Google Threat Intelligence

Hi all,I created a flow in GTI that sends the results of a prompt to several team members via email each day. The issue is that recipients are unable to view the prompt when they click the GTI link included in the email.I've already verified everyone's permissions and haven't found any issues there. Has anyone else encountered this problem or found a solution?

SUMMARY The address 23.227.38.74 is present in the Google Threat Intelligence curated list`iplist-known-malicious-ips`. IP: 23.227.38.74PTR: shops.myshopify.comWhois: Shopify, Inc. — NetName SHOPIFY-NET, CIDR 23.227.32.0/19 This is core Shopify storefront / webhook infrastructure — the address that Shopifystores resolve to — not a compromised host. Because Google's own recommended predefined firewall rules for network firewallpolicies include an egress deny rule with`destThreatIntelligences = iplist-known-malicious-ips`, any customer who follows thatrecommendation silently loses all outbound connectivity to Shopify. There is nowarning, no changelog and no alert: traffic simply starts being dropped. OBSERVED BEHAVIOUR Egress to 23.227.38.74:443 denied by the predefined threat-intelligence egress rule. In one project, denies ran continuously for about five days before we noticed: First DENY: 2026-08-19T21:34:45ZLast DENY: 2026-08-24T22:38:44ZTotal: 11,998 denied connections Date (UTC) De

Visitors to pvamarkets.com are seeing a Cloudflare “Suspected Malware” warning.We checked the server files, database, logs, scheduled tasks, and download system but found no malware or unauthorized files. The site does not distribute executable software.I am trying to confirm whether Google Safe Browsing or another Google security service has flagged the domain. What is the correct way to check the status and request a review if this is a false positive? 

 Agentic now leverages VirusTotal's sandboxed browser execution to analyze suspicious URLs dynamically.Capabilities:Runtime Telemetry: Captures dynamic DOM modifications, network requests, and global JavaScript variables. Campaign Mapping: Fingerprints phishing kits (e.g. pivoting on __jwrAuth variables) to map related threat infrastructure.URLs that are not in the public corpus of Google Threat Intelligence are analyzed privately using Private Scanning.Example Prompt: "Investigate hxxps://t-mobile.zyhqxp.top/pay/ and find other URLs from the same campaign using its JS footprint. Then create a campaign collection."View this conversation in Agentic → What This Means for YouAs security analysts, we've all been trapped in the endless game of "whack-a-mole": you block one malicious URL, and the threat actor spins up three more before you can even close the ticket. Historically, dissecting these evasive campaigns required spinning up local sandbox environments, manually parsing raw code, an

Target Technology Watchlists are now in Public Preview for GTI customers. This capability allows you to easily track relevant intelligence based on your specific technology stack, driving focus to the threats that truly matter most.Key Benefits:Flexible Inputs: Simply drop a list of technologies or CPEs into your threat scenario to immediately get vulnerability intelligence alerts through the alert section in the org profile. Customizable Alerts:Receive notifications specifically for CVEs affecting the organization's tech stack. Rich Vulnerability Details: Every alert is enriched with full exploit context, including assigned priority, vulnerability Risk Rating, real-world Exploitation State, and more. Intelligence Context: Leverage direct integration with GTI vulnerability intelligence for full exploit context. Unified View & API Access: Access a unified alerts stream, fully available via API for programmatic and agentic workflows.For more information, please refer to the documenta

Hi Everybody! I’m developing a prompt that can help intelligence analysts and security professionals with assessing the malicousness of a URL or a Domain.  I was inspired after working with one of my clients who asked me:“What workflow would you follow or things would you look at to determine if a domain was malicious?”After some back and forth using Gemini, I’ve settled on this current version of the prompt which uses a placeholder variable inside of Google Threat Intelligence to take the URL/Domain as an Input, follow a consistent analysis process, and set a consisten output generation template. Please feel free to use this prompt, or comment below on any recommended changes or things it should include.   ### **System Objective & Role**You are an expert **Tier 2 Threat Intelligence Analyst**. Your objective is to conduct a comprehensive, highly accurate investigation on a suspicious domain or URL using *exclusively* Google Threat Intelligence (GTI) capabilities and context.### **

