.user_id	Number	Telegram user ID of the sender.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.source	String	Source of the document or content triggering the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.timestamp	Date	Timestamp when the message or document was created.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.id	String	Unique identifier of the label assigned to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.classifier	String	Classifier name used for label assignment.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.version	String	Version of the classifier or labeling process.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.label	String	Name of the label assigned to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.confidence	Number	Confidence score of the assigned label.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.element_path	String	Path of the element where the label was applied.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.id	String	Unique identifier of the extracted topic.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.type	String	Type of the extracted topic.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.value	String	Value of the extracted topic.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor	String	Name of the topic extraction tool.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor_version	String	Version of the topic extractor used.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.element_path	String	Path of the element where the entity was detected.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.offsets	Number	Character offsets of the detected entity in the document.
GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.topic_id	String	Identifier of the matched topic.
GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.value	String	Matched value for the topic.
GoogleThreatIntelligenceDTMAlerts.Alerts.label_matches	List	List of labels matched for the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.match_path	String	Path within the document where a match occurred.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.offsets	Number	Offset positions of the document match.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.value	String	Value of the matched document content.
GoogleThreatIntelligenceDTMAlerts.Alerts.tags	List	Tags associated with the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.created_at	Date	Date and time when the alert was created.
GoogleThreatIntelligenceDTMAlerts.Alerts.updated_at	Date	Date and time when the alert was last updated.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels_url	String	URL to fetch labels associated with the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics_url	String	URL to fetch topics associated with the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc_url	String	URL of the original document related to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.status	String	Current status of the alert (e.g., open, closed, triaged).
GoogleThreatIntelligenceDTMAlerts.Alerts.alert_type	String	Type or category of the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.alert_summary	String	Summary of the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.title	String	Title of the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.email_sent_at	String	Timestamp when the alert email was sent.
GoogleThreatIntelligenceDTMAlerts.Alerts.indicator_mscore	Number	Malicious score of the indicator related to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.severity	String	Severity level of the alert (e.g., low, medium, high).
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence	Number	Confidence score of the alert detection.
GoogleThreatIntelligenceDTMAlerts.Alerts.aggregated_under_id	String	ID under which the alert has been aggregated.
GoogleThreatIntelligenceDTMAlerts.Alerts.has_analysis	Boolean	Indicates whether the alert has an associated analysis.
GoogleThreatIntelligenceDTMAlerts.Alerts.ai_doc_summary	String	AI-generated summary of the document related to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.similarity_score	Number	Similarity score between this alert and related alerts.
GoogleThreatIntelligenceDTMAlerts.Alerts.severity_reasoning.rule	String	Rule used to determine the severity of the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.version	String	Version of the confidence reasoning model.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.response_count	Number	Number of responses contributing to confidence reasoning.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.malicious_count	Number	Number of malicious detections contributing to confidence.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.benign_count	Number	Number of benign detections contributing to confidence.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.confidence_count	Number	Total number of samples considered for confidence calculation.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.explanation	String	Explanation behind the confidence score.
GoogleThreatIntelligenceDTMAlerts.Alerts.ignore	Boolean	Indicates if the alert should be ignored.
GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_version	Number	Version of the monitoring source generating the alert.

