skills.rest
dandye
dandyeCOMMUNITY
Explore all skills by this author →
𝕏@dandyeGitHub

domain-get-gti-report

Retrieve GTI threat reputation and WHOIS intelligence for a domain name.

85|14|Updated May 17, 2025
Search Tags:#threat intelligence#security operations#whois#gti#domain reputation#ioc enrichment#alert triage
One-click install
npx skills add https://github.com/dandye/adk_runbooks --skill domain-get-gti-report-dandye
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-get-gti-report
Source: https://github.com/dandye/adk_runbooks/tree/main/skills/atomic/domain-get-gti-report
Command: npx skills add https://github.com/dandye/adk_runbooks --skill domain-get-gti-report-dandye

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security analysts need a fast, standardized way to assess whether a domain observed in alerts or IOC lists is malicious, without manually querying threat intelligence platforms and interpreting raw reports. ## Core Features & Use Cases - GTI Domain Report Retrieval: Calls the Google Threat Intelligence MCP get_domain_report tool to fetch reputation, categories, resolutions, and WHOIS data for a domain or FQDN. - Risk Scoring & Decision Logic: Extracts malicious, suspicious, and harmless engine counts and classifies the domain as High, Medium, or Low risk with defined next-step runbooks. - Use Case: During alert triage, an analyst receives a suspicious domain from a DNS query field; this Skill fetches its GTI report, flags it as high-risk if malicious scores or phishing categories appear, and triggers IP reputation checks on resolved addresses. ## Quick Start Use this skill to fetch the GTI reputation report for the domain 'evil-example.com' and tell me its risk classification.

Frequently Asked Questions about domain-get-gti-report

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check a domain's reputation with Google Threat Intelligence?▼

Call the GTI MCP get_domain_report tool with the domain name as the parameter. The returned JSON includes last_analysis_stats, categories, resolutions, and WHOIS data, which you use to classify the domain as high, medium, or low risk.

How to triage a suspicious domain found in a security alert?▼

Extract the domain from alert fields such as target.hostname or DNS question names, then fetch its GTI report. If malicious scores exceed 5 or malware/phishing categories appear, escalate and check resolved IPs; otherwise correlate with Chronicle entity lookups.

What inputs does the GTI domain report lookup require?▼

It requires a single input: a valid domain name or FQDN string, typically sourced from alert fields, IOC lists, or output from another runbook. The value is mapped directly to the get_domain_report tool's domain parameter.

What happens if the GTI domain lookup fails?▼

On failure, the runbook logs the error message and suggests executing an alternative SecOps threat intelligence lookup for the domain. If the alternative also fails, the case is escalated to a human analyst with a failure note.

When should a domain be flagged as high risk from GTI data?▼

Flag a domain as high risk when the malicious engine count exceeds 5 or when GTI categories include malware or phishing. Recently registered domains from WHOIS creation dates combined with malicious indicators also signal new threat campaigns.

Related Skills

Explore More Software Engineering Skills→
dandyedandye
120

hunt-ioc

Parse IOC lists, query SIEMs, and enrich matched indicators.

Community
Advanced
cris-mcris-m

virustotal

Analyze hashes, URLs, IPs, and domains for malware risk via VirusTotal APIs.

Community
Advanced
dandyedandye
120

enrich-ioc

Enrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.

Community
Advanced
luisgustavooliveiraluisgustavooliveira

Recon

Perform passive and active infrastructure reconnaissance using DNS, WHOIS, and IPInfo.

Community
Advanced