Group-IB Threat Intelligence & Attribution

Pack helps to integrate Group-IB Threat Intelligence and get incidents directly into Cortex XSOAR. The list of included collections: Compromised Accounts, Compromised Cards, Compromised Masked Cards, Brand Protection Phishing, Brand Protection Phishing Kit, OSI Git Leak, OSI Public Leak, Targeted Malware.

Data Enrichment & Threat Intelligence · Group-IB Threat Intelligence

Details

IDGroup-IB Threat Intelligence & Attribution
ProviderGroup IB
CategoryData Enrichment & Threat Intelligence
From Version6.0.0
Docker Imagedemisto/vendors-sdk:1.0.0.10120494
Supported ModulesAgentix XSIAM

README

Group-IB Threat Intelligence

Pack helps to integrate Group-IB Threat Intelligence and get incidents directly into Cortex XSOAR.
The integration supports multiple collections including compromised accounts, bank cards, breaches, malware, attacks, OSI leaks, vulnerabilities, and threat intelligence. See the Data Collections Overview section below for the complete list with descriptions and recommended date ranges.

Prerequisites

  1. Access Group-IB Threat Intelligence (TI) Web Interface
  2. Generate API Credentials
    • In the web interface, click your name in the upper right corner
    • Select Profile → Security and Access tab
    • Click Personal token and follow the instructions to generate your API token
    • Note: The API token serves as your password for authentication
  3. Network Configuration
    • Important: Contact Group-IB support to add your Cortex XSOAR server’s IP address to the allow list
    • If you are using a proxy, provide the public IP address of the proxy server instead
    • Make sure you have added Group-IB API IPs/URLs to you FW/Proxy rules.

Important Notes

Recommended Instance Layout

Run separate integration instances for the following groups:

  • Accounts unique
  • Accounts combolist
  • Cards (masked/unmasked)
  • Public leaks/Git Leaks
  • Breached
  • Vulnerabilities
  • Malware reports and threats including profiles
  • SPD
  • Suspicious IP
  • Malware CNC
  • DDoS/Deface/phishing/phishing_kit

Limit Parameter

The Limit (items per request) parameter specifies the number of records requested per API page. This limit applies to all collections configured in the integration instance.

Important considerations:

  • The limit determines how many records are fetched in a single API request. For example, if “Number of requests per collection” is set to 2 and the limit is 500, the integration will make 2 requests per collection, each requesting up to 500 records, resulting in up to 1000 records per collection per fetch cycle.
  • Different collections may have different optimal limit values based on their data structure and API recommendations. We strongly recommend consulting the official API Limitations documentation for specific limit recommendations for each collection.
  • Best practice: Create separate integration instances for different collections or groups of collections that share similar optimal limit values. This allows you to optimize performance for each collection type.

Collection-Specific Filters

The following three filters control data collection behavior for the compromised/account_group collection:

  • Include unique type in data: Filter to include unique data from the compromised/account_group collection
  • Include combolist type in data: Filter to include combolist data from the compromised/account_group collection
  • Enable filter “Probable Corporate Access”: Filter to limit data collection to only corporate accounts

Filter Logic (applies to unique and combolist filters):

  • If both Include unique type in data and Include combolist type in data are disabled: No filtering is applied, and both types of data are collected
  • If only Include unique type in data is enabled: Only unique records are collected
  • If only Include combolist type in data is enabled: Only combolist records are collected
  • If both Include unique type in data and Include combolist type in data are enabled: Both types of data are collected
  • When both unique and combolist filters are not enabled (no checkboxes selected): Both unique and combolist data types are collected by default (as stated above). In this state, you can enable Enable filter "Probable Corporate Access" to limit the entire feed (both unique and combolist data) to only corporate accounts. You can also combine the corporate access filter with unique or combolist filters, if needed. For example, if you are collecting only combolist data (without unique), you can enable Enable filter "Probable Corporate Access" to limit the combolist collection to only corporate accounts

Best Practice: For optimal organization and performance, consider running two separate integration instances:

  • Instance 1: Enable Include unique type in data only
  • Instance 2: Enable Include combolist type in data only
  • Instance 3 (optional): Enable ‘Probable Corporate Access’ - if you need to focus on your company employees compromises only

These filters have no effect on other collections.

Data Collections Overview

Once the configuration is complete, the following collections become available in Cortex XSOAR. For detailed information about each collection, its structure, and available fields, please refer to the official Collections Details documentation.

Note: If you’re using a POC or partner license, access to data is limited to 30 days. The recommended date ranges below are guidelines and can be adjusted according to your needs.

