Name: Use Cases in Threat Intel: Evolving to Dynamic Threat Intelligence
Start: 2024-10-24T15:00:00Z
End: 2024-10-24T15:00:48.000Z
Location: BrightTALK
Rating: 5

Mandiant is a recognized leader in dynamic cyber defense, threat intelligence and incident response services. By scaling decades of frontline experience, Mandiant helps organizations to be confident in their readiness to defend against and respond to cyber threats. Mandiant is part of Google Cloud.

For modern security teams, the gap between detecting a suspicious indicator and fully understanding the threat is often measured in days—time that defenders simply don’t have. Manually correlating data, mapping TTPs, and authoring detection rules creates critical bottlenecks that slow down response and burn out analysts.

Join Tim Gallo, Lead Global Solutions Architect, as he demonstrates how to shatter these bottlenecks using the new Agentic capabilities within Google Threat Intelligence. Tim will showcase a powerful workflow that transforms a single indicator of compromise (IOC) into a comprehensive threat hunting methodology, compressing what used to take days of research into just seven minutes.

In this session, you will learn how to:
- Instantly Pivot: Automatically correlate a raw IOC with specific malware families, threat actors, and historical campaign data.
- Automate Framework Mapping: Extract tactical behaviors and map them directly to the MITRE ATT&CK framework without manual analysis.
- Generate Immediate Detections: Watch the system build production-ready YARA, YARA-L, and Sigma rules tailored to the specific threat.
- Operationalize Defense: Create complete threat hunting playbooks on the fly to proactively defend your environment.

Don't miss this opportunity to see the future of high-velocity threat analysis in action. Register now to see how Agentic workflows can multiply your team's efficiency and speed.

From IOC to Action in Minutes: Unlocking Agentic Capabilities in Google Threat Intel (APAC Timezone)

From IOC to Action in Minutes: Unlocking Agentic Capabilities in Google Threat Intel

Modern threats utilize highly complex and obfuscated delivery chains to conceal their final payloads and evade detection. This tactical webinar, presented by Google Cloud VirusTotal Security Engineer and FLARE's reverse engineering expert, will demystify the process of analyzing these sophisticated multi-stage threats and show how to scale your static analysis pipeline.

We will demonstrate an in-depth analysis of a multi-stage .NET dropper that leads to the final AgentTesla payload. You will learn expert-level techniques to unravel these chains efficiently:

*Time-Travel Debugging (TTD) Mastery: See how to leverage TTD to navigate complex execution flows, trace obfuscation routines, and perform efficient analysis to quickly extract the primary payload.

*Rapid Static Triage: See the combined power of capa and FLOSS for swift malware capability identification and automated configuration extraction. Learn how to deobfuscate critical strings and access key indicators without ever running the final AgentTesla payload.

*Google Threat Intelligence Integration for Context & Validation: Discover how the high-fidelity indicators and extracted configuration data, once gathered, are instantly cross-referenced with Google Threat Intelligence's massive dataset. This pivoting capability allows analysts to gain immediate threat context, identify related samples, confirm findings, and showcase the effectiveness of crowd-sourced detection efforts.

We will move from initial traditional analysis to building a sense of the threat's complexity, utilizing TTD for payload extraction, analyzing the final configuration data, and pivoting to Google Threat Intelligence to see how detection is achieved through these multiple layers of obfuscation.

Don’t miss this opportunity to learn practical, scalable strategies for transforming complex reverse engineering tasks into automated, repeatable wins for your threat intelligence program.

Static Analysis at Scale: Unpacking the Malware Ecosystem

2025 was a big year for Google Threat Intelligence with a number of security-boosting and time-saving updates. We want to make sure none of these new capabilities slipped past you and make sure you are prepared for the new capabilities we are excited to deliver in 2026.

Join our product experts Megan Deblois, Product Manager and Sara Ouled, Technical Product Growth Team lead for this informative as they dive into: 
- Recently released features
- Practical new use cases
- An exclusive preview of our 2026 roadmap

Google Threat Intelligence News & 2026 Roadmap

Google Threat Intelligence News & 2026 Roadmap (APAC Timezone)

Cyber threats are constantly evolving. Learn how to stay ahead of them in 2026 with security expert Andrew Kopcienski.

