Using OpenCTI to operationalize Google Threat Intelligence

Google Threat Intelligence gives security teams one of the most comprehensive views of the threat landscape available today: Google's visibility into global internet traffic, Mandiant's frontline incident response expertise, and VirusTotal's crowdsourced malware intelligence, covering everything from nation-state actors to emerging malware campaigns.

Filigran’s OpenCTI connector for Google Threat Intelligence serves as an operational layer that helps to further unlock the value of Google Threat Intelligence, turning data into action.

Using Google Threat Intelligence for proactive defense

Google Threat Intelligence delivers deep, high-confidence insight into adversaries, from nation-state actors to emerging malware campaigns. Few organizations can bring together this scale of visibility and depth of expertise, which is why it's become a go-to resource for security teams looking to stay ahead of adversaries.

Filigran can enhance Google Threat Intelligence in three key ways:

• Surface intelligence: Correlate threat intelligence with internal environment sightings and surface inside existing workflows.
• Distill intelligence: Turn deep, narrative-rich reporting into clear, actionable insights.
• Deploy intelligence: Automatically push that insight into your security stack fast enough to actually stop or prevent an attack.

OpenCTI can help analysts fully understand, prioritize, and operationalize intelligence across every layer of your defense stack.

OpenCTI as an operational layer of Google Threat Intelligence

Filigran built an OpenCTI connector that automatically ingests Google Threat Intelligence data types such as reports, threat actors, malware, campaigns, vulnerabilities, and IOCs into OpenCTI. OpenCTI then converts this data into fully structured, interlinked STIX 2.1 objects, making it immediately actionable within the platform.

OpenCTI enhances Google Threat Intelligence in three ways:

1. OpenCTI zeroes in on the signals that matter

•  Threat scoring to highlight the most urgent threats: High-confidence scoring and origin metadata from Google Threat Intelligence plug directly into OpenCTI's filtering and correlation engine. This lets teams home in on the intelligence that matches their own environment, surfacing the most relevant findings instead of an overwhelming stream of global data.
• Sharpens focus on what matters to your organization: OpenCTI further reduces noise by letting organizations define Priority Intelligence Requirements (PIRs), which automatically elevate threats relevant to a customer's environment. The result: analysts can quickly take action on what truly matters.

• Compares intelligence to internal environment sightings: OpenCTI ingests data from an organization's own security tools (such as SIEMs, EDRs, and firewalls) and correlates it against Google Threat Intelligence in real time. This lets teams quickly see whether a given threat, indicator, or actor has actually surfaced in their environment, raising the threat's priority.

2. OpenCTI enriches Google Threat Intelligence insights

• Enrich with other sources: OpenCTI allows you to add intelligence from other sources such as open-source and commercial feeds, enrichment sources, industry sharing groups (e.g., ISACs and CERTs), and OSINT. All intelligence is then correlated, and relationships between actors, infrastructure, and TTPs (tactics, techniques, and procedures) are inferred and shown in a visual graph to provide the complete story behind threats.

•  Automation at scale: Operationalizing intelligence at scale requires automation. OpenCTI includes no-code playbooks that can handle repetitive, time-consuming tasks (such as enriching indicators, triggering workflows, and keeping your knowledge base current), so your analysts can start making decisions faster.

3. OpenCTI puts Google Threat Intelligence into action

• Integrates into your security stack: Intelligence only delivers value when teams can act on it. OpenCTI integrates with the tools in your existing security stack, such as SIEMs, EDRs, SOARs, and firewalls, pushing enriched, contextualized indicators directly to the tools that act on them. This means Google's threat research doesn't stop at a dashboard. It directly shapes detections and defenses across the security stack, including Google Security Operations.
• Streamlines workflows: When contextual, enriched intelligence flows directly into the tools analysts already use, there's no need to manually pivot between platforms to piece together the full picture on a threat. OpenCTI pushes intelligence from Google Threat Intelligence into the security stack already correlated, prioritized, and contextualized, so analysts see the relevant history, related entities, and internal sightings the moment a threat appears, right where they're already working.
• Enables safe intelligence sharing: OpenCTI shares Google Threat Intelligence data types such as reports, threat actors, and IOCs as interlinked STIX 2.1 objects via Live Streams and TAXII collections, feeding them to other instances, partners, or connected tools in real time. TLP markings and access controls keep shared intelligence limited to the appropriate audience.

OpenCTI integration with Google Threat Intelligence: a complete intelligence pipeline

The OpenCTI integration with Google Threat Intelligence delivers a complete pipeline from intelligence to real-world defense:

• Google Threat Intelligence provides best-in-class breadth and authority, the depth of visibility and expertise that only Google's global scale, Mandiant's frontline experience, and VirusTotal's community intelligence can deliver.
• OpenCTI helps ensure that intelligence can be fully understood, prioritized, and operationalized across every layer of the defense stack.

This integration gives security teams not just more data, but more decision-ready intelligence, delivered fast enough to matter.

How to integrate OpenCTI with Google Threat Intelligence

Integrating OpenCTI with Google Threat Intelligence is straightforward:

1. Deploy the OpenCTI Google Threat Intelligence connector by following the instructions on this page. For Enterprise Edition users, connector deployment is automatic after clicking Deploy in OpenCTI.

2. Enter your Google Threat Intelligence API credentials, and define the scope of data to ingest (such as threat actors, malware, campaigns, vulnerabilities, and IOCs).
3. Once connected, the integration runs automatically, pulling intelligence from Google Threat Intelligence into OpenCTI on a continuous basis and converting it into structured, interlinked STIX 2.1 objects.
4. Analysts can now apply OpenCTI's filtering, correlation, and Priority Intelligence Requirements to tailor the feed to their environment, then push validated, prioritized intelligence out to their SIEM, SOAR, EDR, or Google Security Operations platform via Live Streams, TAXII feeds, or playbook automation.

Learn more about the OpenCTI and Google Threat Intelligence integration

The 2025 Forrester State of Threat Intelligence Report makes it clear: operationalization is no longer a nice-to-have. It's the benchmark security leaders are measured against.

Want to see how OpenCTI can help your team operationalize Google Threat Intelligence? Reach out to the Filigran team to learn more or start your free trial today.