Collection Description Recommended Date Range
compromised/account_group The collection contains credentials collected from various phishing resources, botnets, C&C servers, Darkweb, etc., used by hackers. All indicated sources are unique and private. It also includes combolist and corporate accounts. For Public Breaches - please refer to compromised/breached. 2-4 years
compromised/bank_card_group Information about compromised bank cards, sourced from card shops, forums, and public leaks. 2 years
compromised/masked_card Information about compromised masked bank card records returned as individual card entries, including card, owner, malware, source, and CNC context. 2 years
compromised/mule Information on compromised accounts used by threat actors for money laundering and fund transfers. 90 days
compromised/spd Suspicious payment details collected from underground markets, forums, and messaging platforms. 90 days
compromised/breached Information about publicly leaked databases containing credentials and personal data. Note: Hunting rules are on by default here. 90 days
attacks/ddos Data on Distributed Denial of Service (DDoS) attacks, including targeted resources and attack durations. 5-10 days
attacks/deface Records of defacement attacks, highlighting compromised websites and related actors. 5-10 days
attacks/phishing_group Information on phishing attacks, including URLs of phishing websites. Note: Do not use IPs for detection - it may cause many false positives. Focus only on URLs. 3-5 days
attacks/phishing_kit Collections of phishing website templates, scripts, and configurations used by attackers. 30 days
apt/threat Reports on nation-state APTs activities, including associated indicators (IOCs), attack techniques, and MITRE ATT&CK mappings. 2-4 years
apt/threat_actor Profiles of nation-state groups detailing their characteristics, targets, motivations, and techniques. 2-4 years
hi/threat Finance motivated cybercriminals reports, including associated indicators (IOCs), attack techniques, and MITRE ATT&CK mappings. 2-4 years
hi/threat_actor Profiles of financially motivated cybercriminals detailing their characteristics, targets, motivations, and techniques. 2-4 years
malware/cnc Information on malware Command-and-Control (C&C) servers used for data exfiltration and command distribution. 90 days
malware/malware Detailed malware descriptions. 2-4 years
osi/git_repository Publicly available code from repositories like GitHub, filtered by your hunting rules. Note: Hunting rules are on by default here. 30 days
osi/public_leak Public data leaks from sources like Pastebin, ghostbin, and others, including credentials, database dumps, configuration files, and logs. Note: Hunting rules are on by default here. 15 days
osi/vulnerability Information on software vulnerabilities, associated exploits, and available proof-of-concept details. 90 days
suspicious_ip/tor_node Data about known Tor exit nodes used as anonymity relays. 5 days
suspicious_ip/open_proxy Information on publicly available proxy servers, including potentially misconfigured proxies. 5 days
suspicious_ip/scanner IP addresses identified as scanning or probing corporate networks. 5 days
suspicious_ip/socks_proxy IP addresses of infected hosts configured as SOCKS proxies used for anonymized attacks. 5 days
suspicious_ip/vpn Information about public and private VPN servers identified as potentially malicious or suspicious. 5 days

Configure Group-IB Threat Intelligence in Cortex

Parameter Description Required
GIB TI URL The FQDN/IP the integration should connect to (default: https://tap.group-ib.com/api/v2/). True
Username Enter the email address you use to log into the web interface. The API token serves as your password for authentication. True
Trust any certificate (not secure) Whether to allow connections without verifying SSL certificates validity. False
Use system proxy settings Whether to use XSOAR system proxy settings to connect to the API. False
Source Reliability Reliability of the source providing the intelligence data. Used as a fixed reliability for reputation commands unless overridden by Ignore Source Reliability override. True
Ignore Source Reliability override If enabled, ignore the instance Source Reliability setting and use the integration’s computed reliability per indicator for reputation commands. False
Colletions to fetch Select the collections you want to fetch incidents from. Read more about collections here. False
Incidents first fetch Specify the date range for initial data fetch (default: “3 days”). False
Number of requests per collection Number of API requests per collection in each fetch iteration (default: 3). If you face some runtime errors, lower the value. False
Skip updated incidents (prevent duplicates) Disabled by default. Enable this only when you want the integration itself to suppress duplicate incidents because Pre-Processing Rules are not working reliably in your environment. When enabled, the integration skips Group-IB records that were already fetched and later re-sent after updates. False
Deduplication lookback (days) Used only when Skip updated incidents (prevent duplicates) is enabled. Defines how long fetched Group-IB incident IDs are remembered in the built-in deduplication cache. Recommended value is 365 days. False
Limit (items per request) Number of items requested per API page. This limit applies to all collections in the instance. The limit determines how many records are fetched in a single API request. For example, if “Number of requests per collection” is 2 and limit is 500, the integration will make 2 requests per collection, each requesting up to 500 records, resulting in up to 1000 records per collection per fetch cycle. We recommend following the official API Limitations documentation for collection-specific limit recommendations. Best practice: create separate integration instances for different collections or groups of collections with similar optimal limit values. False
Enable reputation commands Multi-select list of reputation commands to enable for this integration instance (supported: ip, domain, file). Default: none enabled (fail-safe). Only selected commands perform enrichment and return DBotScore. False
Include combolist type in data Filter to include combolist data from the compromised/account_group collection. Works only for compromised/account_group collection. Filter logic: If only this filter is enabled, only combolist records are collected. If both combolist and unique filters are enabled, both types are collected. If both are disabled, both types are collected by default. False
Include unique type in data Filter to include unique data from the compromised/account_group collection. Works only for compromised/account_group collection. Filter logic: If only this filter is enabled, only unique records are collected. If both combolist and unique filters are enabled, both types are collected. If both are disabled, both types are collected by default. False
Enable filter “Probable Corporate Access” Filter to limit data collection to only corporate accounts. Works only for compromised/account_group collection. When both unique and combolist filters are not enabled, you can enable this to limit the whole feed to corporate accounts only. Can also be combined with unique or combolist filters if needed. False
Hunting Rules To enable the collection of data using hunting rules, please select this parameter. False

Note

Requests to the following collections come with the Hunting Rules parameter by default - and turing it off or on won’t make any changes: osi/git_repository, osi/public_leak, compromised/breached, compromised/messenger, compromised/discord

Built-in deduplication should be enabled only when Pre-Processing Rules are not working reliably in your environment. If you rely on Pre-Processing Rules to update existing incidents, keep Skip updated incidents (prevent duplicates) disabled.

