Google Cloud Threat Intelligence false positive?
Here’s where to start.
Google Threat Intelligence customer support is handled through Google Cloud Customer Care. A support case can request routing of a disputed Google-authored rule match.
Appeal contacts
Choose a channel for the type of detection you want reviewed. Contact availability and acceptance are controlled by the vendor.
How to request a review
Detection rules review
Google Threat Intelligence customer support is handled through Google Cloud Customer Care. A support case can request routing of a disputed Google-authored rule match.
- Follow the Google Threat Intelligence onboarding instructions for Cloud Customer Care and sign in with your support-enabled organization account.
- Create a technical support case for Google Threat Intelligence, naming the GCTI rule author, rule name or ID, VirusTotal report URL and disputed match.
- Explain the legitimate behavior and ask the support team to route the report to the rule owner.
- This is a customer technical-support route, not a publicly confirmed GCTI false-positive form. A Google Threat Intelligence subscription and configured support access may be required.
- Google states that GTI customer support moved from legacy VirusTotal channels to the Google Cloud console on December 2, 2025.
- Do not confuse a GCTI rule match with the Google antivirus file engine or Google Safe Browsing.
Names you may see in a report
Aliases help locate the responsible vendor. Related products can use different submission channels; check the scope shown above.
Sources for this entry
“Guidance checked” means a public vendor source supports the route or instructions. We have not sent a test appeal or verified mailbox delivery. Read our methodology.