JB5K GCP project
Modernizing Mandiant’s Threat Intel Bot
In threat intelligence, speed is the only metric that truly matters. To stay ahead, analysts need immediate access to indicators like IPs and file hashes without the friction of context-switching between chat tools and heavy dashboards. For years, our "JB5k" bot provided this bridge, but its legacy architecture—reliant on errBot and the Microsoft Bot Framework—had become a bottleneck.
In 2024, at Google, I led the migration of JB5k to Google Chat, transforming it from a legacy tool into a modern, identity-first service
Architecture: Security by Design
The replatforming wasn't just a change of scenery; it was a total overhaul of our security posture. We moved away from the risks of long-lived service account keys, opting instead for Workload Identity.
By leveraging the GCP Metadata Server, the bot now fetches short-lived ID tokens for every request. This ensures that our backend Threat Intel APIs and data stores are only accessible via verified, ephemeral identities, significantly hardening our security perimeter.
The "Partner Domain" Challenge
The most difficult hurdle wasn't the code—it was the boundaries. We needed to allow analysts from a specific Google Partner Domain to query the bot. Standard cross-domain patterns often fail to validate these external users against internal backend services, creating significant authentication friction.
The Solution: Collaborative Impersonation
To solve this, we moved beyond standard documentation and collaborated directly with Google’s Core teams, including EIP, ALE, CHP, and the Google Chat product team.
The result was a custom Service Account Impersonation flow. This allows the bot to:
-
Validate incoming requests from the partner domain.
-
"Impersonate" a trusted internal identity to fetch the required data.
-
Deliver results securely without exposing internal services to the public internet.
Final Takeaways
-
Modernize Auth Early: Transitioning to Workload Identity simplifies secret management and builds a foundation of trust.
-
Plan for Boundaries: Identity friction between partner domains is often the steepest hurdle in any corporate integration.
-
Push the Platform: When you hit a wall, brainstorm with platform experts (like the EIP and Chat teams) to find undocumented paths to success.
JB5k is now live, serving Mandiant analysts faster and more securely than ever before