Additional Resources

For detailed information about collections, their structure, available fields, and recommended date ranges, refer to the official Collections Details documentation.

Reputation Commands (ip / domain / file)

This integration implements the standard Cortex XSOAR reputation commands:

  • ip
  • domain
  • file

Best practice: use a dedicated instance for reputation

We recommend using a dedicated integration instance for reputation commands, such as Group-IB Threat Intelligence (Partner Contribution).

Enabling reputation commands

Reputation commands are disabled by default to avoid unexpected auto-enrichment side effects.
To enable them, configure the integration instance parameter Enable reputation commands and select the command types you want to allow (ip, domain, file).

Source Reliability and override behavior

The integration supports two reliability modes for reputation commands:

  • Instance override mode (fixed reliability):
    • Controlled by the instance parameter Source Reliability.
    • When Ignore Source Reliability override is disabled (unchecked), the integration attaches the configured Source Reliability value to every reputation response, regardless of indicator-specific findings.
  • Integration-calculated reliability mode (dynamic reliability):
    • Enabled by the instance parameter Ignore Source Reliability override.
    • When Ignore Source Reliability override is enabled (checked), the integration ignores the instance Source Reliability value and calculates reliability per indicator based on the collections that returned matches (see rules below).

Score (DBotScore) calculation rules

Score and reliability are calculated independently. A finding may affect reliability without affecting score.

file score rules

  • BAD: at least one match in ioc/common
  • UNKNOWN (NONE): no matches

Note: For file reputation, the integration evaluates only the ioc/common collection for score.

domain score rules

The integration uses a 3-year recency window and the following date fields:

  • ioc/common.dateLastSeen
  • hi/open_threats.detected
  • attacks/deface.date

Rules (evaluated top-to-bottom):

  • BAD: ioc/common match with dateLastSeen within the last 3 years
  • SUSPICIOUS: hi/open_threats or attacks/deface match with a date within the last 3 years
  • SUSPICIOUS: ioc/common has records but dateLastSeen is missing or older than 3 years
  • UNKNOWN (NONE): no findings (no matches in ioc/common, hi/open_threats, attacks/deface)

ip score rules

The integration maps the numeric Group-IB riskScore (0..100) to DBotScore:

  • GOOD: 0..49
  • SUSPICIOUS: 50..84
  • BAD: 85..100
  • UNKNOWN (NONE): score is missing or out of range

Reliability calculation rules (only when Ignore Source Reliability override is enabled)

When the integration-calculated reliability mode is enabled, reliability is computed as follows:

file reliability rules

  • A - Completely reliable: at least one match in ioc/common
  • None: no matches

domain and ip reliability rules

Reliability is derived from which collections returned matches:

  • A - Completely reliable:
    • any match in apt/threat or apt/threat_actor (nation-state intelligence), or
    • any match in ioc/common
  • B - Usually reliable:
    • any match in attacks/deface, or
    • any match in hi/open_threats

Final selection logic (deterministic):

  • If there is at least one A - Completely reliable source → reliability is A - Completely reliable
  • Else if there is at least one B - Usually reliable source → reliability is B - Usually reliable
  • Else → reliability is None

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Available Commands

The following commands are available in this integration:

Note: Commands now use the gibti- prefix. Legacy gibtia- commands remain available for backward compatibility and are marked as deprecated in the integration settings.

  • gibti-get-available-collections - Returns list of available collections
  • gibti-get-compromised-account-info - Performs Group-IB event lookup in compromised/account collection
  • gibti-get-compromised-card-group-info - Performs Group-IB event lookup in compromised/card collection
  • gibti-get-compromised-masked-card-info - Performs Group-IB event lookup in compromised/masked_card collection
  • gibti-get-compromised-breached-info - Performs Group-IB event lookup in compromised/breached collection
  • gibti-get-phishing-group-info - Performs Group-IB event lookup in attacks/phishing_group collection
  • gibti-get-phishing-kit-info - Performs Group-IB event lookup in attacks/phishing_kit collection
  • gibti-get-osi-git-leak-info - Performs Group-IB event lookup in osi/git_repository collection
  • gibti-get-osi-public-leak-info - Performs Group-IB event lookup in osi/public_leak collection
  • gibti-get-osi-vulnerability-info - Performs Group-IB event lookup in osi/vulnerability collection
  • gibti-get-malware-malware-info - Performs Group-IB event lookup in malware/malware collection
  • gibti-get-compromised-mule-info - Performs Group-IB event lookup in compromised/mule collection
  • gibti-get-compromised-spd-info - Performs Group-IB event lookup in compromised/spd (suspicious payment details) collection
  • gibti-get-attacks-ddos-info - Performs Group-IB event lookup in attacks/ddos collection
  • gibti-get-attacks-deface-info - Performs Group-IB event lookup in attacks/deface collection
  • gibti-get-threat-info - Performs Group-IB event lookup in hi/threat or apt/threat collection
  • gibti-get-threat-actor-info - Performs Group-IB event lookup in hi/threat_actor or apt/threat_actor collection
  • gibti-get-suspicious-ip-tor-node-info - Performs Group-IB event lookup in suspicious_ip/tor_node collection
  • gibti-get-suspicious-ip-open-proxy-info - Performs Group-IB event lookup in suspicious_ip/open_proxy collection
  • gibti-get-suspicious-ip-socks-proxy-info - Performs Group-IB event lookup in suspicious_ip/socks_proxy collection
  • gibti-get-suspicious-ip-vpn-info - Performs Group-IB event lookup in suspicious_ip/vpn collection
  • gibti-get-suspicious-ip-scanner-info - Performs Group-IB event lookup in suspicious_ip/scanner collection
  • gibti-get-malware-cnc-info - Performs Group-IB event lookup in malware/cnc collection
  • gibti-global-search - Performs global Group-IB search across all collections
  • gibtia-local-search - Performs Group-IB search in selected collection