Join this deep-dive session based on the Cybersecurity Forecast 2026 report, where Andrew will cover key trends and insights to help strengthen your cyber defenses in the year ahead, including:

- The AI Arms Race: How generative AI is being used by both attackers and defenders.
- Nation-State Threats: A deep dive into activity from the "Big Four"—China, Russia, North Korea, and Iran.
- The Cybercrime Economy: The latest tactics in ransomware, extortion, and cyber crime operations
- Regional Intelligence: Exclusive insights and predictions for the JAPAC and EMEA regions.

Google Cloud Cybersecurity Forecast 2026

This webinar will show you how to transform raw intelligence into a dynamic and actionable defense strategy.

We'll start with a real-world scenario sourced from Google Threat Intelligence, demonstrating how to extract key indicators and behaviors. From there, we'll use the power of agents powered by Gemini to build a robust threat model. We'll show you a step-by-step process, starting with a sequence of prompts to guide the creation of a threat hunt and then using intelligent agents to help automate and operationalize the entire workflow.

Join Muhammad Muneer, Principal Incident Response Consultant and Joseliyo Sánchez, Security Engineer as they show you how to move beyond manual analysis and use advanced AI to accelerate your threat hunting capabilities, enabling you to: 
- Proactively defend against modern threats with speed and precision
- Use AI tools to react quicker to threats when needed
- Enhance your current SOC workflows

Stop chasing alerts and start actively hunting threats. This is your chance to operationalize your threat intelligence and build a truly proactive defense with Google Cloud.

From Intel to Action: A Modern Threat Hunting Workflow

Join us for an in-depth exploration of Google Threat Intelligence, a powerful platform that blends advanced AI capabilities, crowdsourced data, large-scale device scanning, and deep human expertise from Mandiant with the community-driven intelligence of VirusTotal. 

In this webcast, SANS Instructor Dave Shackleford and Google’s Global Solutions Architect, Ben Cook, will talk about how this platform streamlines threat detection, enrichment, and analysis for security teams of all sizes. From tracking threat actors and malware campaigns to monitoring the dark web for emerging risks, you’ll see how Google’s converged ecosystem provides both operational and strategic value.

This discussion will include practical setup guidance and insights, including creating and managing Threat Profiles, leveraging Google ASM for attack surface monitoring, and using Digital Threat Monitoring to stay ahead of malicious activity. You’ll learn how analysts can enrich indicators, explore campaigns, visualize relationships in threat graphs, and integrate insights into your workflows with tools like IocStream. Whether you’re looking to enhance day-to-day threat analysis or inform long-term strategy, this review will give you a clear picture of how Google Threat Intelligence can elevate your security operations.

Enhancing Security Operations with Google Threat Intelligence

Effective threat hunting hinges on your ability to find adversaries before they achieve their objectives. This requires moving beyond generic indicators and arming your team with timely, relevant intelligence on the specific TTPs threat actors are using today. In this webinar, we will explore the latest how AI is making threat hunting more effective in less time than ever before.

Join us as we:
*Unveil  our groundbreaking Agentic Platform (now in public preview) — a major leap in applying AI to investigations and complex security tasks.
*Demo the Ransomware Data Leaks dashboard, offering fresh insights into evolving extortion trends.
*Showcase Code Insight, our AI-powered code analysis tool that converts plain text code files into clear, natural-language explanations—enabling analysts to understand complex threats without reading a single line of code.

The session concludes with a live Q&A, giving you the chance to engage with our experts and explore how these innovations can transform your threat hunting practices.

Threat Hunting with Google Threat Intelligence: Accelerating Investigations with AI (APAC Timezone)

What key strengths are essential for incident response and cyber resilience success?

Join our guest speaker Research VP Craig Robinson of IDC and Senior Director Nick Bennett from Mandiant, as they build on data and insights from the IDC MarketScape: Worldwide Incident Response 2025 Vendor Assessment report. This dynamic fireside chat will go beyond the headlines to provide a strategic look at the market.

