Google Threat Intelligence

Google Threat Intelligence Integration

The integration pulls IoCs from GTI threat lists and pushes them into Mimecast. Different indicator types are enforced differently in Mimecast (for example, File Hashes via Bring Your Own Threat Intelligence, URLs via Managed URLs, Domains via Blocked Senders). The integration runs on a schedule and uses checkpoints so only new data is processed after the first run.

Mimecast + Google Use Cases

• File Hashes

  Fetch SHA256 hashes from selected GTI threat lists (e.g. ransomware, malware) and pushes them to Mimecast Bring Your Own Threat Intelligence (BYOTI).

• URLs

  Fetch URLs from selected threat lists and adds them to Mimecast Managed URLs.

• Domains

  Fetch domains from selected threat lists and adds them to Mimecast (Block Senders and optionally, Managed URLs).

Key Benefits

1. Automates ingestion of GTI threat intelligence into Mimecast for email protection.
2. Reduces manual effort to maintain BYOTI, Managed URLs, and Blocked Senders lists from threat feeds.
3. Lets you choose which indicator types to import and refine data with Query, Verdicts, and Severities.
4. Uses checkpointing so only new data is processed after the first run.
5. Supports notifications when the integration hits permanent errors (e.g. invalid credentials).