gibti-get-compromised-account-info

Command performs Group-IB event lookup in compromised/account collection with provided ID.

Base Command

gibti-get-compromised-account-info

Input

Argument Name Description Required
id GIB event id.
e.g.: 253b9a136f0d574149fc43691eaf7ae27aff141a.		 Required

Context Output

Path Type Description
GIBTIA.CompromisedAccount.client.ipv4.asn String Victim IP address
GIBTIA.CompromisedAccount.client.ipv4.countryName String Country name
GIBTIA.CompromisedAccount.client.ipv4.ip String Victim IP address
GIBTIA.CompromisedAccount.client.ipv4.region String Region name
GIBTIA.CompromisedAccount.cnc.domain String Event CNC domain
GIBTIA.CompromisedAccount.cnc.url String CNC URL
GIBTIA.CompromisedAccount.cnc.ipv4.ip String CNC IP address
GIBTIA.CompromisedAccount.dateCompromised Date Date of compromise
GIBTIA.CompromisedAccount.dateDetected Date Date of detection
GIBTIA.CompromisedAccount.dropEmail.email String Email where compromised data were sent to
GIBTIA.CompromisedAccount.dropEmail.domain String Email domain
GIBTIA.CompromisedAccount.login String Compromised login
GIBTIA.CompromisedAccount.password String Compromised password
GIBTIA.CompromisedAccount.malware.name String Malware name
GIBTIA.CompromisedAccount.malware.id String Group-IB malware ID
GIBTIA.CompromisedAccount.person.name String Card owner name
GIBTIA.CompromisedAccount.person.email String Card owner e-mail
GIBTIA.CompromisedAccount.portalLink String Link to GIB incident
GIBTIA.CompromisedAccount.threatActor.name String Associated threat actor
GIBTIA.CompromisedAccount.threatActor.isAPT Boolean Is threat actor APT group
GIBTIA.CompromisedAccount.threatActor.id String Threat actor GIB ID
GIBTIA.CompromisedAccount.id String Group-IB incident ID
GIBTIA.CompromisedAccount.evaluation.severity String Event severity

Command Example

!gibti-get-compromised-account-info id=253b9a136f0d574149fc43691eaf7ae27aff141a

Human Readable Output

Feed from compromised/account with ID 253b9a136f0d574149fc43691eaf7ae27aff141a

client ipv4 ip cnc cnc cnc domain cnc ipv4 asn cnc ipv4 city cnc ipv4 countryCode cnc ipv4 countryName cnc ipv4 ip cnc ipv4 provider cnc ipv4 region cnc url companyId dateDetected domain evaluation admiraltyCode evaluation credibility evaluation reliability evaluation severity evaluation tlp evaluation ttl id login malware id malware name malware stixGuid oldId password portalLink silentInsert sourceType stixGuid
0.0.0.0 ««««http://some.com»»»» some.com AS1111 City RU Country 11.11.11.11 some.com City http://some.com -1 2020-02-22T01:21:03+00:00 some.com A2 80 100 red red 90 253b9a136f0d574149fc43691eaf7ae27aff141a some.com 411ac9df6c5515922a56e30013e8b8b366eeec80 PredatorStealer 2f7650f4-bc72-2068-d1a5-467b688975d8 396792583 @some@ https://group-ib.com/cd/accounts?searchValue=id:253b9a136f0d574149fc43691eaf7ae27aff141a 0 Botnet 8abb3aa9-e351-f837-d61a-856901c3dc9d

URL indicator

gibid severity value
253b9a136f0d574149fc43691eaf7ae27aff141a red http://some.com

Domain indicator

gibid severity value
253b9a136f0d574149fc43691eaf7ae27aff141a red some.com

IP indicator

asn geocountry geolocation gibid severity value
AS1111 Country City 253b9a136f0d574149fc43691eaf7ae27aff141a red 11.11.11.11

gibti-get-compromised-breached-info

Command performs Group-IB event lookup in compromised/breached collection with provided ID.

