Investigate a GCTI alert

Google Cloud Threat Intelligence (GCTI) alerts are derived from both Google's internal threat detection infrastructure and research provided by GCTI security analysts.

For Google Security Operations customers, GCTI alerts are displayed on the Alerts and IOCspage. They are located under the Sourcecolumn. Alerts that have been generated by GCTI are labeled as Curated detections.

View a GCTI Alert

To see your GCTI alerts, follow these steps:

1. From the navigation bar, click Detection > Alerts and IOCs.
2. Under the Sourcetab, GCTI alerts are labeled as Curated detections. Click Sourceto have all the Alerts with the Curated detectionstag move to the top.
3. Click the link in the Namecolumn of the alert you want to investigate.

When you click the text in the Namecolumn, a page opens with three tabs: Overview, Graphand Alert history. Graphis an interactive graph that lets you expand your search. Alert historyshows you important information about the alert.

To learn how to use Graphand Alert history, follow the steps in Investigate an Alert .

Navigate to GCTI rules dashboard

The Curated detectionsdashboard is where all the GCTI related rules are located.

To get to the Curated detectionsdashboard, follow these steps:

1. From the navigation bar, click Detection > Rules & detections.
2. There are four tabs: Rules dashboard, Rules editor, Curated detectionsand Exclusions. Click Curated detections. Curated detectionsis where all the GCTI rules and the alerts they generate are located.

Investigate GCTI rules

Above the table are two tabs: Rules setsand Dashboard.

In Rules sets, there is a table that shows all the rules and rule sets (groups of rules that are used together). In this tab, you can do the following:

• Collapse or expand different sections
• Enable or disable Alertingand Status
• Use the boxes in the left hand corner of the table to apply changes to a single rule set or to all rule sets

The Dashboardsection displays the rules separated by category.

If you click an alert in the Dashboardsection, a page opens which shows you a timeline of recent detections for that alert.

Using Precise and Broad rules

There are two types of rules in Rules sets: Preciseand Broad. You can enable or disable Preciseor Broadrules separately depending on the type of search you are doing.

• Preciserules are rules that find malicious behavior with a higher degree of confidence with fewer false positives due to the more specific nature of the rule.
• Broadrules find behavior that could potentially be malicious or anomalous. Since these rules are more general than the Preciseones, there is a higher chance for false positives.

Need more help? Get answers from Community members and Google SecOps professionals.