Command example

!gti-dtm-alert-get alert_id=dummy_alert_001

Context Example

{
    "GoogleThreatIntelligenceDTMAlerts": {
        "Alerts": {
            "aggregated_under_id": "dummy_alert_001",
            "ai_doc_summary": "This advertisement details a sophisticated phishing-as-a-service platform verified email spoofing capabilities",
            "alert_summary": "Angel Mailer the best possible solution for all your mailing needs Our main features 1 1 Verified Mails with Checkmark on Google",
            "alert_type": "Message",
            "confidence": 0.5404703550433493,
            "confidence_reasoning": {
                "benign_count": 0,
                "malicious_count": 0,
                "response_count": 0,
                "version": ""
            },
            "created_at": "2025-08-19T09:29:31.827Z",
            "doc": {
                "__id": "dummy",
                "__type": "message",
                "body": "Welcome to Angel Mailer, the best possible solution for all your mailing needs. \n\nOur main features:\n\n💎 1:1 Verified Mails with Checkmark on googl/AOL\n\n A lot of templates with a choice of spoof.",
                "channel": {
                    "channel_id": "dummy",
                    "channel_info": {
                        "description": "chasingchicken"
                    },
                    "channel_url": "DUMMY",
                    "invite_url": "DUMMY",
                    "messenger": {
                        "id": "google",
                        "name": "Google"
                    },
                    "name": "dummy"
                },
                "ingested": "2025-08-19T08:43:20Z",
                "message_id": "dummy",
                "messenger": {
                    "id": "google",
                    "name": "Google"
                },
                "parts": [
                    {
                        "content_type": "video/mp4",
                        "filename": "angelmailerready.mp4"
                    }
                ],
                "sender": {
                    "identity": {
                        "first_name": "dummy_xyz",
                        "name": "dummy_xyz"
                    },
                    "google": {
                        "user_id": 157338048
                    }
                },
                "source": "Google",
                "timestamp": "2025-08-19T08:43:16Z"
            },
            "doc_matches": [
                {
                    "locations": [
                        {
                            "offsets": [
                                395,
                                399
                            ],
                            "value": "full"
                        }
                    ],
                    "match_path": "body"
                }
            ],
            "doc_url": "https://www.virustotal.com/v4/dtm/docs/message/dummy",
            "email_sent_at": "",
            "has_analysis": false,
            "id": "dummy_alert_001",
            "ignore": false,
            "indicator_mscore": 92,
            "labels": [
                {
                    "classifier": "classifier-content",
                    "confidence": 100,
                    "element_path": "body",
                    "id": "dummy",
                    "label": "prose",
                    "version": "2-0-0"
                },
                {
                    "classifier": "classifier-language",
                    "confidence": 76,
                    "element_path": "body",
                    "id": "dummy",
                    "label": "en",
                    "version": "1-0-0"
                },
                {
                    "classifier": "classifier-threat",
                    "confidence": 100,
                    "id": "dummy",
                    "label": "information-security/anonymization",
                    "version": "3-0-0"
                }
            ],
            "labels_url": "https://www.virustotal.com/v4/dtm/docs/message/dummy/labels",
            "monitor_id": "dummy_monitor_id_000",
            "monitor_version": 1,
            "severity": "medium",
            "severity_reasoning": {
                "rule": ""
            },
            "similarity_score": 0.9554455,
            "status": "new",
            "tags": [
                "attempt"
            ],
            "title": "Found topic \"google\" posted by actor \"test \" on channel \"chasinchicken1\"",
            "topic_matches": [
                {
                    "offsets": [
                        0,
                        6
                    ],
                    "term": "google",
                    "topic_id": "dummy",
                    "value": "Google"
                },
                {
                    "topic_id": "doc_type:message",
                    "value": "message"
                }
            ],
            "topics": [
                {
                    "confidence": 81,
                    "entity_locations": [
                        {
                            "element_path": "body",
                            "offsets": [
                                666,
                                674
                            ]
                        }
                    ],
                    "extractor": "analysis-pipeline.nerprocessor-nerenglish-gpu",
                    "extractor_version": "4-0-2",
                    "id": "dummy",
                    "type": "product",
                    "value": "Google"
                },
                {
                    "confidence": 100,
                    "entity_locations": [
                        {
                            "element_path": "body",
                            "offsets": [
                                262,
                                267,
                                1183,
                                1188
                            ]
                        }
                    ],
                    "extractor": "dummy_extractor",
                    "extractor_version": "4-0-2",
                    "id": "dummy",
                    "type": "organization",
                    "value": "Google"
                }
            ],
            "topics_url": "https://www.virustotal.com/v4/dtm/docs/message/dummy/topics",
            "updated_at": "2025-08-19T10:13:25.352Z"
        }
    }
}

Human Readable Output

DTM Alert

Alert ID Title Alert Summary Alert Type Severity Status Monitor ID Indicator Score Created At Updated At Tags

dummy_alert_001 Found topic “google” posted by actor “test” on channel “chasinchicken1” This advertisement details a sophisticated phishing-as-a-service platform verified email spoofing capabilities. Message Medium New dummy_monitor_id_000 92 2025-08-19T09:29:31.827Z 2025-08-19T10:13:25.352Z attempt

Alert ID	Title	Alert Summary	Alert Type	Severity	Status	Monitor ID	Indicator Score	Created At	Updated At	Tags
dummy_alert_001	Found topic “google” posted by actor “test” on channel “chasinchicken1”	This advertisement details a sophisticated phishing-as-a-service platform verified email spoofing capabilities.	Message	Medium	New	dummy_monitor_id_000	92	2025-08-19T09:29:31.827Z	2025-08-19T10:13:25.352Z	attempt

gti-dtm-alert-status-update

Update the status of DTM alert.

