Apply Google Threat Intelligence

Google Threat Intelligence lets Google Cloud Armor Enterprise subscribers secure their traffic by allowing or blocking traffic to their external Application Load Balancers based on several categories of threat intelligence data.

Google Threat Intelligence data is divided into the following categories:

• Tor exit nodes: Tor is open-source software that enables anonymous communication. To exclude users who hide their identity, block the IP addresses of Tor exit nodes (points where traffic exits the Tor network).
• Known malicious IP addresses: IP addresses that need to be blocked to improve your application's security posture because attacks on web applications are known to originate there.
• Search engines: IP addresses that you can allow to enable site indexing.
• VPN providers: IP addresses that are used by low-reputation VPN providers. This category can be blocked to deny attempts to circumnavigate IP address-based rules.
• Anonymous proxies: IP addresses that are used by known anonymous proxies.
• Crypto miners: IP addresses that are used by known cryptocurrency mining websites.
• Public cloud IP address ranges: This category can be either blocked to avoid malicious automated tools from browsing web applications or allowed if your service uses other public clouds.

To use Google Threat Intelligence, you define security policy rules that allow or block traffic based on some or all of these categories by using the evaluateThreatIntelligence match expression along with a feed name that represents one of the preceding categories. In addition, you must subscribe to Cloud Armor Enterprise. For more information about Cloud Armor Enterprise, see the Cloud Armor Enterprise overview.

Configure Google Threat Intelligence

To use Google Threat Intelligence, you configure security policy rules by using the evaluateThreatIntelligence('FEED_NAME') match expression, providing a FEED_NAME based on the category that you want to allow or block. Information within each feed is continually updated, protecting services from new threats without additional configuration steps. The valid arguments are as follows.

You can configure a new security policy rule using the following gcloud command, with a FEED_NAME from the previous table and any ACTION like allow, deny, or throttle. For more information about rule actions, see policy types.

gcloud compute security-policies rules create 1000 \
    --security-policy=NAME \
    --expression="evaluateThreatIntelligence('FEED_NAME')" \
    --action="ACTION"

Replace the following:

• NAME: the name of the security policy that you want to set up
• FEED_NAME: the feed name from the previous table
• ACTION: the action to take for the rule, such as allow, deny, or throttle

Examples of Google Threat Intelligence expressions

• You can use Google Threat Intelligence with a user IP address.

The following example command uses the iplist-tor-exit-nodes feed name with a caller's User IP address:

    evaluateThreatIntelligence('iplist-tor-exit-nodes', origin.user_ip)
  

For more information, see User IP addresses overview.

• You can prevent Google Threat Intelligence from blocking a specific IP address or IP address range by adding the address to the exclusion list.

The following example command uses the iplist-known-malicious-ips feed name:

    evaluateThreatIntelligence('iplist-known-malicious-ips', ['ADDRESS'])
  

Replace ADDRESS with the address or address range that you want to exclude.

• You can use Google Threat Intelligence with a User IP address. Add an IP address or IP address range to the exclusion list to prevent Google Threat Intelligence from blocking it.

The following example command uses the iplist-known-malicious-ips feed name with a User IP address:

    evaluateThreatIntelligence('iplist-known-malicious-ips', origin.user_ip, ['ADDRESS'])
  

Use named IP address lists