Package Documentation
Storm Package: synapse-google-ti
The following Commands are available from this package. This documentation is generated for version 0.1.0 of the package.
Storm Commands
This package implements the following Storm Commands.
google.ti.config.add
Add a Synapse-Google-TI configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Add a global configuration
google.ti.config.add global_config apikey1234
// Add a configuration for the current user
google.ti.config.add --scope self my_config apikey5678
Usage: google.ti.config.add [options] <name> <apikey>
Options:
--help : Display the command usage.
--ssl-noverify : Do not perform SSL/TLS verification.
--proxy <proxy> : Configure the proxy usage. (default: True)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from Google-TI. (default: rep.google)
--scope <scope> : Set the scope on the configuration. (default: global, choices: global, self, unscoped)
--no-check-apikey : Do not perform API key validation with Google Threat Intelligence.
Arguments:
<name> : A unique name for the configuration.
<apikey> : The API key string.
The command is accessible to users with one or more of the following permissions:
power-ups.google-ti.adminpower-ups.google-ti.user
google.ti.config.del
Delete a Synapse-Google-TI configuration.
Examples:
// Delete the "fooconfig" configuration
google.ti.config.del fooconfig
Usage: google.ti.config.del [options] <name>
Options:
--help : Display the command usage.
Arguments:
<name> : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.google-ti.adminpower-ups.google-ti.user
google.ti.config.list
Display the list of Synapse-Google-TI configurations you have access to.
Usage: google.ti.config.list [options]
Options:
--help : Display the command usage.
The command is accessible to users with one or more of the following permissions:
power-ups.google-ti.adminpower-ups.google-ti.user
google.ti.config.migrate
Migrate options for all Synapse-Google-TI configurations.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Migrate the tag prefix for all configurations
google.ti.config.migrate --tag-prefix my.tagpref
Usage: google.ti.config.migrate [options]
Options:
--help : Display the command usage.
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from Google-TI. (default: None)
The command is accessible to users with one or more of the following permissions:
power-ups.google-ti.admin
google.ti.config.show
Show the details of a configuration.
Examples:
// Show the in-use configuration for the current user
google.ti.config.show
// Show a configuration by name
google.ti.config.show myconfig
Usage: google.ti.config.show [options] <name>
Options:
--help : Display the command usage.
Arguments:
[name] : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.google-ti.adminpower-ups.google-ti.user
google.ti.config.update
Update the configuration of a defined Synapse-Google-TI configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Set the permission level for user "myuser" to "admin" on the "fooconfig"
// configuration
google.ti.config.update fooconfig --perm user myuser admin
// Set the permission level for the "all" role to "deny" on the
// "fooconfig" configuration
google.ti.config.update fooconfig --perm role all deny
// Do not verify the SSL certificate when connecting to "fooconfig"
google.ti.config.update fooconfig --ssl-verify (false)
// Change the name of the "fooconfig" configuration to "barconfig"
google.ti.config.update fooconfig --name barconfig
Usage: google.ti.config.update [options] <config>
Options:
--help : Display the command usage.
--apikey <apikey> : The API key string. (default: None)
--perm <perm> : Set the permission level for a user or role on this configuration.
Arguments to this option are <scope>, <name>, <level>:
<scope>: The scope for the permission, either "user" or "role".
<name>: The user/role name depending on scope.
<level>: The $lib.auth.easyperm.level, or None to remove the permission.
(default: None)
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from Google-TI. (default: None)
--name <name> : Rename the configuration. (default: None)
--no-check-apikey : Do not perform API key validation with Google Threat Intelligence.
Arguments:
<config> : The name of the configuration to modify.
The command is accessible to users with one or more of the following permissions:
power-ups.google-ti.adminpower-ups.google-ti.user
google.ti.info
Display Google Threat Intelligence user information and quota usage.
Examples:
// Display user info
google.ti.info
Endpoints:
/users/{id}/overall_quotas : Retrieve user information and quota usage.
Usage: google.ti.info [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--config <config> : Override the default config with the provided name.
The command is accessible to users with one or more of the following permissions:
power-ups.google-ti.adminpower-ups.google-ti.user
google.ti.report.get
Retrieve a single report from Google Threat Intelligence by ID.
The report ID can be provided as a positional argument or by piping in
media:news nodes that have a GTI report ID set.
By default, all supported relationships (campaigns, vulnerabilities,
threat actors, malware families, software toolkits) are recursively
ingested up to the specified recursion depth.
Examples:
// Fetch a report by ID
google.ti.report.get report--abc123
// Fetch a report from an existing node
media:news:ext:id=report--abc123 | google.ti.report.get
// Fetch without relationships
google.ti.report.get report--abc123 --no-relationships
// Exclude specific relationships
google.ti.report.get report--abc123 --exclude-relationships (threat_actors, malware_families)
// Override the default config
google.ti.report.get report--abc123 --config myconfig
Endpoints:
/collections/{id} : Retrieve a single collection object by ID.
/collections/{id}/relationships/{relationship}: Retrieve relationship descriptors for a collection.
Usage: google.ti.report.get [options] <id>
Options:
--help : Display the command usage.
--no-relationships : Do not ingest related threat objects.
--include-relationships <include_relationships>: Only ingest the specified relationship types.
--exclude-relationships <exclude_relationships>: Exclude the specified relationship types from ingestion.
--recursion-depth <recursion_depth>: Maximum depth for recursive relationship ingestion. (default: 1)
--debug : Show verbose debug output.
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
Arguments:
[id] : The GTI report ID.
Inputs:
media:news : Retrieve and enrich an existing report node.
The command is accessible to users with one or more of the following permissions:
power-ups.google-ti.adminpower-ups.google-ti.user
google.ti.reports
Ingest reports from Google Threat Intelligence.
By default, all supported relationships (campaigns, vulnerabilities,
threat actors, malware families, software toolkits) are recursively
ingested up to the specified recursion depth.
The --since-last option can be used to retrieve new results since the
last run of the command. When using --since-last, the time of the query
execution will be stored in the :latest property of an associated
meta:feed node. On the first run with --since-last, results from the
last 24 hours will be retrieved.
Examples:
// Ingest recent reports
google.ti.reports
// Ingest reports since the last run
google.ti.reports --since-last
// Ingest reports created after a specific date
google.ti.reports --created-after 2025-01-01
// Ingest reports without relationships
google.ti.reports --no-relationships
// Exclude specific relationships
google.ti.reports --exclude-relationships (threat_actors, malware_families)
// Override the default config
google.ti.reports --config myconfig
Endpoints:
/collections : Retrieve threat intelligence collections (reports, vulns, actors, etc.).
/collections/{id}/relationships/{relationship}: Retrieve relationship descriptors for a collection.
Usage: google.ti.reports [options]
Options:
--help : Display the command usage.
--no-relationships : Do not ingest related threat objects.
--include-relationships <include_relationships>: Only ingest the specified relationship types.
--exclude-relationships <exclude_relationships>: Exclude the specified relationship types from ingestion.
--recursion-depth <recursion_depth>: Maximum depth for recursive relationship ingestion. (default: 1)
--created-after <created_after>: Only ingest reports created after this date.
--created-before <created_before>: Only ingest reports created before this date.
--updated-after <updated_after>: Only ingest reports updated after this date.
--updated-before <updated_before>: Only ingest reports updated before this date.
--since-last : Retrieve results since the last run of the command. Defaults to the last 24 hours on
the first run.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
The command is accessible to users with one or more of the following permissions:
power-ups.google-ti.adminpower-ups.google-ti.user
Storm Modules
This package does not export any Storm APIs.