Base Command

gti-dtm-alert-status-update

Input

Argument Name	Description	Required
alert_id	Specify ID of the alert. Note: Use gti-dtm-alert-list to retrive the Alert ID.	Required
status	Specify status of the alert. Possible values are: new, read, in_progress, escalated, closed, no_action_required, duplicate, not_relevant, tracked_external.	Required

Context Output

Path	Type	Description
GoogleThreatIntelligenceDTMAlerts.Alerts.id	String	Unique identifier for the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_id	String	Identifier of the monitoring source that generated the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__id	String	Unique document ID associated with the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__type	String	Type of document associated with the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.body	String	Full content or message body of the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_id	String	ID of the channel where the alert was observed.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_info.description	String	Description of the channel where the alert was detected.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_url	String	URL of the detected channel.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.invite_url	String	Invite link of the detected channel, if available.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.id	String	Identifier of the messenger platform linked to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.name	String	Name of the messenger platform.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.name	String	Name of the channel where the content was found.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.ingested	Date	Date and time when the document was ingested into the system.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.message_id	String	Identifier of the specific message triggering the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.id	String	Messenger platform ID associated with the message.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.name	String	Name of the messenger platform associated with the message.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.hashes.sha256	String	SHA-256 hash of the sender’s avatar file.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.mime_type	String	MIME type of the sender’s avatar file.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.first_name	String	First name of the sender.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.last_name	String	Last name of the sender.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.name	String	Full name of the sender.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.name	String	Telegram username of the sender.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.user_id	Number	Telegram user ID of the sender.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.source	String	Source of the document or content triggering the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc.timestamp	Date	Timestamp when the message or document was created.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.id	String	Unique identifier of the label assigned to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.classifier	String	Classifier name used for label assignment.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.version	String	Version of the classifier or labeling process.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.label	String	Name of the label assigned to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.confidence	Number	Confidence score of the assigned label.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels.element_path	String	Path of the element where the label was applied.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.id	String	Unique identifier of the extracted topic.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.type	String	Type of the extracted topic.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.value	String	Value of the extracted topic.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor	String	Name of the topic extraction tool.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor_version	String	Version of the topic extractor used.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.element_path	String	Path of the element where the entity was detected.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.offsets	Number	Character offsets of the detected entity in the document.
GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.topic_id	String	Identifier of the matched topic.
GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.value	String	Matched value for the topic.
GoogleThreatIntelligenceDTMAlerts.Alerts.label_matches	List	List of labels matched for the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.match_path	String	Path within the document where a match occurred.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.offsets	Number	Offset positions of the document match.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.value	String	Value of the matched document content.
GoogleThreatIntelligenceDTMAlerts.Alerts.tags	List	Tags associated with the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.created_at	Date	Date and time when the alert was created.
GoogleThreatIntelligenceDTMAlerts.Alerts.updated_at	Date	Date and time when the alert was last updated.
GoogleThreatIntelligenceDTMAlerts.Alerts.labels_url	String	URL to fetch labels associated with the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.topics_url	String	URL to fetch topics associated with the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.doc_url	String	URL of the original document related to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.status	String	Current status of the alert (e.g., open, closed, triaged).
GoogleThreatIntelligenceDTMAlerts.Alerts.alert_type	String	Type or category of the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.alert_summary	String	Summary of the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.title	String	Title of the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.email_sent_at	String	Timestamp when the alert email was sent.
GoogleThreatIntelligenceDTMAlerts.Alerts.indicator_mscore	Number	Malicious score of the indicator related to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.severity	String	Severity level of the alert (e.g., low, medium, high).
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence	Number	Confidence score of the alert detection.
GoogleThreatIntelligenceDTMAlerts.Alerts.aggregated_under_id	String	ID under which the alert has been aggregated.
GoogleThreatIntelligenceDTMAlerts.Alerts.has_analysis	Boolean	Indicates whether the alert has an associated analysis.
GoogleThreatIntelligenceDTMAlerts.Alerts.ai_doc_summary	String	AI-generated summary of the document related to the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.similarity_score	Number	Similarity score between this alert and related alerts.
GoogleThreatIntelligenceDTMAlerts.Alerts.severity_reasoning.rule	String	Rule used to determine the severity of the alert.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.version	String	Version of the confidence reasoning model.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.response_count	Number	Number of responses contributing to confidence reasoning.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.malicious_count	Number	Number of malicious detections contributing to confidence.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.benign_count	Number	Number of benign detections contributing to confidence.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.confidence_count	Number	Total number of samples considered for confidence calculation.
GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.explanation	String	Explanation behind the confidence score.
GoogleThreatIntelligenceDTMAlerts.Alerts.ignore	Boolean	Indicates if the alert should be ignored.
GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_version	Number	Version of the monitoring source generating the alert.

