GoogleThreatIntelligence

Analyzes suspicious hashes, URLs, domains, and IP addresses.

Category

Data Enrichment & Threat Intelligence

Pack

GoogleThreatIntelligence

Configuration parameters

• credentials — API Key (leave empty. Fill in the API key in the password field.) (required)
• feedReliability — Source Reliability
• gti_malicious — GTI Malicious Verdict. Check Google Threat Intelligence verdict to consider the file malicious.
• gti_suspicious — GTI Suspicious Verdict. Check Google Threat Intelligence verdict to consider the file suspicious.
• fileThreshold — File Malicious Threshold. Minimum number of positive results from VT scanners to consider the file malicious.
• fileSuspiciousThreshold — File Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the file suspicious.
• ipThreshold — IP Malicious Threshold. Minimum number of positive results from VT scanners to consider the IP malicious.
• ipSuspiciousThreshold — IP Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the IP suspicious.
• disable_private_ip_lookup — Disable reputation lookups for private IP addresses
• urlThreshold — URL Malicious Threshold. Minimum number of positive results from VT scanners to consider the URL malicious.
• urlSuspiciousThreshold — URL Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the URL suspicious.
• domainThreshold — Domain Malicious Threshold. Minimum number of positive results from VT scanners to consider the Domain malicious.
• domainSuspiciousThreshold — Domain Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the Domain suspicious.
• preferredVendors — Preferred Vendors List. CSV list of vendors who are considered more trustworthy.
• preferredVendorsThreshold — Preferred Vendor Threshold. The minimum number of highly trusted vendors required to consider a domain, IP address, URL, or file as malicious.
• crowdsourced_yara_rules_enabled — Enable score analyzing by Crowdsourced Yara Rules, Sigma, and IDS.
• yaraRulesThreshold — Crowdsourced Yara Rules Threshold
• SigmaIDSThreshold — Sigma and Intrusion Detection Rules Threshold
• domain_popularity_ranking — Domain Popularity Ranking Threshold
• ip_relationships — IP Relationships
• domain_relationships — Domain Relationships
• url_relationships — URL Relationships
• file_relationships — File Relationships
• proxy — Use system proxy settings
• insecure — Trust any certificate (not secure)

Commands (31)

• cve — Retrieves CVE information from Google Threat Intelligence.
• domain — Checks the reputation of a domain.
• file — Checks the file reputation of the specified hash.
• file-rescan — Rescans an already submitted file. This avoids having to upload the file again. Use the gti-analysis-get command to get the scan results.
• file-scan — Submits a file for scanning. Use the gti-analysis-get command to get the scan results.
• gti-analysis-get — Scan and get the analysis of a file submitted to GoogleThreatIntelligence.
• gti-assessment-get — Retrieves GTI assessment for a given resource.
• gti-comments-add — Adds comments to files and URLs.
• gti-comments-delete — Delete a comment.
• gti-comments-get — Retrieves comments for a given resource.
• gti-comments-get-by-id — Retrieves a comment by comment ID.
• gti-curated-campaigns-get — Retrieves GTI curated campaigns for a given resource.
• gti-curated-malware-families-get — Retrieves GTI curated malware families for a given resource.
• gti-curated-threat-actors-get — Retrieves GTI curated threat actors for a given resource.
• gti-file-sandbox-report — Retrieves a behavioral relationship of the given file hash.
• gti-file-scan-and-analysis-get — Scan and get the analysis of a file submitted to GoogleThreatIntelligence.
• gti-file-scan-upload-url — Get a special URL for files larger than 32 MB.
• gti-file-sigma-analysis — Result of the last Sigma analysis in markdown format.
• gti-passive-dns-data — Returns passive DNS records by indicator.
• gti-private-file-scan-and-analysis-get — Scan and get the analysis of a private file submitted to GoogleThreatIntelligence.
• gti-private-url-scan-and-analysis-get — Scan and get the analysis of a private URL submitted to GoogleThreatIntelligence.
• gti-privatescanning-analysis-get — Get analysis of a private file or URL submitted to GoogleThreatIntelligence.
• gti-privatescanning-file — Checks the file reputation of the specified private hash.
• gti-privatescanning-file-scan — Submits a file for private scanning. Use the gti-privatescanning-analysis-get command to get the scan results.
• gti-privatescanning-url — Checks the reputation of a private URL.
• gti-privatescanning-url-scan — Submits an URL for private scanning. Use the gti-privatescanning-analysis-get command to get the scan results.
• gti-search — Search for an indicator in Google Threat Intelligence.
• gti-url-scan-and-analysis-get — Scan and get the analysis of a URL submitted to GoogleThreatIntelligence.
• ip — Checks the reputation of an IP address.
• url — Checks the reputation of a URL.
• url-scan — Scans a specified URL. Use the gti-analysis-get command to get the scan results.