Hi dear community, we're an MSSP evaluating the Digital Threat Monitoring (DTM) module in Google Threat Intelligence as the digital-risk / threat-monitoring capability we offer to our customers. As part of the evaluation, we're benchmarking DTM against Intelligence X (intelx.io), which we currently use for this purpose, and we've run into some results we'd like to sanity-check with the community — and ideally with someone from the GTI/DTM team. ObservationAcross the topics, brands, and companies we research, DTM returns substantially fewer results than we expected — and consistently fewer than Intelligence X for comparable queries. The gap is large enough that we want to confirm whether this reflects how DTM is designed, or whether we're operating the tool incorrectly. Our questions1. Scope / design of the corpus Is DTM intended primarily as a curated, entity- and relevance-driven monitoring capability (optimized to reduce noise) rather than an exhaustive surface/deep/dark-web index li

In the May 25 release notes for Google Threat Intelligence, we introduced the concept of private knowledge collections, which allow you to create your own private instances of GTI objects like Malware, Campaigns, Threat Actors, and more.Creating these private objects allows GTI teams to blend localized threat intelligence with Google’s global dataset rather than waiting for vendor attribution. Some of the common use cases you might be interested in include creating a private collection based on the contents of a security blog or a PDF document that you are analyzing.   An excellent way to implement this workflow is by leveraging the GTI MCP server in combination with “skills” to guide agents through the process of generating private collections based on these external resources.In this post you’ll find two agent skills:  One for creating a private collection based on PDFs and another for creating a private collection based on a security blog.  You can introduce these skills into your e

Hi, want to report annoying behavior of share.google in hope somebody from Google devs team can hook up and fix this security gap.Right now links to https://share[.]google/EnyBDZiv3ksnQT9xZ would lead to https://www.google.com/share[.]google?q=EnyBDZiv3ksnQT9xZ via 301 redirect by both HEAD & GET, but from that point https://www.google.com/share[.]google?q=EnyBDZiv3ksnQT9xZ - would reply with 302 redirect only on GET, and not HEAD, which is violation of RFC 9110 Section 9.3.2 and breaks automated systems from safely verifying destination link, which in case with share.google in 99% cases now used as obscurity platform to spread phishing, fraud, malware and other not good things.

I’m looking to set up a process that allows me to monitor a list of vendors and whether they show up in breaches - i.e.search a vendor name, website or email in GTI programmatically via API and see if theyre ivolved in breaches. Is that possible via GTI? What coverage for sources does GTI have if thats possible?

Does GTI have the capabilities to provide information on third parties that we specify - i.e. we want to track to see if our vendors have been breached - does GTI provide any capabilities via API to query  breach info that is collated from open source feeds and any proprietary feds (e.g. the dark web)?

Hello Google Cloud Community,I am the founder of Meyra Digital Plant Health Clinic (DPHC), an initiative focused on supporting smallholder farmers with accessible, AI-powered plant health services.Our mission is to reduce dependency on chemical pesticides by providing farmers with natural, locally available solutions combined with intelligent diagnosis tools.We are currently exploring how to leverage Google Cloud to build a scalable and impactful system with the following components:Image-based plant disease detection using AI/MLAutomated advisory system for eco-friendly treatment recommendationsMobile-first delivery (Telegram bot / lightweight apps) for rural accessibilityScalable backend infrastructure for future expansionI would greatly appreciate guidance from the community on:The most suitable Google Cloud services for building and scaling this solution (e.g., Vertex AI, Firebase, Cloud Run)Best approaches for training or integrating plant disease detection modelsDesigning cost-ef

My production project is down and suspended for 48h now with no prior notice and no reply for my appeal request. Not sure what to do.  We are facing a huge loss. I have audited all my code for any security leak and it is clean. Not sure what happened.

I have a SOAR playbook for investigating emails. As part of the playbook, domain and URL case entities are checked against static lists to see if they are:1 - Free Share Link sites2- Domains for free email services (e.g. gmail.com)3 - URL shorteners4 - A obviously benign entity, belonging to a trusted organisation such as bank e.g. jpmorganchase.comDoes GI check and report back whether submitted domain or URL IOCs belong to any of these categories, if the submission is done via API?

Hello everyone,I hope this is the right place to ask. We (Argos Security) have a question regarding GTI and the API-Usage. Right now our Company is on the plan "Integration Advanced" which gives us certain API-Allowance. Now, what we would like to do, which is impossible according to our Google-Contact, is to change our plan and Daily caps. I can not believe that, even with throwing in more money, it is supposed to be impossible to change our daily caps. Some products we do not need at all (Diff and Private Graph for example) while others we need a way higher cap (ASM for example). Could please someone give me a hint on who to contact to get this sorted out, if possible? 