Command example

!gti-dtm-alert-status-update alert_id=dummyalertid_001 status=duplicate

Context Example

{
    "GoogleThreatIntelligenceDTMAlerts": {
        "Alerts": {
            "aggregated_under_id": "dummy_monitor_id_001",
            "ai_doc_summary": "This advertisement for \"Angel Mailer\" highlights its capabilities for sending spoofed emails.",
            "alert_summary": "Angel Mailer the best possible solution for all your mailing needs Our main features…",
            "alert_type": "Message",
            "confidence": 0.5404703550433493,
            "confidence_reasoning": {
                "benign_count": 0,
                "malicious_count": 0,
                "response_count": 0,
                "version": ""
            },
            "created_at": "2025-08-27T19:05:38.521Z",
            "doc_matches": [
                {
                    "locations": [
                        {
                            "value": "full"
                        }
                    ],
                    "match_path": "body"
                }
            ],
            "doc_url": "https://www.virustotal.com/v4/dtm/docs/message/dummyid",
            "email_sent_at": "",
            "has_analysis": false,
            "id": "dummy_alert_id_001",
            "ignore": false,
            "indicator_mscore": 92,
            "labels_url": "https:///www.virustotal.com/v4/dtm/docs/message/dummyid/labels",
            "monitor_id": "dummy_monitor_id",
            "monitor_version": 1,
            "severity": "medium",
            "severity_reasoning": {
                "rule": ""
            },
            "similarity_score": 0.9554455,
            "status": "duplicate",
            "title": "Found topic \"google\" posted by actor \"test\" on Telegram channel \"chasinchicken1\"",
            "topic_matches": [
                {
                    "offsets": [
                        0,
                        6
                    ],
                    "term": "google",
                    "topic_id": "000101000010",
                    "value": "Google"
                },
                {
                    "topic_id": "doc_type:message",
                    "value": "message"
                }
            ],
            "topics_url": "https:///www.virustotal.com/topics",
            "updated_at": "2025-08-28T06:25:10.535Z"
        }
    }
}

Human Readable Output

Alert Status Updated Successfully

Alert ID Status

dummy_alert_id_001 Duplicate

Alert ID	Status
dummy_alert_id_001	Duplicate

Configuration parameters

credentials — (required)
isFetch — Fetch incidents
max_fetch — Max Fetch
first_fetch — First Fetch Time
mirror_direction — Mirroring Direction
alert_type — Alert Type
alert_monitor_ids — Alert Monitor ID
alert_status — Alert Status
alert_severity — Alert Severity
alert_tags — Alert Tags
alert_match_value — Alert Match Value
alert_mscore_gte — Alert mscore
alert_search — Alert Search
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval

Commands (3)

gti-dtm-alert-get
Get a particular DTM Alert by ID.
gti-dtm-alert-list
Search the DTM Alerts with provided filter arguments.
gti-dtm-alert-status-update
Update the status of DTM alert.

Source

GoogleThreatIntelligenceDTMAlerts.py GoogleThreatIntelligenceDTMAlerts_test.py GoogleThreatIntelligenceDTMAlerts.yml GoogleThreatIntelligenceDTMAlerts_description.md command_examples.txt

