Google Threat Intelligence module.
The Google Threat Intelligence (GTI) module does three things: it collects GTI reports of the types you choose, it enriches entity profiles on new Threat Cards, and it enriches the IOCs that come in with your Events. To use it you need a paid Google subscription and your VirusTotal API key. This page covers where to find the key and how to configure the module without overwhelming your tenant.
You need a paid Google Threat Intelligence subscription. The module reads your key from VirusTotal, which is part of the same Google offering.
What the GTI module does
- Report collection. It imports GTI reports as Events. You choose which report types to receive.
- Entity profile enrichment. When you create a Threat Card for an actor, Liberty91 reaches out to GTI, finds their profile for that entity, and uses it in the enrichment and associations.
- IOC enrichment. For every Event, if an IOC matches something GTI associates with a malware family or threat actor, the platform surfaces that association and offers to create a follow-up Threat Card.
How to connect Google Threat Intelligence
Connecting the module takes two steps: copy your key from VirusTotal, then configure the module in Liberty91.
Step 1: Copy your API key from VirusTotal
- Go to virustotal.com and log in.
- Click your username in the top right and select API key from the drop-down.
- Click the copy icon next to your key. The key stays blurred unless you click the eye icon, but you do not need to reveal it to copy it.
Step 2: Configure the module in Liberty91
- Go to Modules and open the Google Threat Intelligence module under Collection modules.
- Paste the API key you copied from VirusTotal into the key field.
- Select the report types you want to include.
- Choose the source types you want to include.
- Click Update. When it works, "Google Threat Intelligence Module is active" appears under the page title.
Leave OSINT Articles and Patch Reports unchecked. Both carry enormous volume and will quickly clog and dominate your dashboards. For the same reason, do not ingest GTI's open-source reporting through the source types: it is already covered by other modules and will overwhelm your tenant.
The module consumes about 96 API calls per day, roughly 2976 per month, one every 15 minutes. New reports start ingesting immediately. If you also want to import the results of your VirusTotal LiveHunts, you can turn that on in the VirusTotal module.