Group-IB Digital Risk Protection

Details

ID	`Group-IB Digital Risk Protection`
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/vendors-sdk:1.0.0.10120494`

README

Pack helps to integrate Group-IB Digital Risk Protection and get violations incidents directly into Cortex XSOAR.
This integration was integrated and tested with version 1.0 of Group-IB Digital Risk Protection.

Configure Group-IB Digital Risk Protection in Cortex

Parameter	Description	Required
GIB DRP URL		True
Fetch incidents		False
Incident type		False
Trust any certificate (not secure)		False
Use system proxy settings		False
Incidents Fetch Interval		False
Username		True
Password		True
Violation Section to filter the received Violation		False
Brands to filter the received Violation	Brands for filtering received violations. The list of available brands can be obtained with the command !gibdrp-get-brands in the menu WarRoom -> Playground. After getting the brands you must specify the brand ID for which you want to receive violations. Attention! Currently filtering is available only by one brand in one Instance	False
Incidents first fetch	Date to start fetching incidents from.	False
Download images	Enables or disables loading of each image in each violation. Can significantly affect the speed of data collection if the parameter is enabled, i.e. set to True	False
Getting Typosquatting only	Allows for the collection of offenses suitable only for Typo Squatting	False
Number of requests per collection	A number of requests per collection that integration sends in one fetch iteration (each request picks up to 30 incidents). If you face some runtime errors, lower the value.	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

gibdrp-get-brands

Receive all configured brands.

Base Command

gibdrp-get-brands

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
GIBDRP.OtherInfo	string	List of configured brands.
GIBDRP.OtherInfo.brands.name	string	Brand name.
GIBDRP.OtherInfo.brands.id	string	Brand ID.

Command example


#### Context Example

```json
{
    "GIBDRP": {
        "OtherInfo": {
            "brands": [
                {
                    "id": "PvY1BZUBSFbLZGo2x8TA",
                    "name": "Example Brand"
                }
            ]
        }
    }
}

Human Readable Output

Installed Brands

Name Id

Example Brand PvY1BZUBSFbLZGo2x8TA

Name	Id
Example Brand	PvY1BZUBSFbLZGo2x8TA

gibdrp-get-subscriptions

Receive all configured subscriptions.

Base Command

gibdrp-get-subscriptions

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
GIBDRP.OtherInfo	string	List of configured subscriptions.
GIBDRP.OtherInfo.subscriptions	string	Subscriptions list.

Command example


#### Context Example

```json
{
    "GIBDRP": {
        "OtherInfo": {
            "subscriptions": [
                "scam"
            ]
        }
    }
}

Human Readable Output

Purchased subscriptions

Subscriptions

scam

Subscriptions
scam

gibdrp-get-violation-by-id

Getting a single violation by its ID.

Base Command

gibdrp-get-violation-by-id

Input

Argument Name	Description	Required
id	ID violation.	Required

Context Output

Path	Type	Description
GIBDRP.Violation.id	string	Violation ID.
GIBDRP.Violation.title	string	Violation title.
GIBDRP.Violation.description	string	Violation description.
GIBDRP.Violation.status	string	Violation status.
GIBDRP.Violation.violation_uri	string	Violation URI.
GIBDRP.Violation.source	string	Violation source section.
GIBDRP.Violation.detected	date	Detected timestamp.

gibdrp-change-violation-status

Changing the status of a single violation.

Base Command

gibdrp-change-violation-status

Input

Argument Name	Description	Required
id	ID violation.	Required
status	What status to change to. Possible values are: approve, reject.	Required

Context Output

There is no context output for this command.

Configuration parameters

url — GIB DRP URL (required)
isFetch — Fetch incidents
incidentType — Incident type
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
incidentFetchInterval — Incidents Fetch Interval
credentials — Username (required)
violationSection — Filter by Violation Type
brands — Filter by Brand
first_fetch — Incidents first fetch
download_images — Download images
only_typosquatting — Get Typosquatting Only
max_fetch — Number of requests per collection (required)

Commands (4)

gibdrp-change-violation-status
Changing the status of a single violation.
gibdrp-get-brands
Receive all configured brands.
gibdrp-get-subscriptions
Receive all configured subscriptions.
gibdrp-get-violation-by-id
Getting a single violation by its ID.

