The Google Threat Intelligence for ITSM Integration brings automated alert ingestion and full incident lifecycle management into a unified IT operations workflow. It enables IT and security teams to ingest high-fidelity Relevance System Alerts from Google Threat Intelligence (GTI) - which blends Mandiant's frontline insights, VirusTotal's vast malware data, and broader Google visibility - and automatically create ITSM Incidents for streamlined triage and resolution, without requiring a dedicated security module.
The integration supports bidirectional state synchronization between GTI Relevance System Alerts and ITSM Incidents. Incident state changes are automatically reflected back to the GTI platform, and GTI alert state changes are propagated to the corresponding ITSM Incidents - ensuring both platforms remain in sync throughout the incident lifecycle.
This app reduces manual handoff between threat detection and IT operations, eliminates status tracking gaps across platforms, and enables faster alert-to-resolution workflows — ideal for IT operations teams, SOC analysts, and incident managers seeking intelligence-led incident handling directly within their existing ITSM environment.
-
Ingest filtered Relevance System Alerts from GTI into ITSM
-
Automatically create ITSM Incidents and link them to the corresponding GTI Relevance System Alerts
-
Bidirectional state synchronization between GTI Relevance System Alert states and ITSM Incident states
-
Visual Dashboard to monitor ingested alert and incident data in real time
-
Process Monitor to track data-fetching and processing job execution for operational visibility
Brand new integration to ingest filtered Relevance System Alerts from Google Threat Intelligence into ITSM by automatically creating and linking Incidents. The integration maintains full bidirectional status synchronization — incident state changes are reflected back to GTI, and GTI Relevance System Alert state changes are propagated to the corresponding ITSM Incidents for complete incident lifecycle tracking. A built-in Dashboard and Process Monitor provide real-time visibility into integration activity and job execution health.
It is standalone app and does not have any depenencies, thus ServiceNow instance is sufficient.