What problem does it solve? Security analysts need fast external reputation context on IP addresses during alert triage and investigations, and manually querying threat intelligence platforms slows down response times. ## Core Features & Use Cases - GTI Reputation Lookup: Calls the Google Threat Intelligence MCP tool get_ip_address_report to fetch malicious, suspicious, and harmless engine scores for any IPv4 or IPv6 address. - Structured Output Extraction: Parses the JSON report to extract malicious scores, categories, AS owner, and country for downstream decision-making. - Risk-Based Decision Logic: Classifies IPs as High, Medium, or Low risk based on detection thresholds and recommends escalation, containment, or further internal investigation. - Use Case: During alert triage, an analyst receives a suspicious source IP from a Chronicle alert and uses this runbook to confirm it is flagged as malicious by 12 engines, triggering immediate escalation. ## Quick Start Check the GTI reputation of IP address 203.0.113.45 and tell me whether it should be escalated.