Base Command

gibti-get-compromised-breached-info

Input

Argument Name Description Required
id GIB event id.
e.g.: 6fd344f340f4bdc08548cb36ded62bdf.		 Required

Context Output

Path Type Description
GIBTIA.DataBreach.email String List of breached emails
GIBTIA.DataBreach.leakName String Name of the leak
GIBTIA.DataBreach.password String List of breached passwords
GIBTIA.DataBreach.uploadTime Date Date of breached data upload
GIBTIA.DataBreach.id String Group-IB incident ID
GIBTIA.DataBreach.evaluation.severity String Event severity

Command Example

!gibti-get-compromised-breached-info id=277c4112d348c91f6dabe9467f0d18ba

Human Readable Output

Feed from compromised/breached with ID 277c4112d348c91f6dabe9467f0d18ba

addInfo email evaluation id leakName password uploadTime
address:
some@gmail.com admiraltyCode: C3
credibility: 50
reliability: 50
severity: green
tlp: amber
ttl: null		 277c4112d348c91f6dabe9467f0d18ba some.com AC91C480FDE9D7ACB8AC4B78310EB2TD,
1390DDDFA28AE085D23518A035703112		 2021-06-12T03:02:00

gibti-get-compromised-mule-info

Command performs Group-IB event lookup in compromised/mule collection with provided ID.

Base Command

gibti-get-compromised-mule-info

Input

Argument Name Description Required
id GIB event id.
e.g.: 50a3b4abbfca5dcbec9c8b3a110598f61ba93r33.		 Required

Context Output

Path Type Description
GIBTIA.CompromisedMule.account String Account number (card/phone), which was used by threat actor to cash out
GIBTIA.CompromisedMule.cnc.ipv4.asn String CNC ASN
GIBTIA.CompromisedMule.cnc.ipv4.countryName String Country name
GIBTIA.CompromisedMule.cnc.ipv4.ip String Victim IP address
GIBTIA.CompromisedMule.cnc.ipv4.region String Region name
GIBTIA.CompromisedMule.cnc.url String CNC URL
GIBTIA.CompromisedMule.cnc.domain String CNC domain
GIBTIA.CompromisedMule.dateAdd Date Date of detection
GIBTIA.CompromisedMule.malware.name String Malware name
GIBTIA.CompromisedMule.portalLink String Link to GIB incident
GIBTIA.CompromisedMule.threatActor.name String Associated threat actor
GIBTIA.CompromisedMule.threatActor.id String Threat actor GIB ID
GIBTIA.CompromisedMule.threatActor.isAPT Boolean Is threat actor APT group
GIBTIA.CompromisedMule.id String Group-IB incident ID
GIBTIA.CompromisedMule.sourceType String Information source
GIBTIA.CompromisedMule.evaluation.severity String Event severity

Command Example

!gibti-get-compromised-mule-info id=50a3b4abbfca5dcbec9c8b3a110598f61ba90a99

Human Readable Output

Feed from compromised/mule with ID 50a3b4abbfca5dcbec9c8b3a110598f61ba90a99

account cnc cnc cnc domain cnc ipv4 ip cnc url dateAdd evaluation admiraltyCode evaluation credibility evaluation reliability evaluation severity evaluation tlp evaluation ttl hash id malware id malware name malware stixGuid oldId organization name portalLink sourceType stixGuid type
1111111111111111 ««««««««««««««««http://some.com»»»»»»»»»»»»»»»» some 11.11.11.11 http://some.com 2020-02-21T13:02:00+00:00 A2 80 100 red amber 30 some 50a3b4abbfca5dcbec9c8b3a110598f61ba90a99 5a2b741f8593f88178623848573abc899f9157d4 Anubis 7d837524-7b01-ddc9-a357-46e7136a9852 392993084 Some https://group-ib.com/cd/mules?searchValue=id:50a3b4abbfca5dcbec9c8b3a110598f61ba90a99 Botnet 2da6b164-9a12-6db5-4346-2a80a4e03255 Person

URL indicator

gibid severity value
50a3b4abbfca5dcbec9c8b3a110598f61ba90a99 red http://some.com

Domain indicator

gibid severity value
50a3b4abbfca5dcbec9c8b3a110598f61ba90a99 red some

IP indicator

gibid severity value
50a3b4abbfca5dcbec9c8b3a110598f61ba90a99 red 11.11.11.11

gibti-get-compromised-spd-info

Command performs Group-IB event lookup in compromised/spd (suspicious payment details) collection with provided ID. Returns payment-related observables (e.g. cryptocurrency wallets) linked to threat actors and leaks, including type, value, events, sources, malware, and evaluation (severity, TLP, TTL).

Base Command

gibti-get-compromised-spd-info

Input

Argument Name Description Required
id GIB event id.
e.g.: 5120a3b4abbfca5dcbed3ac9c8b3a110598f61.		 Required

Context Output

Path Type Description
GIBTIA.CompromisedSPD.id String Group-IB SPD incident ID.
GIBTIA.CompromisedSPD.type String Observable type (e.g. Cryptocurrency Wallet).
GIBTIA.CompromisedSPD.value.value String Main observable value (wallet address, etc.).
GIBTIA.CompromisedSPD.serviceType String Service type (e.g. BTCLike, XMRLike).
GIBTIA.CompromisedSPD.ownerName String Owner name if available.
GIBTIA.CompromisedSPD.illegalScore Number Illegal score.
GIBTIA.CompromisedSPD.portalLink String Link to GIB incident.
GIBTIA.CompromisedSPD.events Unknown Events table (compromisedAt, detectedAt, source, malware, threatActor).
GIBTIA.CompromisedSPD.sources Unknown Sources table (name, type).
GIBTIA.CompromisedSPD.malware Unknown Malware table (id, name, stixGuid).
GIBTIA.CompromisedSPD.threatActor Unknown Threat actor table (id, name, stixGuid).
GIBTIA.CompromisedSPD.evaluation.severity String Event severity.
GIBTIA.CompromisedSPD.evaluation.tlp String TLP.
GIBTIA.CompromisedSPD.evaluation.ttl Number TTL (days).

