August 12th, 2026 — Agentic Flows & API, and Threat Actor Naming Updates

🌊 Public Preview: Google TI Flows

Google TI Flows is a scheduled orchestration engine that automates recurring investigations by executing natural language prompts (with optional email delivery) and advanced saved searches (delivered to your IoC Stream) on a schedule.

Key Capabilities:

• Scheduled Natural Language Prompts: Schedule complex multi-step AI agent investigations (e.g., "Summarize all new ransomware infrastructure targeting healthcare in the last 24 hours") to execute periodically.
• Scheduled Advanced Saved Searches: Run recurring advanced saved searches (e.g., active campaign indicators, brand impersonation domains) automatically on a schedule and receive the results directly on your IoC Stream.
• Automated Email Reports: Configure prompt-based flows to automatically format and dispatch the results of your prompts—such as structured reports or summaries—directly to team email distribution lists.

Example Use Cases:

• Automated Daily Executive Threat Digest: A Flow executes a daily prompt to summarize threat actor activity and malware campaigns for a specific sector, emailing a clean executive summary directly to security leadership every morning.
• Continuous Campaign Threat Hunting: A Flow executes an advanced VTI saved search query at set intervals for new samples matching your query, automatically flagging and sending newly identified samples to the IoC Stream.

Documentation: Google TI Flows Guide

🤖 Public Preview: Agentic API & Flows API

The Agentic API is now live in Public Preview for Enterprise, Enterprise Plus, and Integration Advanced users. It provides programmatic REST API access to specialized AI threat intelligence agents, shifting threat intelligence from manual lookups to continuous, autonomous AI-driven defense.

Key Capabilities:

• Programmatic Intelligence: Utilize direct REST API endpoints to trigger specialized AI agents for deep IOC triage, threat actor profiling, dark web monitoring, malware analysis, and automated YARA rule generation.
• Flows API: Programmatically orchestrate your investigations with full CRUD access, enabling you to create, execute, and monitor automated flows directly from your internal systems.
• Seamless SOC Integration: Embed Google TI’s agentic intelligence natively into your SIEM, SOAR, or custom security pipelines to eliminate manual toil and significantly accelerate incident response times.

Example Use Case — SOAR Automated Alert Enrichment: When a SIEM/SOAR triggers an alert for an unknown malicious IP or file hash, a playbook can call the Agentic API to execute deep IOC triage, gather dark web chatter, and draft YARA detection rules automatically, attaching high-context notes before an analyst even begins review.

Documentation: Agentic API Reference | Flows API Reference

👤 Threat Actors: New Naming Convention

We are rolling out a new, unified threat actor naming schema to standardize tracking across all systems and make our threat intelligence more intuitive and actionable. As the threat landscape expands, relying on sequential numbers (e.g., APT44, FIN11) has become an exercise in memorization rather than intuition.

The Cryptonym-Based Approach
We are transitioning from numerical identifiers to a cryptonym-based approach. Each distinct threat actor will now be identified by a memorable two-word combination:

• First Word: A unique, memorable term representing the specific actor.
• Second Word: Categorizes the actor by its primary motivation, origin, or activity type (e.g., RELIC for Russia, NEPTUNE for North Korea, or COMET for cybercriminals).

A Work in Progress
We have initially prioritized renaming several dozen of the most active groups, and will continue this process on a rolling basis. Previous names will remain indexed and searchable in the Google Threat Intelligence platform, with MITRE ATT&CK mappings and other vendor aliases preserved, see Figure 1.