This is an n8n community node. It lets you use Google Threat Intelligence in your n8n workflows.
Google Threat Intelligence (GTI) is Google's threat intelligence platform, combining a global crowdsourced detection network, Mandiant's frontline incident response intelligence, and Google Cloud's global security telemetry into a single source for IOC enrichment, public/private malware sandboxing, vulnerability intelligence, real-time IOC feeds and threat lists, Attack Surface Management (ASM), Digital Threat Monitoring (DTM), and RS Alert/finding lifecycle management.
n8n is a fair-code licensed workflow automation platform.
Follow the installation guide in the n8n community nodes documentation, using the package name n8n-nodes-google-threat-intelligence.
Other installation options (local development, Docker)
Local development:
git clone <this-repository-url>
cd n8n-nodes-google-threat-intelligence
npm install
npm run build # or `npm run build:win` on WindowsPoint a local n8n instance at the built package via the N8N_CUSTOM_EXTENSIONS environment variable:
export N8N_CUSTOM_EXTENSIONS="/path/to/n8n-nodes-google-threat-intelligence/dist"
n8n startDocker:
FROM n8nio/n8n:latest
USER root
RUN npm install -g n8n-nodes-google-threat-intelligence
USER nodeOn this page, you'll find a list of operations the Google Threat Intelligence node supports, and links to more resources.
Credentials: you can find authentication information for this node in Credentials.
Turn it on for a simplified version. Most operations support a Simplify toggle that trims the raw API response down to the fields most workflows need; a handful of operations that don't return a report to trim — status updates, scan submissions, document fetches, and the threat-list snapshots — don't have this toggle.
| Resource | Operation | Description |
|---|---|---|
| IOC Enrichment | Get IP Report | Retrieve a threat report for an IPv4/IPv6 address |
| Get Domain Report | Retrieve a threat report for a domain name | |
| Get URL Report | Retrieve a threat report for a URL | |
| Get File Report | Retrieve a threat report for a file by hash (MD5, SHA1, SHA256) | |
| Vulnerability | Get Vulnerability | Retrieve details for a specific CVE |
| List Vulnerabilities | List and filter vulnerabilities by risk rating, CVSS, exploitation state, and more | |
| ASM | Get All ASM Alerts | Search Attack Surface Management alerts/issues, with filtering |
| Get ASM Alert | Retrieve a single ASM alert/issue by ID | |
| Update ASM Alert Status | Set the status of an ASM alert/issue | |
| Get ASM Projects | List the ASM projects available to the credential | |
| DTM | Get All DTM Alerts | List Digital Threat Monitoring alerts, with filtering |
| Get DTM Alert | Retrieve a single DTM alert by ID | |
| Update DTM Alert Status | Update the status of a DTM alert | |
| Public Scanning | Scan File | Upload and scan a public file |
| Scan URL | Submit a public URL for scanning | |
| Get a URL/File Analysis | Retrieve a public analysis by ID, with optional polling until complete | |
| Private Scanning | Scan Private File | Upload and scan a file without making results public |
| Scan Private URL | Submit a URL for scanning without making results public | |
| Get a Private URL/File Analysis | Poll a private analysis's status by ID | |
| Get a Private File Report | Retrieve the full report for a privately scanned file | |
| Get a Private URL Report | Retrieve the full report for a privately scanned URL | |
| Feed Ingestion | Get IOC Stream (Notifications) | Retrieve a stream of IOC notifications |
| Get the Latest Threat List | Retrieve the latest snapshot of a threat list | |
| Get an Hourly Threat List | Retrieve a specific hourly snapshot of a threat list | |
| RS Alert | Get All RS Alerts | List RS alerts for a Google Cloud project |
| Get RS Alert | Retrieve a specific RS alert by ID or resource name | |
| Get RS Alert Document | Retrieve a document attached to an RS alert | |
| List RS Alert Findings | List RS security findings for a Google Cloud project | |
| Get RS Alert Finding | Retrieve a specific RS security finding by ID | |
| Update RS Alert Status | Execute a state-transition action (Benign, Duplicate, Escalated, Triaged, Resolved, and more) |
See Usage for a working example of enriching an indicator and branching on the result.
You can use these credentials to authenticate the following nodes:
- Google Threat Intelligence
- API Key — used for every operation, sent as the
x-apikeyheader
Refer to Google Threat Intelligence's API documentation for more information about the service.
To configure this credential, you'll need a Google Threat Intelligence account with Google Threat Intelligence access, and:
- API Key (required) — your Google Threat Intelligence API key
- Project ID (optional) — your Google Cloud Project ID, only needed for RS Alert operations
To get your API key:
- Sign in to your Google Threat Intelligence account and open API Key settings.
- Copy your API key.
- In n8n, add a Google Threat Intelligence node, create a new credential, paste in the API Key (and Project ID if you'll use RS Alert), and save.
- Test the credential with an operation such as Get IP Report for
8.8.8.8.
- An invalid API key masks any Project ID error. If both an invalid API key and a Project ID are entered, credential testing fails immediately on the API key check (
API Key check failed: ...) — it never gets as far as checking the Project ID, even if that would also be invalid. Fix the API key first, then re-test to see whether the Project ID also needs correcting.
- Minimum n8n version:
1.0.0 - Minimum Node.js version:
18.17.0 - Minimum npm version:
9.0.0
No known version incompatibilities.
- Add the Google Threat Intelligence node to your workflow.
- Select a Resource (e.g. IOC Enrichment, ASM, Vulnerability).
- Select an Operation.
- Fill in the required parameters and, optionally, toggle Simplify.
- Execute!
- Resource:
IOC Enrichment→ Operation:Get Domain Report, with the domain from an earlier step. - Add an If node checking
gti_assessment.verdict/gti_assessment.severityon the result. - Branch into whatever action fits your workflow (open a ticket, notify a channel, block the indicator elsewhere).
- ASM, DTM, RS Alert, and Vulnerability listing operations expose a Return All toggle to auto-paginate automatically, instead of manual page/cursor fields.
- Get a URL/File Analysis and Get a Private URL/File Analysis support Wait for Completion, which polls until the scan finishes instead of returning the in-progress state immediately.
- For Private Scanning, the analysis object returned right after a scan doesn't carry the final verdict — follow up with Get a Private File/URL Report once the analysis status is
completed.