Download History Raw

commonfields:
  id: GoogleThreatIntelligenceDTMAlerts
  version: -1
name: GoogleThreatIntelligenceDTMAlerts
display: Google Threat Intelligence - DTM Alerts
fromversion: 6.10.0
category: Data Enrichment & Threat Intelligence
provider: Google
defaultmapperin: Google Threat Intelligence DTM Alerts - Incoming Mapper
sectionorder:
- Connect
- Collect
description: This integration allows the creation of incidents based on DTM Alerts from Google Threat Intelligence.
configuration:
- displaypassword: API Key
  name: credentials
  type: 9
  required: true
  hiddenusername: true
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Max Fetch
  name: max_fetch
  defaultvalue: '25'
  type: 0
  required: false
  additionalinfo: Maximum number of Alerts to fetch each time. Maximum value is 100.
  section: Collect
- display: First Fetch Time
  name: first_fetch
  defaultvalue: '1 days'
  type: 0
  required: false
  additionalinfo: "The date or relative timestamp from which to begin fetching Alerts.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2025, 01 May 2025 04:45:33, 2025-05-17T14:05:44Z."
  section: Collect
- display: Mirroring Direction
  hidden:
  - marketplacev2
  - platform
  name: mirror_direction
  type: 15
  options:
  - Outgoing
  required: false
  additionalinfo: The mirroring direction in which to mirror the details. You can mirror "Outgoing" (from XSOAR to GTI) direction for DTM Alerts. Cortex XSOAR only parameter.
  section: Collect
- display: Alert Type
  name: alert_type
  type: 16
  options:
  - Compromised Credentials
  - Domain Discovery
  - Forum Post
  - Message
  - Paste
  - Shop Listing
  - Tweet
  - Web Content
  required: false
  section: Collect
  additionalinfo: Fetch Alerts by the specified alert types.
- display: Alert Monitor ID
  name: alert_monitor_ids
  type: 16
  required: false
  section: Collect
  additionalinfo: Fetch Alerts by the specified monitor IDs.
- display: Alert Status
  name: alert_status
  type: 16
  required: false
  section: Collect
  additionalinfo: Fetch Alerts by the specified status.
  options:
  - New
  - Read
  - Escalated
  - In Progress
  - Closed
  - No Action Required
  - Duplicate
  - Not Relevant
  - Tracked External
- display: Alert Severity
  name: alert_severity
  type: 16
  required: false
  section: Collect
  additionalinfo: Fetch Alerts by the specified severity.
  options:
  - Low
  - Medium
  - High
- display: Alert Tags
  name: alert_tags
  type: 16
  required: false
  section: Collect
  additionalinfo: Fetch Alerts by the specified tags.
- display: Alert Match Value
  name: alert_match_value
  type: 16
  required: false
  section: Collect
  additionalinfo: Fetch Alerts by specified match value.
- display: Alert mscore
  name: alert_mscore_gte
  type: 0
  required: false
  section: Collect
  additionalinfo: "Fetch Alerts with mscore greater than or equal to the given value.\n\nNote: Valid range is 0 to 100."
- display: Alert Search
  name: alert_search
  type: 0
  required: false
  section: Collect
  additionalinfo: Search Alerts and triggering documents using a Lucene query with text values joined by AND/OR.
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Incident type
  name: incidentType
  type: 13
  defaultvalue: Google Threat Intelligence DTM Alert
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
script:
  script: ''
  type: python
  subtype: python3
  commands:
  - name: gti-dtm-alert-list
    description: Search the DTM Alerts with provided filter arguments.
    arguments:
    - name: start_time
      required: false
      description: "Start time of the time range to list alerts.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2025, 01 Mar 2025 04:45:33, 2025-04-17T14:05:44Z."
    - name: end_time
      required: false
      description: "End time of the time range to list alerts.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2025, 01 Mar 2025 04:45:33, 2025-04-17T14:05:44Z."
    - auto: PREDEFINED
      name: order
      required: false
      description: Filter alerts by the provided sort order.
      defaultValue: 'Desc'
      predefined:
      - Asc
      - Desc
    - auto: PREDEFINED
      name: sort
      required: false
      description: Filter alerts by the provided sort field.
      defaultValue: 'Created At'
      predefined:
      - Created At
      - Updated At
      - Monitor ID
      - ID
    - name: page_size
      required: false
      description: Specify the desired page size for the request. Maximum value is 25.
      defaultValue: 10
    - name: monitor_id
      required: false
      description: Filter alerts by monitor IDs. Supports comma-separated values.
      isArray: true
    - auto: PREDEFINED
      name: alert_type
      required: false
      description: Filters alerts by their alert type. Supports comma-separated values.
      isArray: true
      predefined:
      - Compromised Credentials
      - Domain Discovery
      - Forum Post
      - Message
      - Paste
      - Shop Listing
      - Tweet
      - Web Content
    - name: tags
      required: false
      description: Filter alerts by tags value. Supports comma-separated values.
      isArray: true
    - auto: PREDEFINED
      name: status
      required: false
      description: Filter alerts by the provided status. Supports comma-separated values.
      isArray: true
      predefined:
      - New
      - Read
      - In Progress
      - Escalated
      - Closed
      - No Action Required
      - Duplicate
      - Not Relevant
      - Tracked External
    - auto: PREDEFINED
      name: severity
      required: false
      description: Filter alerts by severity. Supports comma-separated values.
      isArray: true
      predefined:
      - Low
      - Medium
      - High
    - name: mscore_gte
      required: false
      description: "Filter alerts with mscore greater than or equal to the given value.\n\nNote: Valid range is 0 to 100."
    - auto: PREDEFINED
      name: include_more_details
      required: false
      description: If yes, doc, labels, and topics are returned in the context data.
      defaultValue: 'Yes'
      predefined:
      - Yes
      - No
    - auto: PREDEFINED
      name: include_monitor_name
      required: false
      description: If yes, then the monitor's name that created the alert is returned in the alert response body.
      defaultValue: 'No'
      predefined:
      - Yes
      - No
    - auto: PREDEFINED
      name: has_analysis
      required: false
      description: If yes, then only alerts that have analysis are returned. An alert has analysis if it has either analysis text or analysis file attachments.
      predefined:
      - Yes
      - No
    - name: search
      required: false
      description: Filter alert and triggering document contents using a simple Lucene query string with one or more text values separated by AND or OR.
    - name: match_value
      isArray: true
      required: false
      description: Filter alerts by the given match value. Supports comma-separated values.
    outputs:
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.id
      description: Unique identifier for the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_id
      description: Identifier of the monitoring source that generated the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__id
      description: Unique document ID associated with the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__type
      description: Type of document associated with the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.body
      description: Full content or message body of the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_id
      description: ID of the channel where the alert was observed.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_info.description
      description: Description of the channel where the alert was detected.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_url
      description: URL of the detected channel.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.invite_url
      description: Invite link of the detected channel, if available.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.id
      description: Identifier of the messenger platform linked to the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.name
      description: Name of the messenger platform.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.name
      description: Name of the channel where the content was found.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.ingested
      description: Date and time when the document was ingested into the system.
      type: Date
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.message_id
      description: Identifier of the specific message triggering the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.id
      description: Messenger platform ID associated with the message.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.name