Why Attend? 

As a cybersecurity leader, you'll gain the insights needed to strengthen your security posture and make informed decisions. By attending, you will:
- Benchmark your program: Discover the methodology and criteria in the IDC MarketScape that helped position Google as a leader and learn how to apply those same principles to your own organization.
- Align strategy with business goals: Get up-to-date information on the latest industry trends, including cyber risk management and recovery strategies, to optimize your incident response and cyber resilience plans.
- Enhance decision-making: Learn how to improve crisis communication and reduce the financial and reputational impact of a breach.

Mandiant’s Guide to Cyber Resilience in 2025 and Beyond

In the rush to adopt AI, your organization faces an urgent challenge: how do you enable innovation without exposing your most sensitive data and systems to new, unseen risks? This session provides a strategic roadmap for organizations to adopt and deploy AI securely from day one, helping you shift from a reactive security posture to a proactive strategy. 

Drawing on Mandiant's extensive experience assisting diverse, global organizations, Muhammad Muneer, Principal Security Engineer, will share actionable frameworks and strategies on: 
- Critical steps for establishing a secure AI environment 
- The role of a comprehensive governance framework
- Implementing secure development and deployment practices
- AI monitoring and threat detection
- Strengthening AI security incident response and recovery capabilities
- Fostering a culture of AI security awareness and training across the organization

Designed for both executive leadership and technical professionals, attendees will gain actionable insights and practical strategies for navigating the complexities of AI adoption. This session will empower your organization to prepare for a new wave of AI-driven threats.

Securing the AI revolution: How to prepare your organization for AI

La eficacia del Threat Hunting depende de la capacidad de los analistas para encontrar a los adversarios antes de que alcancen sus objetivos. Esto requiere ir más allá de los indicadores genéricos y dotar a su equipo de inteligencia relevante en el momento oportuno sobre las TTP específicas que los actores de amenazas utilizan hoy en día. En este webinar, exploraremos cómo la IA está haciendo que el Threat Hunting sea más eficaz en menos tiempo que nunca. Únase a nosotros para descubrir:
*Nuestra Plataforma Agentic (ahora en vista previa pública) —un gran avance en la aplicación de la IA a las investigaciones y a tareas complejas de seguridad.
*El Ransomware Data Leaks dashboard, que ofrece información actualizada sobre las tendencias cambiantes en materia de extorsión.
*Code Insight, nuestra herramienta de análisis de código impulsada por IA que convierte ficheros de código en texto plano en explicaciones claras en lenguaje natural, lo que permite a los analistas comprender amenazas complejas sin leer una sola línea de código.

La sesión concluirá con una serie de preguntas y respuestas en vivo, dándole la oportunidad de interactuar con nuestros expertos y mejorar sus prácticas de threat hunting.

Threat Hunting con Google Threat Intelligence: Acelerando investigaciones con IA (Versión en Español)

Effective threat hunting hinges on your ability to find adversaries before they achieve their objectives. This requires moving beyond generic indicators and arming your team with timely, relevant intelligence on the specific TTPs threat actors are using today. 

In this webinar, we will explore the latest how AI is making threat hunting more effective in less time than ever before. 

Join us as we:
*Unveil our groundbreaking Agentic Platform (now in public preview) — a major leap in applying AI to investigations and complex security tasks.

*Demo the Ransomware Data Leaks dashboard, offering fresh insights into evolving extortion trends.

*Showcase Code Insight, our AI-powered code analysis tool that converts plain text code files into clear, natural-language explanations—enabling analysts to understand complex threats without reading a single line of code.

The session concludes with a live Q&A, giving you the chance to engage with our experts and explore how these innovations can transform your threat hunting practices.

Threat Hunting with Google Threat Intelligence: Accelerating Investigations with AI

Unpacks today's trends in the cyber threat landscape, marked by escalating sophistication and destructive potential. It highlights that state-sponsored groups are increasingly focused on gaining persistent access to critical infrastructure and are rapidly experimenting with Al. This brief aims to equip security practitioners with actionable intelligence to proactively defend against evolving threats.

