commonfields: id: GoogleThreatIntelligenceDTMAlerts version: -1 name: GoogleThreatIntelligenceDTMAlerts display: Google Threat Intelligence - DTM Alerts fromversion: 6.10.0 category: Data Enrichment & Threat Intelligence provider: Google defaultmapperin: Google Threat Intelligence DTM Alerts - Incoming Mapper sectionorder: - Connect - Collect description: This integration allows the creation of incidents based on DTM Alerts from Google Threat Intelligence. configuration: - displaypassword: API Key name: credentials type: 9 required: true hiddenusername: true section: Connect - display: Fetch incidents name: isFetch type: 8 required: false section: Collect - display: Max Fetch name: max_fetch defaultvalue: '25' type: 0 required: false additionalinfo: Maximum number of Alerts to fetch each time. Maximum value is 100. section: Collect - display: First Fetch Time name: first_fetch defaultvalue: '1 days' type: 0 required: false additionalinfo: "The date or relative timestamp from which to begin fetching Alerts.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2025, 01 May 2025 04:45:33, 2025-05-17T14:05:44Z." section: Collect - display: Mirroring Direction hidden: - marketplacev2 - platform name: mirror_direction type: 15 options: - Outgoing required: false additionalinfo: The mirroring direction in which to mirror the details. You can mirror "Outgoing" (from XSOAR to GTI) direction for DTM Alerts. Cortex XSOAR only parameter. section: Collect - display: Alert Type name: alert_type type: 16 options: - Compromised Credentials - Domain Discovery - Forum Post - Message - Paste - Shop Listing - Tweet - Web Content required: false section: Collect additionalinfo: Fetch Alerts by the specified alert types. - display: Alert Monitor ID name: alert_monitor_ids type: 16 required: false section: Collect additionalinfo: Fetch Alerts by the specified monitor IDs. - display: Alert Status name: alert_status type: 16 required: false section: Collect additionalinfo: Fetch Alerts by the specified status. options: - New - Read - Escalated - In Progress - Closed - No Action Required - Duplicate - Not Relevant - Tracked External - display: Alert Severity name: alert_severity type: 16 required: false section: Collect additionalinfo: Fetch Alerts by the specified severity. options: - Low - Medium - High - display: Alert Tags name: alert_tags type: 16 required: false section: Collect additionalinfo: Fetch Alerts by the specified tags. - display: Alert Match Value name: alert_match_value type: 16 required: false section: Collect additionalinfo: Fetch Alerts by specified match value. - display: Alert mscore name: alert_mscore_gte type: 0 required: false section: Collect additionalinfo: "Fetch Alerts with mscore greater than or equal to the given value.\n\nNote: Valid range is 0 to 100." - display: Alert Search name: alert_search type: 0 required: false section: Collect additionalinfo: Search Alerts and triggering documents using a Lucene query with text values joined by AND/OR. - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Incident type name: incidentType type: 13 defaultvalue: Google Threat Intelligence DTM Alert section: Collect - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true script: script: '' type: python subtype: python3 commands: - name: gti-dtm-alert-list description: Search the DTM Alerts with provided filter arguments. arguments: - name: start_time required: false description: "Start time of the time range to list alerts.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2025, 01 Mar 2025 04:45:33, 2025-04-17T14:05:44Z." - name: end_time required: false description: "End time of the time range to list alerts.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2025, 01 Mar 2025 04:45:33, 2025-04-17T14:05:44Z." - auto: PREDEFINED name: order required: false description: Filter alerts by the provided sort order. defaultValue: 'Desc' predefined: - Asc - Desc - auto: PREDEFINED name: sort required: false description: Filter alerts by the provided sort field. defaultValue: 'Created At' predefined: - Created At - Updated At - Monitor ID - ID - name: page_size required: false description: Specify the desired page size for the request. Maximum value is 25. defaultValue: 10 - name: monitor_id required: false description: Filter alerts by monitor IDs. Supports comma-separated values. isArray: true - auto: PREDEFINED name: alert_type required: false description: Filters alerts by their alert type. Supports comma-separated values. isArray: true predefined: - Compromised Credentials - Domain Discovery - Forum Post - Message - Paste - Shop Listing - Tweet - Web Content - name: tags required: false description: Filter alerts by tags value. Supports comma-separated values. isArray: true - auto: PREDEFINED name: status required: false description: Filter alerts by the provided status. Supports comma-separated values. isArray: true predefined: - New - Read - In Progress - Escalated - Closed - No Action Required - Duplicate - Not Relevant - Tracked External - auto: PREDEFINED name: severity required: false description: Filter alerts by severity. Supports comma-separated values. isArray: true predefined: - Low - Medium - High - name: mscore_gte required: false description: "Filter alerts with mscore greater than or equal to the given value.\n\nNote: Valid range is 0 to 100." - auto: PREDEFINED name: include_more_details required: false description: If yes, doc, labels, and topics are returned in the context data. defaultValue: 'Yes' predefined: - Yes - No - auto: PREDEFINED name: include_monitor_name required: false description: If yes, then the monitor's name that created the alert is returned in the alert response body. defaultValue: 'No' predefined: - Yes - No - auto: PREDEFINED name: has_analysis required: false description: If yes, then only alerts that have analysis are returned. An alert has analysis if it has either analysis text or analysis file attachments. predefined: - Yes - No - name: search required: false description: Filter alert and triggering document contents using a simple Lucene query string with one or more text values separated by AND or OR. - name: match_value isArray: true required: false description: Filter alerts by the given match value. Supports comma-separated values. outputs: - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.id description: Unique identifier for the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_id description: Identifier of the monitoring source that generated the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__id description: Unique document ID associated with the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__type description: Type of document associated with the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.body description: Full content or message body of the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_id description: ID of the channel where the alert was observed. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_info.description description: Description of the channel where the alert was detected. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_url description: URL of the detected channel. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.invite_url description: Invite link of the detected channel, if available. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.id description: Identifier of the messenger platform linked to the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.name description: Name of the messenger platform. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.name description: Name of the channel where the content was found. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.ingested description: Date and time when the document was ingested into the system. type: Date - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.message_id description: Identifier of the specific message triggering the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.id description: Messenger platform ID associated with the message. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.name description: Name of the messenger platform associated with the message. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.hashes.sha256 description: SHA-256 hash of the sender's avatar file. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.mime_type description: MIME type of the sender's avatar file. