Google Threat Intelligence - IP Enrichment

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

This playbook will enrich IP entities.

Attribute	Value
Type	Playbook
Solution	Google Threat Intelligence
Source	View on GitHub

Logic App Connectors

This playbook uses 3 Logic App connectors / built-in actions:

Connector / Action	Type	Connections	Actions
`azuresentinel`	Managed	1	1
`googlethreatintelligence`	Managed	0	1
`GoogleThreatIntelligence-CustomConnector`	Custom	1	0

Action parameters (URLs, paths, function IDs)

`azuresentinel` (Managed)

Action	Method	Endpoint	Other
Add_comment_to_incident_(V3)	post	`/Incidents/Comment`	—

`googlethreatintelligence` (Managed)

Action	Method	Endpoint	Other
Get_IP_Report	get	`/ip_addresses/@{encodeURIComponent(triggerBody()?['Entity']?['properties']?['Address'])}`	—

Additional Documentation

📄 Source: GTIEnrichment/GTI-EnrichEntity/GTI-EnrichIP/readme.md

Summary

This playbook is triggered from an IP entity in Microsoft Sentinel. It calls the Google Threat Intelligence custom connector to retrieve the IP address report, including reputation, last analysis stats, geolocation, ownership, community votes, and the GTI Assessment (threat score, verdict, and severity). If the entity is associated with an incident, the playbook formats this data and adds it as a comment on the incident, giving the analyst enrichment context without leaving Microsoft Sentinel.

Prerequisites

Deploy the Google Threat Intelligence Custom Connector (GTICustomConnector) and configure its API connection with your Google Threat Intelligence API key before deploying this playbook.
Ensure you have a Log Analytics Workspace configured for Microsoft Sentinel.

Deployment Instructions

To deploy the Playbook, click the Deploy to Azure button. This will launch the ARM Template deployment wizard.
Fill in the required parameters:
- PlaybookName: Enter the playbook name here (default: GTI-IOCEnrichmentIP).
- ConnectorName: Name of the deployed Google Threat Intelligence custom connector (default: GoogleThreatIntelligence-CustomConnector).

Post-Deployment Instructions

a. Authorize connections

Once deployment is complete, authorize each connection.

Go to your logic app → API connections → Select Microsoft Sentinel connection resource.
Go to General → edit API connection.
Click Authorize.
Sign in.
Click Save.
Repeat steps for the Google Threat Intelligence (googlethreatintelligence) connection.

b. Attach to IP Entity

This playbook is triggered from an IP entity (/entity/IP), not run on a schedule.

On an incident in Microsoft Sentinel, select the IP entity you want to enrich.
Right-click the entity (or open the entity pane) and choose Run playbook.
Select GTI-IOCEnrichmentIP (or the PlaybookName you deployed with) and run it.
If the entity is linked to an incident, the playbook adds a "GTI IP Report" comment with the reputation, analysis stats, geolocation, ownership, votes, and GTI Assessment (score, verdict, severity) to that incident.