Navigating the Evolving Threat Landscape

Panelists will delve into how leaders across various industries are building exceptional proactive cyber defense programs. This session will explore strategies for continuous improvement, identify critical technical debt to eliminate, and discuss how to stay ahead of adversaries while fostering secure digital transformation.

Panel Discussion: Perspectives on Proactive Cyber Defense

Join FBI San Francisco and Mandiant as they unveil their collaborative approach to countering sophisticated cyber espionage threats from the People's Republic of China (PRC). This session will focus on advanced persistent threat actors, including UNC4841 and UNC5221, who exploit zero-day vulnerabilities in network appliances, and the emerging threat of PRC-aligned freelance actors like UNC5174.

FBI & Mandiant: Perspective on Countering PRC Cyber Threats

This session delves into notable multi-cloud incidents from 2025, dissecting destructive and intricate cases. Attendees will gain a deeper understanding of emerging threats, proactive defense measures, and best practices for robust multi-cloud detection and incident response.

Notable Cloud Incidents of 2025: Destructive and Complex Multi-Cloud IR Cases

This session shares real-world incidents where threat actors target the technical infrastructure but rely on business risk to accomplish their mission, and how executive teams are unprepared to respond to a cyber event at their organization.

Prepare for the Whole Attack: Building Executive Resilience

Effective cyber defense starts with a focused approach: deeply understanding the threats that matter most to your organization. This focus provides a critical strategic advantage.

Join Megan DeBlois, Product Manager for Google Threat Intelligence, for this exclusive webinar where she’ll delve into how Google Threat Intelligence Threat Profiles empower your Cyber Threat Intelligence (CTI) function to conduct more focused, efficient, and actionable research.

In this session, you’ll learn how Google Threat Intelligence Threat Profiles serve as a dedicated space for CTI teams to:

*Tailor and Curate Emerging Threats: Easily customize your view to focus on threats that matter most, such as financially motivated ransomware targeting specific sectors or persistent ingress threats.

*Track Comprehensive Threat Intelligence: Stay updated by tracking related vulnerabilities, campaigns, and the actors leveraging them, all within a single, dynamic profile.

*Gain Holistic Visibility: Leverage programmatic access via API and automated recommendations across all Google Threat Intelligence objects (actors, malware, campaigns, vulnerabilities, and reports from Mandiant, partners, and crowdsourced origins) for a complete picture.

*Drive Actionable Insights: Utilize automatically curated IOC streams for tactical actionability and unlock targeted retrohunting in your SIEM with out-of-the-box rules like YARA, IDS, and SIGMA.

Discover how Threat Profiles can be a source of truth for your security program, helping you make sense of vast threat data and prioritize your research efforts with confidence.

Prioritize what matters: Elevate your threat research with Google Threat Intelligence Threat Profiles

Únase a uno de nuestros mejores investigadores de Google Threat Intelligence para una sesión en vivo paso a paso sobre threat hunting con Google Threat Intelligence. Durante la sesión, se abordarán casos prácticos reales y recientes sobre cómo realizar threat hunting y usar la API de Google Threat Intelligence para automatizar investigaciones con el objetivo de:
*Identificar patrones
*Consultas a escala
*Entender los datos

Para conseguirlo, utilizaremos como ejemplo un caso real de una campaña de phishing masiva reciente.

Threat Hunting con Google Threat Intelligence, Episodio 4 (Versión en Español)

Join one of our top Google Threat Intelligence researchers for a step by step LIVE session on Threat Hunting with Google Threat Intelligence. During the session, real-life and recent case studies will be covered on how to conduct threat hunting and use the Google Threat Intelligence API to automate the research, with the goal of:
*Identifying patterns
*Querying at scale
*Understanding the data

To achieve this, we will use as an example a real case of a recent massive phishing campaign.

Threat Hunting with Google Threat Intelligence, Episode 4

Join this next session in the Google Threat Intelligence Use Cases Series where our experts will provide a deep dive into the private scanning module. We will explore its core functionality and use cases and share practical examples on how cyber security analysts can customize the tool to maximize its effectiveness for their specific needs.