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.first_name description: First name of the sender. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.last_name description: Last name of the sender. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.name description: Full name of the sender. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.name description: Telegram username of the sender. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.user_id description: Telegram user ID of the sender. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.source description: Source of the document or content triggering the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.timestamp description: Timestamp when the message or document was created. type: Date - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.id description: Unique identifier of the label assigned to the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.classifier description: Classifier name used for label assignment. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.version description: Version of the classifier or labeling process. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.label description: Name of the label assigned to the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.confidence description: Confidence score of the assigned label. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.element_path description: Path of the element where the label was applied. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.id description: Unique identifier of the extracted topic. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.type description: Type of the extracted topic. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.value description: Value of the extracted topic. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor description: Name of the topic extraction tool. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor_version description: Version of the topic extractor used. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.element_path description: Path of the element where the entity was detected. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.offsets description: Character offsets of the detected entity in the document. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.topic_id description: Identifier of the matched topic. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.value description: Matched value for the topic. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.label_matches description: List of labels matched for the alert. type: List - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.match_path description: Path within the document where a match occurred. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.offsets description: Offset positions of the document match. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.value description: Value of the matched document content. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.tags description: Tags associated with the alert. type: List - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.created_at description: Date and time when the alert was created. type: Date - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.updated_at description: Date and time when the alert was last updated. type: Date - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels_url description: URL to fetch labels associated with the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics_url description: URL to fetch topics associated with the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_url description: URL of the original document related to the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.status description: Current status of the alert (e.g., open, closed, triaged). type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.alert_type description: Type or category of the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.alert_summary description: Summary of the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.title description: Title of the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.email_sent_at description: Timestamp when the alert email was sent. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.indicator_mscore description: Malicious score of the indicator related to the alert. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.severity description: Severity level of the alert (e.g., low, medium, high). type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence description: Confidence score of the alert detection. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.aggregated_under_id description: ID under which the alert has been aggregated. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_name description: Name of the monitoring source that generated the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.analysis description: Analysis report or details associated with the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.has_analysis description: Indicates whether the alert has an associated analysis. type: Boolean - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.ai_doc_summary description: AI-generated summary of the document related to the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.similarity_score description: Similarity score between this alert and related alerts. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.severity_reasoning.rule description: Rule used to determine the severity of the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.version description: Version of the confidence reasoning model. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.response_count description: Number of responses contributing to confidence reasoning. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.malicious_count description: Number of malicious detections contributing to confidence. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.benign_count description: Number of benign detections contributing to confidence. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.confidence_count description: Total number of samples considered for confidence calculation. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.explanation description: Explanation behind the confidence score. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.ignore description: Indicates if the alert should be ignored. type: Boolean - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_version description: Version of the monitoring source generating the alert. type: Number - name: gti-dtm-alert-get description: Get a particular DTM Alert by ID. arguments: - name: alert_id description: "Specify ID of the alert.\n\nNote: Use gti-dtm-alert-list to retrive the Alert ID." required: true - auto: PREDEFINED name: include_more_details required: false description: If yes, doc, labels, and topics are returned in the context data. defaultValue: 'Yes' predefined: - Yes - No - auto: PREDEFINED name: sanitize required: false description: If yes, any HTML content in the alert is sanitized to ensure it does not contain malicious tags. predefined: - Yes - No - name: truncate required: false description: "Specify whether to truncate document fields to the given length.\n\nNote: A Unicode ellipsis (\\x2026) is used to indicate truncation." outputs: - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.id description: Unique identifier for the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_id description: Identifier of the monitoring source that generated the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__id description: Unique document ID associated with the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__type description: Type of document associated with the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.body description: Full content or message body of the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_id description: ID of the channel where the alert was observed. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_info.description description: Description of the channel where the alert was detected. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_url description: URL of the detected channel. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.invite_url description: Invite link of the detected channel, if available. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.id description: Identifier of the messenger platform linked to the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.name description: Name of the messenger platform. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.name description: Name of the channel where the content was found. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.ingested description: Date and time when the document was ingested into the system. type: Date - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.message_id description: Identifier of the specific message triggering the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.id description: Messenger platform ID associated with the message. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.name description: Name of the messenger platform associated with the message. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.hashes.sha256 description: SHA-256 hash of the sender's avatar file. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.mime_type description: MIME type of the sender's avatar file. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.first_name description: First name of the sender. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.last_name description: Last name of the sender. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.name description: Full name of the sender. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.name description: Telegram username of the sender. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.user_id description: Telegram user ID of the sender. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.source description: Source of the document or content triggering the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.timestamp description: Timestamp when the message or document was created. type: Date - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.id description: Unique identifier of the label assigned to the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.classifier description: Classifier name used for label assignment. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.version description: Version of the classifier or labeling process. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.label description: Name of the label assigned to the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.confidence description: Confidence score of the assigned label. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.element_path description: Path of the element where the label was applied. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.id description: Unique identifier of the extracted topic. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.type description: Type of the extracted topic. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.value description: Value of the extracted topic. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor description: Name of the topic extraction tool. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor_version description: Version of the topic extractor used. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.element_path description: Path of the element where the entity was detected. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.offsets description: Character offsets of the detected entity in the document. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.topic_id description: Identifier of the matched topic. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.value description: Matched value for the topic. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.label_matches description: List of labels matched for the alert. type: List - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.match_path description: Path within the document where a match occurred. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.offsets description: Offset positions of the document match. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.value description: Value of the matched document content. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.tags description: Tags associated with the alert. type: List - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.created_at description: Date and time when the alert was created. type: Date - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.updated_at description: Date and time when the alert was last updated. type: Date - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels_url description: URL to fetch labels associated with the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics_url description: URL to fetch topics associated with the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_url description: URL of the original document related to the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.status description: Current status of the alert (e.g., open, closed, triaged). type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.alert_type description: Type or category of the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.alert_summary description: Summary of the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.title description: Title of the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.email_sent_at description: Timestamp when the alert email was sent. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.indicator_mscore description: Malicious score of the indicator related to the alert. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.severity description: Severity level of the alert (e.g., low, medium, high). type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence description: Confidence score of the alert detection. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.aggregated_under_id description: ID under which the alert has been aggregated. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.has_analysis description: Indicates whether the alert has an associated analysis. type: Boolean - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.ai_doc_summary description: AI-generated summary of the document related to the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.similarity_score description: Similarity score between this alert and related alerts. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.severity_reasoning.rule description: Rule used to determine the severity of the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.version description: Version of the confidence reasoning model. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.response_count description: Number of responses contributing to confidence reasoning. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.malicious_count description: Number of malicious detections contributing to confidence. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.benign_count description: Number of benign detections contributing to confidence. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.confidence_count description: Total number of samples considered for confidence calculation. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.explanation description: Explanation behind the confidence score. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.ignore description: Indicates if the alert should be ignored. type: Boolean - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_version description: Version of the monitoring source generating the alert. type: Number - name: gti-dtm-alert-status-update description: Update the status of DTM alert. arguments: - name: alert_id description: "Specify ID of the alert.\n\nNote: Use gti-dtm-alert-list to retrive the Alert ID." required: true - auto: PREDEFINED name: status description: Specify status of the alert. required: true predefined: - New - Read - In Progress - Escalated - Closed - No Action Required - Duplicate - Not Relevant - Tracked External outputs: - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.id description: Unique identifier for the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_id description: Identifier of the monitoring source that generated the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__id description: Unique document ID associated with the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.