Google Threat Intelligence - URL Enrichment

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

This playbook will enrich URL entities.

Attribute	Value
Type	Playbook
Solution	Google Threat Intelligence
Source	View on GitHub

Logic App Connectors

This playbook uses 3 Logic App connectors / built-in actions:

Connector / Action	Type	Connections	Actions
`azuresentinel`	Managed	1	1
`googlethreatintelligence`	Managed	0	1
`GoogleThreatIntelligence-CustomConnector`	Custom	1	0

Action parameters (URLs, paths, function IDs)

`azuresentinel` (Managed)

Action	Method	Endpoint	Other
Add_comment_to_incident_(V3)	post	`/Incidents/Comment`	—

`googlethreatintelligence` (Managed)

Action	Method	Endpoint	Other
Get_URL_Report	get	`/urls/@{encodeURIComponent(replace(base64(triggerBody()?['Entity']?['properties']?['Url']),'=',''))}`	—

Additional Documentation

📄 Source: GTIEnrichment/GTI-EnrichEntity/GTI-EnrichURL/readme.md

Summary

This playbook is triggered by the Microsoft Sentinel entity trigger for a URL entity. When run, it calls the Google Threat Intelligence API to retrieve the URL report (reputation, harmless/malicious/suspicious/timeout/undetected detection counts, community votes, and the GTI Assessment threat score, verdict, and severity). If the trigger context includes an associated incident, the playbook formats these results into HTML and adds them as a comment on that incident, giving the analyst an at-a-glance threat assessment of the URL directly in the incident timeline.

Prerequisites

Deploy the GTICustomConnector custom connector before deploying this playbook, and register for a Google Threat Intelligence API key (https://developers.virustotal.com/v3.0/reference#getting-started) to use when authorizing the connector's API connection.
Ensure you have a Log Analytics Workspace configured for Microsoft Sentinel.

Deployment Instructions

To deploy the Playbook, click the Deploy to Azure button. This will launch the ARM Template deployment wizard.
Fill in the required parameters:
- PlaybookName: Enter the playbook name here (default: GTI-IOCEnrichmentURL).
- ConnectorName: Name of the deployed Google Threat Intelligence custom connector (default: GoogleThreatIntelligence-CustomConnector).

Post-Deployment Instructions

a. Authorize connections

Once deployment is complete, authorize each connection.

Go to your logic app → API connections → Select Microsoft Sentinel connection resource.
Go to General → edit API connection.
Click Authorize.
Sign in.
Click Save.
Repeat steps for the Google Threat Intelligence connection, providing your GTI API key when prompted.

b. Attach to URL Entity

This playbook uses the Microsoft Sentinel entity trigger (path UrlEntity) and is intended to be run against a URL entity on an incident:

Open an incident in Microsoft Sentinel that contains a URL entity.
Select the URL entity, then choose Run playbook.
From the list of playbooks, select this playbook (default name: GTI-IOCEnrichmentURL).
The playbook retrieves the GTI URL report and, when the run is associated with an incident, adds the GTI URL Report (reputation, detection stats, votes, and GTI Assessment) as a comment on that incident.