Applied Threat Intelligence priority overview

Supported in:

Applied Threat Intelligence (ATI) alerts in Google SecOps are IoC matches that have been contextualized by YARA-L rules using Curated Detection. The contextualization leverages Mandiant Threat Intelligence from Google SecOps context entities, which allows intelligence-driven alert prioritization. ATI priorities are available in Google SecOps Managed Content as the Applied Threat Intelligence - Curated Prioritization rule pack with Google SecOps license.

Applied Threat Intelligence prioritization features

Applied Threat Intelligence features are extracted from Mandiant Threat Intelligence. Following are the most relevant Applied Threat Intelligence priority features.

  • Mandiant IC-Score: Mandiant automated confidence score.

  • Active IR: Indicator is sourced from an active incident response engagement.

  • Prevalence: Indicator is commonly observed by Mandiant.

  • Attribution: Indicator is strongly associated with a threat tracked by Mandiant.

  • Scanner: Indicator is identified as a known internet scanner by Mandiant.

  • Commodity: Indicator is common knowledge in the security community.

  • Blocked: Indicator was not blocked by security controls.

  • Network Direction: Indicator is connecting in an inbound or outbound network traffic direction.

You can view the Applied Threat Intelligence priority feature for an alert on the IoC Matches > Event Viewer page.

Applied Threat Intelligence priority models

Applied Threat Intelligence uses features that are extracted from Mandiant Threat Intelligence and Google SecOps events to generate a priority. Features that are relevant to the priority level and indicator type are formed into logic chains that output different classes of priority. You can use the Applied Threat Intelligence priority models that focus strongly on actionable threat intelligence. These priority models help you to take action on alerts generated from these priority models.

Priority models are used in the curated detection rules within the Applied Threat Intelligence- curated prioritization rule pack. You can also create custom rules using Mandiant Threat Intelligence through Mandiant Fusion Intelligence, available with the Google SecOps license. For more information about writing Fusion feed YARA-L rules, see Applied Threat Intelligence fusion feed overview.

Active Breach priority

The Active Breach model prioritizes indicators that have been observed in Mandiant investigations associated with active or past compromises. Network indicators in this model attempt to match only outbound direction network traffic. Relevant features used by the model include: Mandiant IC-Score, Active IR, Prevalence, and Attribution. Network models also use Scanner.

High priority

The High model prioritizes indicators that weren't observed in Mandiant investigations, but were identified by Mandiant Threat Intelligence as strongly associated with threat actors or malware. Network indicators in this model attempt to match only outbound direction network traffic. Relevant features used by the model include: Mandiant IC-Score, Prevalence, Attribution and Commodity. Network models also use Scanner.

Medium priority

The Medium model prioritizes indicators that weren't observed in Mandiant investigations, but were identified by Mandiant Threat Intelligence as associated with commodity malware . Network indicators in this model match only outbound direction network traffic. Relevant features used by the model include: Mandiant IC-Score, Prevalence, Attribution, Blocked, and Commodity. Network models also use Scanner.

Inbound IP Address Authentication

The Inbound IP Address Authentication model prioritizes IP addresses authenticating to local infrastructure in an inbound network direction. The UDM authentication extension must exist in events for a match to occur. This rule set also attempts to filter out some failed authentication events, however, this is not comprehensively enforced for all product types. This rule set is not scoped to include some SSO authentication types. Relevant features used by the model include: Mandiant IC-Score, Blocked, Network Direction and Active IR.

Need more help? Get answers from Community members and Google SecOps professionals.