__type description: Type of document associated with the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.body description: Full content or message body of the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_id description: ID of the channel where the alert was observed. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_info.description description: Description of the channel where the alert was detected. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.channel_url description: URL of the detected channel. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.invite_url description: Invite link of the detected channel, if available. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.id description: Identifier of the messenger platform linked to the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.messenger.name description: Name of the messenger platform. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.channel.name description: Name of the channel where the content was found. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.ingested description: Date and time when the document was ingested into the system. type: Date - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.message_id description: Identifier of the specific message triggering the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.id description: Messenger platform ID associated with the message. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.messenger.name description: Name of the messenger platform associated with the message. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.hashes.sha256 description: SHA-256 hash of the sender's avatar file. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.avatar_file.mime_type description: MIME type of the sender's avatar file. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.first_name description: First name of the sender. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.last_name description: Last name of the sender. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.identity.name description: Full name of the sender. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.name description: Telegram username of the sender. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.sender.telegram.user_id description: Telegram user ID of the sender. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.source description: Source of the document or content triggering the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc.timestamp description: Timestamp when the message or document was created. type: Date - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.id description: Unique identifier of the label assigned to the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.classifier description: Classifier name used for label assignment. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.version description: Version of the classifier or labeling process. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.label description: Name of the label assigned to the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.confidence description: Confidence score of the assigned label. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels.element_path description: Path of the element where the label was applied. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.id description: Unique identifier of the extracted topic. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.type description: Type of the extracted topic. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.value description: Value of the extracted topic. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor description: Name of the topic extraction tool. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.extractor_version description: Version of the topic extractor used. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.element_path description: Path of the element where the entity was detected. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics.entity_locations.offsets description: Character offsets of the detected entity in the document. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.topic_id description: Identifier of the matched topic. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topic_matches.value description: Matched value for the topic. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.label_matches description: List of labels matched for the alert. type: List - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.match_path description: Path within the document where a match occurred. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.offsets description: Offset positions of the document match. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_matches.locations.value description: Value of the matched document content. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.tags description: Tags associated with the alert. type: List - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.created_at description: Date and time when the alert was created. type: Date - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.updated_at description: Date and time when the alert was last updated. type: Date - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.labels_url description: URL to fetch labels associated with the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.topics_url description: URL to fetch topics associated with the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.doc_url description: URL of the original document related to the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.status description: Current status of the alert (e.g., open, closed, triaged). type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.alert_type description: Type or category of the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.alert_summary description: Summary of the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.title description: Title of the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.email_sent_at description: Timestamp when the alert email was sent. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.indicator_mscore description: Malicious score of the indicator related to the alert. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.severity description: Severity level of the alert (e.g., low, medium, high). type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence description: Confidence score of the alert detection. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.aggregated_under_id description: ID under which the alert has been aggregated. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.has_analysis description: Indicates whether the alert has an associated analysis. type: Boolean - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.ai_doc_summary description: AI-generated summary of the document related to the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.similarity_score description: Similarity score between this alert and related alerts. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.severity_reasoning.rule description: Rule used to determine the severity of the alert. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.version description: Version of the confidence reasoning model. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.response_count description: Number of responses contributing to confidence reasoning. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.malicious_count description: Number of malicious detections contributing to confidence. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.benign_count description: Number of benign detections contributing to confidence. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.confidence_count description: Total number of samples considered for confidence calculation. type: Number - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.confidence_reasoning.explanation description: Explanation behind the confidence score. type: String - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.ignore description: Indicates if the alert should be ignored. type: Boolean - contextPath: GoogleThreatIntelligenceDTMAlerts.Alerts.monitor_version description: Version of the monitoring source generating the alert. type: Number dockerimage: demisto/python3:3.12.13.10116658 isfetch: true isremotesyncout: true tests: - No tests (auto formatted)