gti
Note: The gti operator uses the Google Threat Intelligence API key associated with the Google Threat Intelligence enrichment configured for your ThreatStream organization.
Use the gti operator to enrich observables with comprehensive threat intelligence using the ThreatStream Google Threat Intelligence enrichment, including detailed threat scores, verdict counts, community insights, and related indicators.
Syntax
| gti <observable>
<observable>
|
The field name containing the observable, enclosed in double quotes. Supported observable types include:
|
Usage
You can use the gti operator to enrich your observables with the latest Google Threat Intelligence verdicts and metadata, and then drive downstream detection, investigation, and response actions. The operator is particularly useful when you need:
Consolidated GTI threat scoring
Use the threat_score and the per-engine verdict counts (malicious, suspicious, harmless, undetected) to quickly determine how strongly Google Threat Intelligence classifies an indicator as malicious. This is useful when you want a single numeric score along with its evidence to feed into correlation rules or risk models.
Community scoring and analyst insight
Use community_malicious and community_harmless to understand how the Google analysts and the broader security community view the IOC.
Using indicators for deeper investigation
Use associated_ioc and other_hashes to expand your investigation from a single IOC to related observables:
Recency checks
Use last_analysis to understand when Google Threat Intelligence last analyzed the IOC.
Examples
Example 1: Enrich a file hash (SHA-256) with Google Threat Intelligence data.
| gti "f46890b4f94821b9c52f3c49e34591203f2ced37339713aaec5b9d65c2b8f3d"Example 2: Enrich an IP address field from your data source with Google Threat Intelligence data.
| where scrip != null | fields + srcip | gti srcipExample 3: Enrich a domain with Google Threat Intelligence data.
| gti "malicious-domain.com"