Command Example

!gibti-get-compromised-spd-info id=5120a3b4abbfca5dcbed3ac9c8b3a110598f61

Human Readable Output

Feed from compromised/spd with ID 5120a3b4abbfca5dcbed3ac9c8b3a110598f61

id type value serviceType illegalScore portalLink evaluation severity evaluation tlp evaluation ttl
5120a3b4abbfca5dcbed3ac9c8b3a110598f61 Cryptocurrency Wallet bc1qrc4zze8zr96pwt49fn6nq53rks625guzn7navy BTCLike 100 https://tap.group-ib.com/cd/suspicious-payment-details?id=5120a3b4abbfca5dcbed3ac9c8b3a110598f61 red amber 30

Events, sources, malware, and threat actor tables are included in the full feed object.

gibti-get-osi-git-leak-info

Command performs Group-IB event lookup in osi/git_leak collection with provided ID.

Base Command

gibti-get-osi-git-leak-info

Input

Argument Name Description Required
id GIB event id.
e.g.: f201c253ac71f7d78db39fa111a2af9d7ee7a3f7.		 Required

Context Output

Path Type Description
GIBTIA.GitLeak.dateDetected Date Leak detection date
GIBTIA.GitLeak.matchesType String List of matches type
GIBTIA.GitLeak.name String GIT filename
GIBTIA.GitLeak.repository String GIT repository
GIBTIA.GitLeak.revisions.file String Leaked file link
GIBTIA.GitLeak.revisions.fileDiff String Leaked file diff
GIBTIA.GitLeak.revisions.info.authorName String Revision author
GIBTIA.GitLeak.revisions.info.authorEmail String Author name
GIBTIA.GitLeak.revisions.info.dateCreated Date Revision creation date
GIBTIA.GitLeak.source String Source(github/gitlab/etc.)
GIBTIA.GitLeak.evaluation.severity String Event severity

Command Example

!gibti-get-osi-git-leak-info id=ead0d8ae9f2347789941ebacde88ad2e3b1ef691

Human Readable Output

Feed from osi/git_leak with ID ead0d8ae9f2347789941ebacde88ad2e3b1ef691

companyId dateDetected dateUpdated evaluation admiraltyCode evaluation credibility evaluation reliability evaluation severity evaluation tlp evaluation ttl file fileId id matchesType matchesTypeCount card matchesTypeCount cisco matchesTypeCount commonKeywords matchesTypeCount domain matchesTypeCount dsn matchesTypeCount email matchesTypeCount google matchesTypeCount ip matchesTypeCount keyword matchesTypeCount login matchesTypeCount metasploit matchesTypeCount nmap matchesTypeCount pgp matchesTypeCount sha matchesTypeCount slackAPI matchesTypeCount ssh name repository source
40,
1872,
2060,
2248,
2522,
2692		 2020-03-12T01:12:00+00:00 2020-02-11T01:12:00+00:00 A6 100 100 green amber 30 https://group-ib.com/api/v2/osi/git_leak/ead0d8ae9f2347789941ebacde88ad2e3b1ef691/file/bWFpbi0zOTFkYjVkNWYxN2FiNmNiYmJmN2MzNWQxZjRkMDc2Y2I0YzgzMGYwOTdiMmE5ZWRkZDJkZjdiMDY1MDcwOWE3 391db5d5f17ab6cbbbf7c35d1f4d076cb4c830f097b2a9eddd2df7b0650709a7 ead0d8ae9f2347789941ebacde88ad2e3b1ef691 commonKeywords,
keyword		 0 0 1 0 0 0 0 0 1 0 0 0 0 0 0 0 some some.com github

revisions table

bind companyId data file fileDiff fileDiffId fileId hash info parentFileId
{‘bindBy’: ‘cert’, ‘companyId’: [2692], ‘data’: ‘cert’, ‘type’: ‘keyword’} 2692 commonKeywords: {“password”: [“password”]} https://group-ib.com/api/v2/osi/git_leak/ead0d8ae9f2347789941ebacde88ad2e3b1ef691/file/cmV2aXNpb24tZmlsZS0zOTFkYjVkNWYxN2FiNmNiYmJmN2MzNWQxZjRkMDc2Y2I0YzgzMGYwOTdiMmE5ZWRkZDJkZjdiMDY1MDcwOWE3 https://group-ib.com/api/v2/osi/git_leak/ead0d8ae9f2347789941ebacde88ad2e3b1ef691/file/cmV2aXNpb24tZmlsZURpZmYtMzkxZGI1ZDVmMTdhYjZjYmJiZjdjMzVkMWY0ZDA3NmNiNGM4MzBmMDk3YjJhOWVkZGQyZGY3YjA2NTA3MDlhNw== a2187ee179076a22e550e8f7fbc51840e87aba260431ab9cb2d4e0192ad4134c 391db5d5f17ab6cbbbf7c35d1f4d076cb4c830f097b2a9eddd2df7b0650709a7 Some authorEmail: some@gmail.com
authorName: some
dateCreated: 2020-01-03T11:17:52+00:00
timestamp: 1617794272		 ead0d8ae9f2347789941ebacde88ad2e3b1ef691

gibti-get-osi-public-leak-info

Command performs Group-IB event lookup in osi/public_leak collection with provided ID.

