Elastic Security now offers native integration with Google Threat Intelligence (GTI), allowing security teams to ingest known malicious indicators and leverage AI-driven workflows for real-time alert enrichment and investigation. This integration aims to streamline the process from initial setup to live threat detection within minutes.
The GTI integration brings curated threat intelligence directly into Elastic Security, providing actionable data for both detection and investigation. GTI combines Google's global security insights with VirusTotal data to offer context on indicators of compromise (IOCs) related to malware, ransomware, phishing, and other adversarial activities. Each indicator is furnished with a verdict (Malicious, Suspicious, or Undetected), a severity level, and a composite threat score ranging from 0 to 100. This score, derived from multiple signals, enables security teams to prioritize indicators based on confidence.
Setting up the integration is designed to be straightforward, requiring only a GTI API key. Once configured, ingestion begins automatically at a scheduled interval, without the need for additional infrastructure. The integration pulls data from two primary streams: the Threat List IOC Stream, intended for high-confidence detection and precision-critical alerting, and the Purpose IOC Stream, which offers broader coverage for threat hunting and early visibility into emerging threats.
As data is ingested, indicators are standardized using the Elastic Common Schema (ECS). This process includes GTI's contextual information, such as verdicts, severity, threat scores, malware families, and threat actor associations. This standardization allows GTI data to be searched and correlated seamlessly with other ECS-compliant intelligence sources, custom intelligence, and existing security telemetry within Elastic Security. Elastic also manages the lifecycle of these indicators, including their expiration and revocation, to prevent matches against outdated information.
With GTI data integrated, Elastic Security's indicator match rules can detect the presence of known malicious IP addresses, domains, URLs, or file hashes within security telemetry. This continuous correlation of intelligence against observed activity surfaces matches for investigation. Security teams can tune these detections based on the confidence provided by GTI's structured fields, allowing high-confidence indicators to trigger immediate escalations while lower-confidence ones can be routed for review.
For threat hunting, GTI metadata enables analysts to pivot from a single IOC to associated infrastructure and search historical telemetry. By enriching indicators with details like threat actor associations and malware family context, analysts can move beyond simple IOC searches and investigate entire campaigns or adversary activities. This capability allows for the identification of any past interactions between known malicious infrastructure and the organization's environment.
The integration also includes prebuilt dashboards that offer visibility into threat intelligence activity and the detections driven by GTI. These dashboards summarize observed threats across various categories, such as malware families, campaigns, and threat actors, helping Security Operations Center (SOC) teams understand prevalent threat types and how intelligence is being operationalized. GTI offers 14 categorized feed categories, including those for cryptominers, ransomware, phishing, and vulnerability exploitation, allowing organizations to tailor their coverage based on their subscription level and specific needs.
Complementing the ingestion of GTI data, Elastic Security supports AI-driven investigation through Agent Builder and Elastic Workflows. These features enable real-time enrichment and reasoning during an investigation, particularly for ambiguous or emerging indicators not yet present in indexed feeds. During alert triage, a workflow can query external services like VirusTotal for live context on IPs, domains, or file hashes, correlate this information with Elastic telemetry, and present a structured summary for analysts. Agent Builder further extends this by allowing teams to create reusable, task-specific capabilities for alert triage, enrichment, and case handling, enabling multi-step investigative tasks to be executed consistently. This dual approach of continuous detection via ingested intelligence and on-demand enrichment via agentic workflows aims to help teams detect known threats at scale and provide crucial context for investigations, enabling faster, more confident decision-making.
