skills.rest
dandye
dandyeCOMMUNITY
Explore all skills by this author →
𝕏@dandyeGitHub

url-get-gti-report

Retrieves URL reputation reports from Google Threat Intelligence for threat classification.

85|14|Updated May 17, 2025
Search Tags:#security operations#mcp tool#threat intel#indicator enrichment#phishing investigation#url reputation#google threat intelligence
One-click install
npx skills add https://github.com/dandye/adk_runbooks --skill url-get-gti-report-dandye
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: url-get-gti-report
Source: https://github.com/dandye/adk_runbooks/tree/main/skills/atomic/url-get-gti-report
Command: npx skills add https://github.com/dandye/adk_runbooks --skill url-get-gti-report-dandye

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security analysts need a fast, standardized way to check whether a URL encountered during an investigation is malicious, suspicious, or benign, without manually querying threat intelligence platforms. ## Core Features & Use Cases - GTI URL Report Retrieval: Calls the Google Threat Intelligence MCP get_url_report tool to fetch full analysis reports for any URL. - Risk Scoring & Categorization: Extracts malicious, suspicious, and harmless engine counts plus URL categories such as phishing or malware. - Decision Logic: Routes outcomes into High, Medium, Low, or Unknown risk flags with defined next steps like domain reputation checks or Chronicle searches. - Use Case: During a phishing email investigation, an analyst submits a suspicious link and receives a structured reputation verdict that determines whether to escalate, block the domain, or continue internal log correlation. ## Quick Start Check the reputation of the URL http://example.com/login using Google Threat Intelligence and tell me whether it is malicious.

Frequently Asked Questions about url-get-gti-report

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check if a URL is malicious using Google Threat Intelligence?▼

Submit the full URL to the GTI get_url_report tool, which returns a JSON report with last_analysis_stats showing how many engines flagged it as malicious or suspicious. A malicious score above 5 or phishing/malware categories indicates high risk.

What data does a GTI URL report contain?▼

The report includes last_analysis_stats with malicious, suspicious, and harmless engine counts, assigned URL categories, the final URL after redirections, and the full redirection chain. These fields drive risk classification decisions.

What happens if GTI has no information on a URL?▼

The runbook returns a NotFound status and flags the URL as Unknown_Reputation_GTI. The recommended next step is extracting the domain for a separate domain reputation check and running internal Chronicle searches.

What should I do when the GTI URL lookup fails?▼

Log the failure message and fall back to the SecOps threat intelligence URL runbook as an alternative source. If the alternative also fails, escalate with a note that external reputation retrieval failed for that URL.

When should a URL be escalated based on GTI results?▼

Escalate when the malicious engine count exceeds 5 or the categories include phishing or malware. In those cases the URL is flagged High_Risk_GTI and containment actions such as blocking the URL or domain are considered.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

detecting-qr-code-phishing-with-email-security

Detect QR code phishing attacks that embed malicious URLs in email images.

Community
Intermediate
dandyedandye
120

enrich-ioc

Enrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.

Community
Advanced
readtheskillreadtheskill
3

bicscan-mcp

Score blockchain addresses and domains for risk using external threat intelligence.

Official
Intermediate
horizontalsystemshorizontalsystems

aif-rules

Append new project rules to .ai-factory/RULES.md and load them before task execution.

Official
Intermediate