      description: Name of the messenger platform associated with the message.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.hashes.sha256
      description: SHA-256 hash of the sender's avatar file.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.mime_type
      description: MIME type of the sender's avatar file.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.first_name
      description: First name of the sender.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.last_name
      description: Last name of the sender.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.name
      description: Full name of the sender.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.name
      description: Telegram username of the sender.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.user_id
      description: Telegram user ID of the sender.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.source
      description: Source of the document or content triggering the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.timestamp
      description: Timestamp when the message or document was created.
      type: Date
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.id
      description: Unique identifier of the label assigned to the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.classifier
      description: Classifier name used for label assignment.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.version
      description: Version of the classifier or labeling process.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.label
      description: Name of the label assigned to the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.confidence
      description: Confidence score of the assigned label.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.element_path
      description: Path of the element where the label was applied.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.id
      description: Unique identifier of the extracted topic.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.type
      description: Type of the extracted topic.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.value
      description: Value of the extracted topic.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor
      description: Name of the topic extraction tool.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor_version
      description: Version of the topic extractor used.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.element_path
      description: Path of the element where the entity was detected.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.offsets
      description: Character offsets of the detected entity in the document.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.topic_id
      description: Identifier of the matched topic.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.value
      description: Matched value for the topic.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.label_matches
      description: List of labels matched for the alert.
      type: List
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.match_path
      description: Path within the document where a match occurred.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.offsets
      description: Offset positions of the document match.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.value
      description: Value of the matched document content.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.tags
      description: Tags associated with the alert.
      type: List
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.created_at
      description: Date and time when the alert was created.
      type: Date
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.updated_at
      description: Date and time when the alert was last updated.
      type: Date
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels_url
      description: URL to fetch labels associated with the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics_url
      description: URL to fetch topics associated with the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_url
      description: URL of the original document related to the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.status
      description: Current status of the alert (e.g., open, closed, triaged).
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.alert_type
      description: Type or category of the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.alert_summary
      description: Summary of the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.title
      description: Title of the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.email_sent_at
      description: Timestamp when the alert email was sent.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.indicator_mscore
      description: Malicious score of the indicator related to the alert.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.severity
      description: Severity level of the alert (e.g., low, medium, high).
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence
      description: Confidence score of the alert detection.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.aggregated_under_id
      description: ID under which the alert has been aggregated.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_name
      description: Name of the monitoring source that generated the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.analysis
      description: Analysis report or details associated with the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.has_analysis
      description: Indicates whether the alert has an associated analysis.
      type: Boolean
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.ai_doc_summary
      description: AI-generated summary of the document related to the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.similarity_score
      description: Similarity score between this alert and related alerts.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.severity_reasoning.rule
      description: Rule used to determine the severity of the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.version
      description: Version of the confidence reasoning model.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.response_count
      description: Number of responses contributing to confidence reasoning.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.malicious_count
      description: Number of malicious detections contributing to confidence.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.benign_count
      description: Number of benign detections contributing to confidence.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.confidence_count
      description: Total number of samples considered for confidence calculation.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.explanation
      description: Explanation behind the confidence score.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.ignore
      description: Indicates if the alert should be ignored.
      type: Boolean
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_version
      description: Version of the monitoring source generating the alert.
      type: Number
  - name: gti-dtm-alert-get
    description: Get a particular DTM Alert by ID.
    arguments:
    - name: alert_id
      description: "Specify ID of the alert.\n\nNote: Use gti-dtm-alert-list to retrive the Alert ID."
      required: true
    - auto: PREDEFINED
      name: include_more_details
      required: false
      description: If yes, doc, labels, and topics are returned in the context data.
      defaultValue: 'Yes'
      predefined:
      - Yes
      - No
    - auto: PREDEFINED
      name: sanitize
      required: false
      description: If yes, any HTML content in the alert is sanitized to ensure it does not contain malicious tags.
      predefined:
      - Yes
      - No
    - name: truncate
      required: false
      description: "Specify whether to truncate document fields to the given length.\n\nNote: A Unicode ellipsis (\\x2026) is used to indicate truncation."
    outputs:
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.id
      description: Unique identifier for the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_id
      description: Identifier of the monitoring source that generated the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__id
      description: Unique document ID associated with the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__type
      description: Type of document associated with the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.body
      description: Full content or message body of the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_id
      description: ID of the channel where the alert was observed.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_info.description
