User Guide
Synapse-Google-TI User Guide
Synapse-Google-TI adds new Storm commands to allow you to query the Google Threat Intelligence API using your existing API key.
Getting Started
Check with your Admin to enable permissions and find out if you need a personal API key.
Examples
Ingest reports from Google Threat Intelligence
Use the google.ti.reports command to ingest reports:
> google.ti.reports --yield --no-relationships --size 2
media:news=34660175b2a2cce1341c8b136009d1c9
.created = 2026/07/24 21:17:36.101
:body = # Alleged Dataset Leak of Canva Exposes 900,000 User Records With Bcrypt Passwords, OAuth Providers, and Design Platform...
:ext:id = report--572f3f55b6b25809bfc0102db354271f0e14bc9c70af7bc292d50a9d70129c7e
:published = 2026/04/01 00:30:59.000
:publisher = 4883d4ab923bb018ba7b8328961af94c
:publisher:name = google
:summary = A threat actor known as xorcat has posted an alleged Canva dataset containing 900,000 user records as a free download on...
:title = alleged dataset leak of canva exposes 900,000 user records with bcrypt passwords, oauth providers, and design platform usage data
:topics = []
:type = google.osint_article
:url = https://www.virustotal.com/gui/collection/report--572f3f55b6b25809bfc0102db354271f0e14bc9c70af7bc292d50a9d70129c7e
:url:fqdn = www.virustotal.com
#rep.google.origin.crowdsourced
media:news=20dc03c0edfd584a044222a0476524f7
.created = 2026/07/24 21:17:36.155
:body = # Google Cloud's Vertex AI platform Vulnerability Allow Attackers to Access Sensitive Data
:ext:id = report--e93d14125cec68bef5b3effbeb711a26207bbee797a96287e97fc1901f1b046b
:published = 2026/04/01 13:06:23.000
:publisher = 4883d4ab923bb018ba7b8328961af94c
:publisher:name = google
:summary = A flaw in Google Cloud Platform Vertex AI Agent Engine lets attackers turn AI agents into data-stealing double agents.
:title = google cloud's vertex ai platform vulnerability allow attackers to access sensitive data
:topics = []
:type = google.osint_article
:url = https://www.virustotal.com/gui/collection/report--e93d14125cec68bef5b3effbeb711a26207bbee797a96287e97fc1901f1b046b
:url:fqdn = www.virustotal.com
#rep.google.origin.crowdsourced
You can also filter reports by creation or modification date:
google.ti.reports --created-after 2026-01-01 --created-before 2026-02-01
Retrieve a single report by ID
Fetch a specific report using google.ti.report.get:
> google.ti.report.get report--fa1d73031a0721eb2516e2c748799686e51f6123a75319564dad8c1973193e43 --yield --no-relationships
media:news=be788c9710faa8572a47ad5a109672ca
.created = 2026/07/24 21:17:36.230
:body = Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution | 17 SHA256 | YARA/...
:ext:id = report--fa1d73031a0721eb2516e2c748799686e51f6123a75319564dad8c1973193e43
:published = 2026/04/01 14:22:24.000
:publisher = 4883d4ab923bb018ba7b8328961af94c
:publisher:name = google
:summary = A supply chain compromise of the axios npm package involved a maintainer account hijack to deploy obfuscated droppers. These droppers installed platform-specific RATs on Windows, macOS, and Linux. The campaign utilized novel .NET injection techniques and established C2 infrastructure to execute commands and exfiltrate data.
:title = axios npm supply chain compromise (2026-03-31) — full re + dynamic analysis + bluenoroff attribution | 17 sha256 | yara/sigma/suricata rules | live peinject validation on daytona
:topics = []
:type = google.osint_article
:updated = 2026/04/01 14:22:32.000
:url = https://www.virustotal.com/gui/collection/report--fa1d73031a0721eb2516e2c748799686e51f6123a75319564dad8c1973193e43
:url:fqdn = www.virustotal.com
#rep.google.origin.crowdsourced
You can also enrich an existing media:news node by piping it through the command:
> media:news:ext:id=report--fa1d73031a0721eb2516e2c748799686e51f6123a75319564dad8c1973193e43 | google.ti.report.get --yield --no-relationships
media:news=be788c9710faa8572a47ad5a109672ca
.created = 2026/07/24 21:17:36.230
:body = Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution | 17 SHA256 | YARA/...
:ext:id = report--fa1d73031a0721eb2516e2c748799686e51f6123a75319564dad8c1973193e43
:published = 2026/04/01 14:22:24.000
:publisher = 4883d4ab923bb018ba7b8328961af94c
:publisher:name = google
:summary = A supply chain compromise of the axios npm package involved a maintainer account hijack to deploy obfuscated droppers. These droppers installed platform-specific RATs on Windows, macOS, and Linux. The campaign utilized novel .NET injection techniques and established C2 infrastructure to execute commands and exfiltrate data.
:title = axios npm supply chain compromise (2026-03-31) — full re + dynamic analysis + bluenoroff attribution | 17 sha256 | yara/sigma/suricata rules | live peinject validation on daytona
:topics = []
:type = google.osint_article
:updated = 2026/04/01 14:22:32.000
:url = https://www.virustotal.com/gui/collection/report--fa1d73031a0721eb2516e2c748799686e51f6123a75319564dad8c1973193e43
:url:fqdn = www.virustotal.com
#rep.google.origin.crowdsourced
Use of meta:source nodes
Synapse-Google-TI uses a meta:source node and -(seen)> light
weight edges to track nodes observed from the Google Threat Intelligence API.
> meta:source=0dc34be95b64c6b519f5135be1056219
meta:source=0dc34be95b64c6b519f5135be1056219
.created = 2026/07/24 21:17:36.075
:name = google-ti api
:type = synapse.google.ti
Storm can be used to filter nodes to include/exclude nodes which have been observed by Synapse-Google-TI. The following example shows how to filter the results of a query to include only results observed by Synapse-Google-TI:
> #cool.tag.lift +{ <(seen)- meta:source=0dc34be95b64c6b519f5135be1056219 }