New Threat Intel Product

Google Threat Intelligence is a cloud-based service combining Mandiant's intelligence-based threat feeds with VirusTotal's crowdsourced data to help HMRC's Cyber Delivery operational teams identify, track, and respond to cyber threats. It provides actionable, high-context intelligence for proactive threat detection, combined with detailed, actionable insights into threat actors, tactics, techniques, and procedures (TTPs). It will support our threat team to hunt for specific threats in real-time or historically using custom Yara rules, and provide risk prioritisation using 'GTI Score' to rank threats based on potential impact so we can concentrate on critical risks impacting our estate. In addition we will strengthen our intelligence to further identify and reduce the impact from malicious activity, including phishing campaigns, brand impersonation, and malware. The product integrates with our SPLUNK SIEM and SOAR platforms to help streamline incident response.