Base Command

gibti-get-osi-public-leak-info

Input

Argument Name Description Required
id GIB event id.
e.g.: a9a5b5cb9b971a2a037e3a0a30654185ea148095.		 Required

Context Output

Path Type Description
GIBTIA.PublicLeak.created Date Leak event detection date
GIBTIA.PublicLeak.data String Leaked data
GIBTIA.PublicLeak.hash String Leak data hash
GIBTIA.PublicLeak.linkList.author String Leak entry author
GIBTIA.PublicLeak.linkList.dateDetected Date Leak detection date
GIBTIA.PublicLeak.linkList.datePublished Date Leak publish date
GIBTIA.PublicLeak.linkList.hash String Leak hash
GIBTIA.PublicLeak.linkList.link String Leak link
GIBTIA.PublicLeak.linkList.source String Leak source
GIBTIA.PublicLeak.matches String Matches
GIBTIA.PublicLeak.portalLink String Group-IB portal link
GIBTIA.PublicLeak.evaluation.severity String Event severity

Command Example

!gibti-get-osi-public-leak-info id=a09f2354e52d5fa0a8697c8df0b4ed99cc956273

Human Readable Output

Feed from osi/public_leak with ID a11f2354e52d5fa0a8697c8df0b4ed99cc956211

created data evaluation admiraltyCode evaluation credibility evaluation reliability evaluation severity evaluation tlp evaluation ttl hash id language portalLink size updated useful
2020-02-02T13:52:01+03:00 Big chunk of data C3 50 50 green amber 30 a11f2354e52d5fa0a8697c8df0b4ed99cc956211 a11f2354e52d5fa0a8697c8df0b4ed99cc956211 java https://group-ib.com/osi/public_leak?searchValue=id:a09f2354e52d5fa0a8697c8df0b4ed99cc956273 709 B 2021-04-01T14:57:01+03:00 1

linkList table

dateDetected datePublished hash itemSource link size source status
2021-04-01T14:57:01+03:00 2021-04-01T14:50:45+03:00 5d9657dbdf59487a6031820add2cacbe54e86814 api https://some.com 709 some.com 1

gibti-get-osi-vulnerability-info

Command performs Group-IB event lookup in osi/vulnerability collection with provided ID.

Base Command

gibti-get-osi-vulnerability-info

Input

Argument Name Description Required
id GIB event id.

e.g.: CVE-2021-27152.		 Required

Context Output

Path Type Description
GIBTIA.OSIVulnerability.affectedSoftware.name String Affected software name
GIBTIA.OSIVulnerability.affectedSoftware.operator String Affected software version operator( ex. le=less or equal)
GIBTIA.OSIVulnerability.affectedSoftware.version String Affected software version
GIBTIA.OSIVulnerability.bulletinFamily String Bulletin family
GIBTIA.OSIVulnerability.cvss.score String CVSS score
GIBTIA.OSIVulnerability.cvss.vector String CVSS vector
GIBTIA.OSIVulnerability.dateLastSeen Date Date last seen
GIBTIA.OSIVulnerability.datePublished Date Date published
GIBTIA.OSIVulnerability.description String Vulnerability description
GIBTIA.OSIVulnerability.id String Vulnerability ID
GIBTIA.OSIVulnerability.reporter String Vulnerability reporter
GIBTIA.OSIVulnerability.title String Vulnerability title
GIBTIA.OSIVulnerability.evaluation.severity String Event severity

Command Example

!gibti-get-osi-vulnerability-info id=CVE-2021-27152

Human Readable Output

Feed from osi/vulnerability with ID CVE-2021-27152

bulletinFamily cvss score cvss vector dateLastSeen dateModified datePublished description displayOptions isFavourite displayOptions isHidden evaluation admiraltyCode evaluation credibility evaluation reliability evaluation severity evaluation tlp evaluation ttl exploitCount extCvss base extCvss environmental extCvss exploitability extCvss impact extCvss mImpact extCvss overall extCvss temporal extCvss vector extDescription href id lastseen modified portalLink provider published references reporter title type
NVD 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P 2021-02-11T14:35:24+03:00 2021-02-11T00:45:00+03:00 2021-02-10T19:15:00+03:00 Description false false A1 100 100 red green 30 0 9.8 0.0 3.9 5.9 0.0 9.8 0.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Big description ««««https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-27152»»»» CVE-2021-27152 2021-02-11T14:35:24+03:00 2021-02-11T00:45:00+03:00 https://group-ib.com/osi/vulnerabilities?searchValue=id:CVE-2021-27152 some.com 2021-02-10T19:15:00+03:00 https://pierrekim.github.io/blog/2021-01-12-fiberhome-ont-0day-vulnerabilities.html#httpd-hardcoded-credentials,
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-27152		 some.com CVE-2021-27152 cve

softwareMixed table

os osVendor osVersion vendor
some_firmware some some some

gibti-get-attacks-ddos-info

Command performs Group-IB event lookup in attacks/ddos collection with provided ID.