Hi Everyone!In support of my upcoming webinar later this week, I wanted to post the Custom Prompt I developed which I use to help convert Advanced IOC Searches into YARA-X Queries used in Livehunting inside of Google Threat Intelligence.  Feel free to use this query and save it as part of your prompts library so you can consistently use this to help you convert IOC Searches and their modifiers into Livehunts. Role: Act as a Senior Threat Intelligence and Malware Analyst and YARA-X Engineering Expert specializing in Google Threat Intelligence and LiveHunting deployments. You have deep expertise in writing highly performant, syntax-perfect rules that scale across massive data streams without causing performance degradation or high false-positive rates. You are a master of converting Advanced IOC Searches from Google Threat Intelligence into Livehunt rules using YARA-X.Action: Translate the provided Advanced IOC Search logic into a fully functional, highly optimized YARA-X rule ready for

How can I forward alerts from My Landscape Organization Profile in GTI to create JIRA tickets.

Hello all,Can GTI be used to determine whether a certain IP or domain is linked to bulletproof hosting or commercial VPN services?Alternatively, is it possible to enrich IPs or domains with any ports or services being run/open on them? Akin to what this Microsoft endpoint would do - https://learn.microsoft.com/en-us/graph/api/resources/security-hostport?view=graph-rest-1.0

Hello everyone,I’m exploring Google Threat Intelligence capabilities and I want to understand if it’s possible to set up custom rules or alerts that specifically track vulnerabilities for particular products (e.g., a certain software or hardware vendor).For example, I’d like to be notified whenever a new CVE affecting a specific product is reported, rather than monitoring general threat feeds.Is there a way to configure Google Threat Intelligence to focus on selected products? Are there any best practices or limitations I should be aware of?Thanks in advance for any guidance!

While ingesting the GTI ioc’s to secops observed a below where we are able to fetch the logs from the GTI and unable to ingest to secops.textPayload: "Error occurred while fetching and ingesting malware data. Error: SSLError(MaxRetryError("HTTPSConnectionPool(host='chronicle.asia-south1.rep.googleapis.com', port=443): Max retries exceeded with url: /v1beta/projects/ [removed by moderator] /locations/asia-south1/instances/1eae0894-b5ea-4413-85de-42aaf69dc3233/logTypes/GCP_THREATINTEL/logs:import (Caused by SSLError(SSLEOFError(8, 'EOF occurred in violation of protocol (_ssl.c:2427)')))"))"

We recently deployed an automated Health‑ISAC → Google SecOps (Chronicle) ingestion pipeline using the following components:Health‑ISAC STIX/TAXII 2.1 collections Cloud Run (Python 3.9) for TAXII polling, indicator transformation, and Chronicle ingestion Cloud Scheduler (cron: */60 * * * *) Secret Manager for Chronicle API Auth JSON + HITS_PASSWORD Terraform for provisioning (Cloud Run, Scheduler, IAM, WIF)The ingestion pipeline successfully executes every hour, Chronicle returns success response codes, and indicators are visible in the GCS export logs.IssueWhile ingestion logs/reporting confirm indicators are successfully pushed to Chronicle, indicators do not appear in the Chronicle UI:They are visible in Cloud Logging + GCS export Chronicle ingest API responds with 200 But the same indicators cannot be found in Chronicle (IOC Search, Entity Search, IOC Feed UI, or via UDM Search)

I’m looking for explanations, recommendations, or general guidance to help us achieve a more consistent and reliable experience when using the Research Tools and Monitors within Google Threat Intelligence.We regularly search for intelligence related to specific organizations using Digital Threat Monitoring Research Tools. A simplified example of a query we commonly use is below (in practice, we often include additional AND conditions to narrow the scope):domain:"company.com" OR group_brand:"Company"However, we’ve encountered several recurring issues and inconsistencies that make it challenging to reliably search for and analyze intelligence. I’ve outlined the primary concerns below.Observed Issues Inconsistent query execution The same query may time out multiple times before eventually succeeding. For example, running the same search five times may result in four timeouts followed by one successful execution. In other cases, a query will work without issue, but when rerun later (with