IOC Curated Enrichment - Google Threat Intelligence

This playbook provides IOC curated enrichment using Google Threat Intelligence data, including malware families, campaigns, and threat actors, and displays the results in the War Room for investigation.

GoogleThreatIntelligence · 11 tasks · 2 inputs · 0 outputs

Inputs

  • resource — The file hash (MD5, SHA1, or SHA256), Domain, URL or IP.
  • resource_type — The type of the resource (IP, domain, URL, or file hash).

Commands used

gti-curated-campaigns-get gti-curated-malware-families-get gti-curated-threat-actors-get

Flowchart

Start Start Get GTI curated campaigns - gti-curated-campaigns-get Get GTI curated campaigns gti-curated-campaigns-get Get GTI curated malware families - gti-curated-malware-families-get Get GTI curated malware f... gti-curated-malware-families-get Get GTI curated threat actors - gti-curated-threat-actors-get Get GTI curated threat ac... gti-curated-threat-actors-get War room Entry for Curated Threat Intelligence data - Print War room Entry for Curate... Print Curated Threat Intelligence Enrichment Curated Threat Intelligen... Done Done Clear Previous Inputs - DeleteContext Clear Previous Inputs DeleteContext Extract Curated Campaigns names - SetAndHandleEmpty Extract Curated Campaigns... SetAndHandleEmpty Extract Malware Families names - SetAndHandleEmpty Extract Malware Families ... SetAndHandleEmpty Extract Threat Actors names - SetAndHandleEmpty Extract Threat Actors names SetAndHandleEmpty