      description: Description of the channel where the alert was detected.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_url
      description: URL of the detected channel.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.invite_url
      description: Invite link of the detected channel, if available.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.id
      description: Identifier of the messenger platform linked to the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.name
      description: Name of the messenger platform.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.name
      description: Name of the channel where the content was found.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.ingested
      description: Date and time when the document was ingested into the system.
      type: Date
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.message_id
      description: Identifier of the specific message triggering the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.id
      description: Messenger platform ID associated with the message.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.name
      description: Name of the messenger platform associated with the message.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.hashes.sha256
      description: SHA-256 hash of the sender's avatar file.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.mime_type
      description: MIME type of the sender's avatar file.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.first_name
      description: First name of the sender.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.last_name
      description: Last name of the sender.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.name
      description: Full name of the sender.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.name
      description: Telegram username of the sender.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.user_id
      description: Telegram user ID of the sender.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.source
      description: Source of the document or content triggering the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.timestamp
      description: Timestamp when the message or document was created.
      type: Date
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.id
      description: Unique identifier of the label assigned to the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.classifier
      description: Classifier name used for label assignment.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.version
      description: Version of the classifier or labeling process.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.label
      description: Name of the label assigned to the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.confidence
      description: Confidence score of the assigned label.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.element_path
      description: Path of the element where the label was applied.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.id
      description: Unique identifier of the extracted topic.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.type
      description: Type of the extracted topic.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.value
      description: Value of the extracted topic.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor
      description: Name of the topic extraction tool.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor_version
      description: Version of the topic extractor used.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.element_path
      description: Path of the element where the entity was detected.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.offsets
      description: Character offsets of the detected entity in the document.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.topic_id
      description: Identifier of the matched topic.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.value
      description: Matched value for the topic.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.label_matches
      description: List of labels matched for the alert.
      type: List
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.match_path
      description: Path within the document where a match occurred.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.offsets
      description: Offset positions of the document match.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.value
      description: Value of the matched document content.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.tags
      description: Tags associated with the alert.
      type: List
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.created_at
      description: Date and time when the alert was created.
      type: Date
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.updated_at
      description: Date and time when the alert was last updated.
      type: Date
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels_url
      description: URL to fetch labels associated with the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics_url
      description: URL to fetch topics associated with the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_url
      description: URL of the original document related to the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.status
      description: Current status of the alert (e.g., open, closed, triaged).
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.alert_type
      description: Type or category of the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.alert_summary
      description: Summary of the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.title
      description: Title of the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.email_sent_at
      description: Timestamp when the alert email was sent.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.indicator_mscore
      description: Malicious score of the indicator related to the alert.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.severity
      description: Severity level of the alert (e.g., low, medium, high).
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence
      description: Confidence score of the alert detection.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.aggregated_under_id
      description: ID under which the alert has been aggregated.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.has_analysis
      description: Indicates whether the alert has an associated analysis.
      type: Boolean
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.ai_doc_summary
      description: AI-generated summary of the document related to the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.similarity_score
      description: Similarity score between this alert and related alerts.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.severity_reasoning.rule
      description: Rule used to determine the severity of the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.version
      description: Version of the confidence reasoning model.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.response_count
      description: Number of responses contributing to confidence reasoning.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.malicious_count
      description: Number of malicious detections contributing to confidence.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.benign_count
      description: Number of benign detections contributing to confidence.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.confidence_count
      description: Total number of samples considered for confidence calculation.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.explanation
      description: Explanation behind the confidence score.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.ignore
      description: Indicates if the alert should be ignored.
      type: Boolean
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_version
      description: Version of the monitoring source generating the alert.
      type: Number
  - name: gti-dtm-alert-status-update
    description: Update the status of DTM alert.
    arguments:
    - name: alert_id
      description: "Specify ID of the alert.\n\nNote: Use gti-dtm-alert-list to retrive the Alert ID."
      required: true
    - auto: PREDEFINED
      name: status
      description: Specify status of the alert.
      required: true
      predefined:
      - New
      - Read
      - In Progress
      - Escalated
      - Closed
      - No Action Required
      - Duplicate
      - Not Relevant
      - Tracked External
    outputs:
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.id
      description: Unique identifier for the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_id