What is Private Scanning?

Private Scanning allows you to analyze files and URLs with Google Threat Intelligence in a privacy preserving fashion. Files and URLs uploaded aren't shared with anyone beyond your organization, and remain in Google Threat Intelligence only for a brief period of time. 

Register now to learn:

*Fundamental concepts, key features, and benefits about Private Scanning.
*Analyzing files with Live Interaction.
*Investigating Onion’s URLs.
*Other strategies and best practices for cyber analysts

Unveiling the power of private scanning in Google Threat Intelligence

Join us for a live threat hunting webinar hosted by Google Threat Intelligence experts.

In this session, we will walk through recent threat campaigns, including phishing and vulnerability exploitation. We'll also take a closer look at the activity of a threat actor and provide an overview of the Google Threat Intelligence platform.

The session will conclude with a live Q&A, giving you the opportunity to engage with our experts and enhance your threat hunting practices.

Presenters:
Sara Ouled, Technical product consultant for Google Threat Intelligence, Google Cloud 
Alexandra Martin, Technical product consultant for Google Threat Intelligence, Google Cloud

Threat Hunting with Google Threat Intelligence

Cybersecurity should be a team sport. Attackers are sharing tactics and sometimes infrastructure, so defenders need to work together as well. Sharing threat intelligence within trusted circles is no longer a "nice to have"—it's an essential component of a robust security strategy. Join our webinar to learn how Google Threat Intelligence empowers you to collaborate with internal groups, industry peers, MSSPs, and Mandiant experts to strengthen all of our collective defense.

Join Megan DeBlois, Google Threat Intelligence Product Manager, as she explores how private collections within Google Threat Intelligence can provide a secure and confidential space to share critical intelligence, including IOCs, TTPs, and strategic insights. Discover how these trusted circles enable you to:

*Proactively improve your organization's defenses
*Stop threats before they impact your systems
*Gain a deeper understanding of the evolving threat landscape. 

Don't miss this opportunity to learn how to build and share private collections within your trusted circle.

Don't go it alone: Use private collections in threat intelligence to strengthen your trusted circles

Join us for a LIVE session with one of our top Google Threat Intelligence researchers to gain valuable insights into the Financial Institutions context. The session will feature curated, real-time, and actionable strategic intelligence from Google Threat Intelligence.

*Get the latest information on emerging threats and attack trends.
*Learn how to apply this intelligence to strengthen your organization's security posture.
*Have your questions answered during the live Q&A.

Use cases in Threat Intelligence: Strategic Threat Intelligence for Financial Institutions

Enhance your threat hunting skills with a hands-on session led by a Google Threat Intelligence researcher and a seasoned hunting expert. Learn how to leverage Google Threat Intelligence to generate leads, threat model scenarios, develop hypotheses, and hunt missions. 

Join Jose Luis Sanchez Martinez and Muhammad Muneer as they share their experiences and best practices they use to hunt for threats including:

*Identifying the most relevant indicators
*Performing efficient hunting 
*Knowing which threads to pull on to uncover challenging threats

Proactive threat hunting helps unveil lurking dangers, enabling rapid response and mitigation before significant damage occurs. By incorporating these threat hunting techniques, your team can strengthen the security posture, reduce attacker dwell time, and gain valuable insights to stay ahead of the threats targeting your organization.

Google Threat Intelligence is changing the game in threat intelligence. By unifying the frontline expertise of Mandiant, the VirusTotal intel community and Google security insights, we are bringing to you unmatched breadth and depth, so you can get a panoramic view of the threat landscape, understand the "why" and "how" behind attacks, and turn insights into rapid action.

Quarterly Threat Hunting with Google Threat Intelligence

Elevate your threat hunting expertise by joining a live session with a leading Google Threat Intelligence researcher and a seasoned threat hunting expert. In this hands-on session, we'll guide you through the entire threat hunting process, from crafting your pipeline to executing various hunt types. We'll delve into the strategic and tactical use of Google Threat Intelligence to uncover critical insights, identify pivot points, and pinpoint additional indicators of compromise (IOCs) for your hunts.

