Google SecOps - GCTI Threat Intelligence Finding

Status: available
Severity: high
Time window: 10m
Source: github.com/Azure/Azure-Sentinel

Creates incidents in Microsoft Sentinel when Google Security Operations raises an active threat intelligence alert (GCTI_FINDING). These alerts are generated by Google's global threat intel corpus and represent high-confidence threats, distinct from customer-authored rule detections.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts `T1566` Phishing
Command & Control	`T1071` Application Layer Protocol
Exfiltration	`T1048` Exfiltration Over Alternative Protocol

Rule body

id: b3e7f921-5c4a-4d8e-a2f9-7b1d3e6c9a5f
name: Google SecOps - GCTI Threat Intelligence Finding
description: |
  Creates incidents in Microsoft Sentinel when Google Security Operations raises an active threat intelligence alert (GCTI_FINDING). These alerts are generated by Google's global threat intel corpus and represent high-confidence threats, distinct from customer-authored rule detections.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: GSDetectionAlerts
    dataTypes:
      - DetectionAlerts_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Execution
  - CommandAndControl
  - Exfiltration
relevantTechniques:
  - T1078
  - T1566
  - T1071
  - T1048
query: |
  GoogleSecOpsDetectionAlerts
  | where detectionType == "GCTI_FINDING"
  | where alertState == "ALERTING"
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: varPrincipalIp
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: varTargetIp
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: varSourceIp
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: varCorrelationIp
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: urlBackToProduct
customDetails:
  RuleName: ruleName
  RuleId: ruleId
  Severity: severity
  RiskScore: riskScore
  DetectionType: detectionType
  DetectionTime: detectionTime
  Description: description
  PrincipalIP: varPrincipalIp
  TargetIP: varTargetIp
  SourceIP: varSourceIp
  CorrelationIP: varCorrelationIp
  PrincipalHostname: varPrincipalHostname
  TargetHostname: varTargetHostname
  SourceHostname: varSourceHostname
  PrincipalUser: varPrincipalUserUserid
  SourceUser: varSourceUserUserid
  TargetUser: varTargetUserUserid
  alert_identifier: id
alertDetailsOverride:
  alertDisplayNameFormat: "GCTI Finding: {{ruleName}} : {{id}}"
  alertDescriptionFormat: "Google Threat Intelligence confirmed finding. Rule: {{ruleName}}. {{description}}"
eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P1D
    matchingMethod: Selected
    groupByCustomDetails:
      - alert_identifier
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GoogleSecOpsDetectionAlerts

Stage 2: `where`

| where detectionType == "GCTI_FINDING"

Stage 3: `where`

| where alertState == "ALERTING"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`alertState`	eq	`ALERTING`	`field:"alertState" kind:eq value:"ALERTING"`
`detectionType`	eq	`GCTI_FINDING`	`field:"detectionType" kind:eq value:"GCTI_FINDING"`