Source

GroupIBDigitalRiskProtection.py GroupIBDigitalRiskProtection_test.py GroupIBDigitalRiskProtection.yml GroupIBDigitalRiskProtection_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
commonfields:
  id: Group-IB Digital Risk Protection
  version: -1
configuration:
- defaultvalue: https://drp.group-ib.com/client_api/
  display: GIB DRP URL
  name: url
  required: true
  section: Connect
  type: 0
- display: Fetch incidents
  name: isFetch
  required: false
  section: Collect
  type: 8
- display: Incident type
  name: incidentType
  required: false
  section: Connect
  type: 13
- advanced: true
  display: Trust any certificate (not secure)
  name: insecure
  required: false
  section: Connect
  type: 8
- advanced: true
  display: Use system proxy settings
  name: proxy
  required: false
  section: Connect
  type: 8
- defaultvalue: "1"
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  required: false
  type: 19
  section: Collect
- name: credentials
  display: Username
  required: true
  type: 9
  displaypassword: ""
  hiddenusername: false
  section: Connect
- display: Filter by Violation Type
  additionalinfo: >
    Select a Violation Section to filter fetched Violations. Options map to DRP sections: Web (1), Marketplace (3), Advertising (5), Mobile Apps (2), Social Networks (4), Instant Messengers (6). Leave empty to fetch from all sections.
  name: violationSection
  type: 15
  required: false
  options:
  - "Web"
  - "Marketplace"
  - "Advertising"
  - "Mobile Apps"
  - "Social Networks"
  - "Instant Messengers"
  section: Collect
- display: Filter by Brand
  name: brands
  type: 0
  required: false
  additionalinfo: >
    Requests only Violations associated with the specified Brand IDs. The list of available brands can be obtained with the command !gibdrp-get-brands in the menu WarRoom -> Playground. After getting the brands you must specify the brand ID for which you want to receive violations. Attention! Currently filtering is available only by one brand in one Instance
  section: Collect
- additionalinfo: Date to start fetching incidents from.
  defaultvalue: 3 days
  display: Incidents first fetch
  hidden: false
  name: first_fetch
  required: false
  type: 0
  section: Collect
- display: Download images
  name: download_images
  defaultvalue: "false"
  type: 8
  required: false
  additionalinfo: Enables or disables loading of each image in each violation. Can significantly affect the speed of data collection if the parameter is enabled, i.e. set to True
  section: Optimize
- display: Get Typosquatting Only
  name: only_typosquatting
  defaultvalue: "false"
  type: 8
  required: false
  additionalinfo: Returns only records of the Typosquatting type. If not specified, you consume only violations - without Typosquatting detections.
  section: Optimize
- display: Number of requests per collection
  name: max_fetch
  type: 15
  required: true
  defaultvalue: "1"
  options:
  - "1"
  - "2"
  - "3"
  - "4"
  - "5"
  - "6"
  additionalinfo: A number of requests per collection that integration sends in one fetch iteration (each request picks up to 30 incidents). If you face some runtime errors, lower the value.
  section: Collect
description: Pack helps to integrate Group-IB Digital Risk Protection and get violations incidents directly into Cortex XSOAR.
display: Group-IB Digital Risk Protection
name: Group-IB Digital Risk Protection
script:
  dockerimage: demisto/vendors-sdk:1.0.0.10120494
  isfetch: true
  runonce: false
  script: ''
  subtype: python3
  type: python
  commands:
  - name: gibdrp-get-brands
    arguments: []
    description: Receive all configured brands.
    outputs:
    - contextPath: GIBDRP.OtherInfo
      description: List of configured brands.
      type: string
    - contextPath: GIBDRP.OtherInfo.brands.name
      description: Brand name.
      type: string
    - contextPath: GIBDRP.OtherInfo.brands.id
      description: Brand ID.
      type: string
  - name: gibdrp-get-subscriptions
    arguments: []
    description: Receive all configured subscriptions.
    outputs:
    - contextPath: GIBDRP.OtherInfo
      description: List of configured subscriptions.
      type: string
    - contextPath: GIBDRP.OtherInfo.subscriptions
      description: Subscriptions list.
      type: string
  - name: gibdrp-get-violation-by-id
    arguments:
    - name: id
      required: true
      description: ID violation.
    description: Getting a single violation by its ID.
    outputs:
    - contextPath: GIBDRP.Violation.id
      description: Violation ID.
      type: string
    - contextPath: GIBDRP.Violation.title
      description: Violation title.
      type: string
    - contextPath: GIBDRP.Violation.description
      description: Violation description.
      type: string
    - contextPath: GIBDRP.Violation.status
      description: Violation status.
      type: string
    - contextPath: GIBDRP.Violation.violation_uri
      description: Violation URI.
      type: string
    - contextPath: GIBDRP.Violation.source
      description: Violation source section.
      type: string
    - contextPath: GIBDRP.Violation.detected
      description: Detected timestamp.
      type: date
  - name: gibdrp-change-violation-status
    arguments:
    - name: id
      required: true
      description: ID violation.
    - name: status
      required: true
      auto: PREDEFINED
      predefined:
      - approve
      - reject
      description: What status to change to.
    description: Changing the status of a single violation.
tests:
- No tests (auto formatted)
fromversion: 6.10.0
sectionorder:
- Connect
- Collect
- Optimize