Incoming feed - Digital Threat Monitoring#

Note

This article describes how to configure incoming feeds for a particular feed source. To see how to configure incoming feeds in general, see Create and configure incoming feeds.

	Specifications
Transport type	GTI Digital Threat Monitoring (DTM) Alerts
Content type	GTI DTM Alert Json
Ingested data	Retrieves Alerts for the configured project & search string.
Processed data	Incidents & related Indicators.
Description	Retrieve and process information on Incidents and related Indicators.

Configure the Incoming feed#

Create an Incoming feed.
From the Transport type drop-down menu, select Digital Threat Monitoring (DTM) Feed.
From the Content type drop-down menu, select GTI ASM Entity.
The API URL field is automatically filled in with the default domain for the endpoint: https://www.virustotal.com/api/v3/dtm.
In the API key field, enter your GTI API key. Sign up to the Google Threat Intelligence Platform to automatically be assigned a personal API key to access the GTI API.
If necessary, contact the intelligence provider to subscribe to the service and to obtain this information, along with any required authentication and authorization credentials.
Select the Start ingesting from field, use the drop-down calendar to select a start date, and set a start time. The feed will fetch content from the stream starting from the time you specified.
In the Monitor ID field, enter the monitor ID(s) to retrieve alerts for. You can specify this field multiple times to filter on more than one monitor ID.
From the Alert type drop-down menu, select one or more alert types to filter by: Compromised Credentials, Domain Discovery, Forum Post, Message, Paste, Shop Listing, Tweet, or Web Content.
From the Status drop-down menu, select one or more alert statuses to filter by: New, Read, Escalated, In progress, Closed, No action required, Duplicate, Not relevant, or Tracked external.
From the Severity drop-down menu, select one or more severities to filter alerts by: High, Medium, or Low.
In the Tags field, enter one or more tags to filter alerts by. This field can be specified multiple times to filter on multiple tags.
In the Lucene Search field, enter a Lucene-style query string (using AND/OR) to search alert and triggering document contents.
In the Minimum match score field, enter a value from 0 to 100 to filter alerts with an mscore greater than or equal to the given value.
Select the Only alerts with analysis checkbox to only return alerts that have analysis text or analysis file attachments.
Select the Neutralize links in alert docs checkbox to replace raw links in doc content with safe placeholders.
In the Sanitize field, enter true to sanitize any HTML content in the alert, or specify a JSON path in the alert document to sanitize. This field may be repeated.
To store your changes, select Save.