Join our webinar to learn how AI in Google Threat Intelligence helps your team uncover hidden threats, streamline investigations, and make faster, more informed decisions. See how AI is transforming threat intelligence in real-world scenarios.

Gemini in Threat Intelligence analyzes vast datasets and acts as a force multiplier, immediately surfacing threats most relevant to your unique risk profile, reducing the noise of generic alerts. It continuously learns from your actions, tailoring its output to become increasingly relevant to your specific needs over time.

Use Cases in Threat Intelligence: Leveraging Gemini

Outsmart attackers and protect your organization with intelligence-driven vulnerability management. In this webinar, Google threat intelligence experts will demonstrate how to prioritize vulnerabilities based on active exploit risk, get early warnings on threats, maximize patch efficiency, and reduce your attack surface.

Use Cases in Threat Intelligence: Making Vulnerability Management Easier

Discover how to streamline your security operations and maximize your threat intelligence investment. In this webinar, we'll explore essential use cases for Google Threat Intelligence, showcasing how it can empower your IOC Enrichment, Incident Response and Forensics, Threat Hunting, Brand Protection and Vulnerability Management.

Join us for a hands-on demonstration of each use case and see benefits of faster threat detection and proactive defense strategies.

Use Cases in Threat Intelligence: Turn Insights into Action

Google Threat Intelligence is changing the game in threat intelligence. By unifying the frontline expertise of Mandiant, the VirusTotal  intel community and Google security insights, we are bringing to you unmatched breadth and depth, so you can get a panoramic view of the threat landscape, understand the "why" and "how" behind attacks, and turn insights into rapid action.

In this webinar, you will:

*Discover how Google Threat Intelligence provides unmatched visibility compared to other leading vendors.
*See a live demo of how to quickly identify the most relevant threats and respond to those threats most likely to target your organization.
*Learn how to operationalize threat intelligence for proactive defense, from automated alerts to AI-assisted malware analysis.
*Understand how Google's team of experts can support your threat intelligence journey, from training to embedded analysts.

Introduction to Google Threat Intelligence

Cyber Threat Intelligence Use Cases and Best Practices

Threat intelligence is the cornerstone of a proactive security posture, but traditional approaches often fall short. Static reports and delayed updates leave security teams struggling to keep pace with the speed of cyberattacks. To stay ahead of threats we need something more dynamic to provide us with more up-to-date and actionable threat intelligence. 

Join Emiliano Martinez, Lead Product Manager and TJ Alldridge, Product Marketing Manager as they explore:
*How dynamic threat intelligence will empower security professionals to use threat intelligence more efficiently. 
*The power of trusted circles - highlighting the power of community and collaboration to keep everyone more safe. 
*AI and automation - making threat intelligence more actionable than ever before.

Join us to unlock the future of threat intelligence and transform your security operations

Use Cases in Threat Intel:  Evolving to Dynamic Threat Intelligence

Malware

Threat Analysis

Threat Detection

Threat Intelligence

Cyber Attacks

Cyber Defense

AIOps

Artificial Intelligence

SecOps

Cloud computing has exploded over the past few years, delivering a previously unimagined level of workplace mobility and flexibility. The cloud computing community on BrightTALK is made up of thousands of engaged professionals learning from the latest cloud computing research and resources. Join the community to expand your cloud computing knowledge and have your questions answered in live sessions with industry experts and vendor representatives.

Cloud Computing

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

The data center management community focuses on the holistic management and optimization of the data center. From technologies such as virtualization and cloud computing to data center design, colocation, energy efficiency and monitoring, the BrightTALK data center management community provides the most up-to-date and engaging content from industry experts to better your infrastructure and operations. Engage with a community of your peers and industry experts by asking questions, rating presentations and participating in polls during webinars, all while you gain insight that will help you transform your infrastructure into a next generation data center.

Data Center Management

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Use Cases in Threat Intel: Evolving to Dynamic Threat Intelligence

Presented by

About this talk

Mandiant | Intelligence and Expertise