{
  "Name": "Google Threat Intelligence",
  "Author": "Google",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/GoogleThreatIntelligence.svg\" width=\"75px\" height=\"75px\">",
  "Description": "This Google Threat Intelligence Solution contains Playbooks that can help enrich incident information with threat information and intelligence for IPs, file hashes and URLs from Google Threat Intelligence. Enriched information can help drive focused investigations in Security Operations.<br><br><b>Important — Custom Connector prerequisite:</b> The Playbooks in this solution depend on the <b>Google Threat Intelligence custom Logic Apps connector</b>, which is <b>not deployed automatically</b> when you install the solution from Content Hub. Before running any of the Playbooks, you must manually deploy the custom connector into the same resource group and region as the Playbooks, using the Deploy to Azure button in the connector's <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Google%20Threat%20Intelligence/Playbooks/CustomConnector/GTICustomConnector\">readme</a>. Without it, the Playbooks will fail to authenticate to the Google Threat Intelligence API.",
  "Data Connectors": [
    "Data Connectors/GTIRelevanceSystemAlerts/GTIRelevanceSystemAlerts_API_FunctionApp.json",
    "Data Connectors/GTIVulnerabilities_ccf/GTIVulnerabilities_ConnectorDefinition.json"
  ],
  "Parsers": [
    "Parsers/GTIRelevanceSystemAlerts.yaml",
    "Parsers/GTIVulnerabilities.yaml"
  ],
  "Hunting Queries": [
    "Hunting Queries/ThreatHuntHash.yaml",
    "Hunting Queries/ThreatHuntIp.yaml",
    "Hunting Queries/ThreatHuntDomain.yaml",
    "Hunting Queries/ThreatHuntUrl.yaml"
  ],
  "Analytic Rules": [
    "Analytic Rules/ThreatHunting/ThreatHuntHash.yaml",
    "Analytic Rules/ThreatHunting/ThreatHuntIp.yaml",
    "Analytic Rules/ThreatHunting/ThreatHuntDomain.yaml",
    "Analytic Rules/ThreatHunting/ThreatHuntUrl.yaml",
    "Analytic Rules/RelevanceSystemAlerts/GTI_DataLeakAlerts.yaml",
    "Analytic Rules/RelevanceSystemAlerts/GTI_HighCriticalPriorityAlerts.yaml",
    "Analytic Rules/RelevanceSystemAlerts/GTI_HighRelevanceAlerts.yaml",
    "Analytic Rules/RelevanceSystemAlerts/GTI_InitialAccessBrokerAlerts.yaml",
    "Analytic Rules/RelevanceSystemAlerts/GTI_InsiderThreatAlerts.yaml",
    "Analytic Rules/RelevanceSystemAlerts/GTI_RelevanceSystemAlerts_IncidentByAlertId.yaml",
    "Analytic Rules/Vulnerabilities/GTI_ActivelyExploitedVulnerability.yaml",
    "Analytic Rules/Vulnerabilities/GTI_CISAKnownExploitedVulnerability.yaml",
    "Analytic Rules/Vulnerabilities/GTI_CriticalCVSSVulnerability.yaml",
    "Analytic Rules/Vulnerabilities/GTI_ZeroDayVulnerability.yaml"
  ],
  "Workbooks": [
    "Workbooks/GoogleThreatIntelligence.json"
  ],
  "Playbooks": [
    "Playbooks/CustomConnector/GTICustomConnector/azuredeploy.json",
    "Playbooks/CustomConnector/GTIFileUpload_FunctionAppConnector/azuredeploy.json",
    "Playbooks/GTIEnrichment/GTI-EnrichIncident/azuredeploy.json",
    "Playbooks/GTIEnrichment/GTI-EnrichAlert/azuredeploy.json",
    "Playbooks/GTIEnrichment/GTI-EnrichEntity/GTI-EnrichIP/azuredeploy.json",
    "Playbooks/GTIEnrichment/GTI-EnrichEntity/GTI-EnrichURL/azuredeploy.json",
    "Playbooks/GTIEnrichment/GTI-EnrichEntity/GTI-EnrichFilehash/azuredeploy.json",
    "Playbooks/GTIEnrichment/GTI-EnrichEntity/GTI-EnrichDomain/azuredeploy.json",
    "Playbooks/GTIThreatList/azuredeploy.json",
    "Playbooks/GTIIocStream/azuredeploy.json",
    "Playbooks/GTIAddCommentToIncident/azuredeploy.json",
    "Playbooks/GTIFileScanBlobEnrichment/azuredeploy.json",
    "Playbooks/GTIFileScanEnrichment/azuredeploy.json",
    "Playbooks/GTIURLScanEnrichment/azuredeploy.json",
    "Playbooks/GTIURLScanEntityEnrichment/azuredeploy.json",
    "Playbooks/GTIURLScanIncidentEnrichment/azuredeploy.json",
    "Playbooks/GTIVulnerabilityEnrichment/azuredeploy.json"
  ],
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Google Threat Intelligence",
  "Version": "3.3.0",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true,
  "StaticDataConnectorIds": []
}