      description: Identifier of the monitoring source that generated the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__id
      description: Unique document ID associated with the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__type
      description: Type of document associated with the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.body
      description: Full content or message body of the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_id
      description: ID of the channel where the alert was observed.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_info.description
      description: Description of the channel where the alert was detected.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_url
      description: URL of the detected channel.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.invite_url
      description: Invite link of the detected channel, if available.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.id
      description: Identifier of the messenger platform linked to the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.name
      description: Name of the messenger platform.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.name
      description: Name of the channel where the content was found.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.ingested
      description: Date and time when the document was ingested into the system.
      type: Date
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.message_id
      description: Identifier of the specific message triggering the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.id
      description: Messenger platform ID associated with the message.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.name
      description: Name of the messenger platform associated with the message.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.hashes.sha256
      description: SHA-256 hash of the sender's avatar file.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.mime_type
      description: MIME type of the sender's avatar file.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.first_name
      description: First name of the sender.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.last_name
      description: Last name of the sender.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.name
      description: Full name of the sender.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.name
      description: Telegram username of the sender.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.user_id
      description: Telegram user ID of the sender.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.source
      description: Source of the document or content triggering the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.timestamp
      description: Timestamp when the message or document was created.
      type: Date
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.id
      description: Unique identifier of the label assigned to the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.classifier
      description: Classifier name used for label assignment.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.version
      description: Version of the classifier or labeling process.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.label
      description: Name of the label assigned to the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.confidence
      description: Confidence score of the assigned label.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.element_path
      description: Path of the element where the label was applied.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.id
      description: Unique identifier of the extracted topic.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.type
      description: Type of the extracted topic.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.value
      description: Value of the extracted topic.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor
      description: Name of the topic extraction tool.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor_version
      description: Version of the topic extractor used.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.element_path
      description: Path of the element where the entity was detected.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.offsets
      description: Character offsets of the detected entity in the document.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.topic_id
      description: Identifier of the matched topic.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.value
      description: Matched value for the topic.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.label_matches
      description: List of labels matched for the alert.
      type: List
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.match_path
      description: Path within the document where a match occurred.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.offsets
      description: Offset positions of the document match.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.value
      description: Value of the matched document content.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.tags
      description: Tags associated with the alert.
      type: List
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.created_at
      description: Date and time when the alert was created.
      type: Date
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.updated_at
      description: Date and time when the alert was last updated.
      type: Date
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels_url
      description: URL to fetch labels associated with the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics_url
      description: URL to fetch topics associated with the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_url
      description: URL of the original document related to the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.status
      description: Current status of the alert (e.g., open, closed, triaged).
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.alert_type
      description: Type or category of the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.alert_summary
      description: Summary of the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.title
      description: Title of the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.email_sent_at
      description: Timestamp when the alert email was sent.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.indicator_mscore
      description: Malicious score of the indicator related to the alert.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.severity
      description: Severity level of the alert (e.g., low, medium, high).
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence
      description: Confidence score of the alert detection.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.aggregated_under_id
      description: ID under which the alert has been aggregated.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.has_analysis
      description: Indicates whether the alert has an associated analysis.
      type: Boolean
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.ai_doc_summary
      description: AI-generated summary of the document related to the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.similarity_score
      description: Similarity score between this alert and related alerts.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.severity_reasoning.rule
      description: Rule used to determine the severity of the alert.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.version
      description: Version of the confidence reasoning model.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.response_count
      description: Number of responses contributing to confidence reasoning.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.malicious_count
      description: Number of malicious detections contributing to confidence.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.benign_count
      description: Number of benign detections contributing to confidence.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.confidence_count
      description: Total number of samples considered for confidence calculation.
      type: Number
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.explanation
      description: Explanation behind the confidence score.
      type: String
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.ignore
      description: Indicates if the alert should be ignored.
      type: Boolean
    - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_version
      description: Version of the monitoring source generating the alert.
      type: Number
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  isremotesyncout: true
tests:
- No tests (auto formatted)