Base Command

gibti-get-attacks-ddos-info

Input

Argument Name Description Required
id GIB event id.
e.g.: 26a05baa4025edff367b058b13c6b43e820538a5.		 Required

Context Output

Path Type Description
GIBTIA.AttacksDDoS.cnc.url String CNC URL
GIBTIA.AttacksDDoS.cnc.domain String CNC domain
GIBTIA.AttacksDDoS.cnc.ipv4.asn String CNC ASN
GIBTIA.AttacksDDoS.cnc.ipv4.countryName String CNC IP country name
GIBTIA.AttacksDDoS.cnc.ipv4.ip String CNC IP address
GIBTIA.AttacksDDoS.cnc.ipv4.region String CNC region name
GIBTIA.AttacksDDoS.target.ipv4.asn String DDoS target ASN
GIBTIA.AttacksDDoS.target.ipv4.countryName String DDoS target country name
GIBTIA.AttacksDDoS.target.ipv4.ip String DDoS target IP address
GIBTIA.AttacksDDoS.target.ipv4.region String DDoS target region name
GIBTIA.AttacksDDoS.target.category String DDoS target category
GIBTIA.AttacksDDoS.target.domain String DDoS target domain
GIBTIA.AttacksDDoS.threatActor.id String Associated threat actor ID
GIBTIA.AttacksDDoS.threatActor.name String Associated threat actor
GIBTIA.AttacksDdos.threatActor.isAPT Boolean Is threat actor APT
GIBTIA.AttacksDDoS.id String GIB incident ID
GIBTIA.AttacksDDoS.evaluation.severity String Event severity

Command Example

!gibti-get-attacks-ddos-info id=26a05baa4025edff367b058b13c6b43e820538a5

Human Readable Output

Feed from attacks/ddos with ID 26a05baa4025edff367b058b13c6b43e820538a5

cnc cnc cnc domain cnc ipv4 asn cnc ipv4 city cnc ipv4 countryCode cnc ipv4 countryName cnc ipv4 ip cnc ipv4 provider cnc ipv4 region companyId dateBegin dateEnd dateReg evaluation admiraltyCode evaluation credibility evaluation reliability evaluation severity evaluation tlp evaluation ttl id oldId portalLink protocol source stixGuid target domainsCount target ipv4 asn target ipv4 city target ipv4 countryCode target ipv4 countryName target ipv4 ip target ipv4 provider target ipv4 region target port type
some.com some.com AS11111 Some US United States 11.11.11.11 Some Some -1 2021-01-16T02:58:53+00:00 2021-01-16T02:58:55+00:00 2021-01-16 A2 90 90 red green 30 26a05baa4025edff367b058b13c6b43e820538a5 394657345 https://group-ib.com/attacks/ddos?searchValue=id:26a05baa4025edff367b058b13c6b43e820538a5 udp honeypot_logs:1 ea05c117-2cca-b3cd-f033-a8e16e5db3c2 0 AS11111 Some US United States 11.11.11.11 Some Some 55843 DNS Reflection

Domain indicator

gibid severity value
26a05baa4025edff367b058b13c6b43e820538a5 red some.com

IP indicator

asn geocountry geolocation gibid severity value
AS11111 United States Some 26a05baa4025edff367b058b13c6b43e820538a5 red 11.11.11.11

gibti-get-attacks-deface-info

Command performs Group-IB event lookup in attacks/deface collection with provided ID.

Base Command

gibti-get-attacks-deface-info

Input

Argument Name Description Required
id GIB event id.
e.g.: 6009637a1135cd001ef46e21.		 Required

Context Output

Path Type Description
GIBTIA.AttacksDeface.date Date Date of deface
GIBTIA.AttacksDeface.id String GIB incident ID
GIBTIA.AttacksDeface.targetIp.asn String Victim ASN
GIBTIA.AttacksDeface.targetIp.countryName String Victim country name
GIBTIA.AttacksDeface.targetIp.region String Victim IP region name
GIBTIA.AttacksDeface.threatActor.id String Associated threat actor ID
GIBTIA.AttacksDeface.threatActor.name String Associated threat actor
GIBTIA.AttacksDeface.threatActor.isAPT Boolean Is threat actor APT
GIBTIA.AttacksDeface.url String URL of compromised resource
GIBTIA.AttacksDeface.evaluation.severity String Event severity

Command Example

!gibti-get-attacks-deface-info id=6009637a1135cd001ef46e21

Human Readable Output

Feed from attacks/deface with ID 6009637a1135cd001ef46e21

date evaluation admiraltyCode evaluation credibility evaluation reliability evaluation severity evaluation tlp evaluation ttl id mirrorLink portalLink providerDomain siteUrl source targetDomain targetIp countryName targetIp ip threatActor id threatActor isAPT threatActor name tsCreate url
2021-01-21T02:22:18+00:00 B2 80 80 orange amber 30 6009637a1135cd001ef46e21 https://some.com/id:-6009637a1135cd001ef46e21: https://group-ib.com/attacks/deface?searchValue=id:6009637a1135cd001ef46e21 some.com ««««««««««««««««http://some.com»»»»»»»»»»»»»»»» some.com some.com Indonesia 11.11.11.11 d7ff75c35f93dce6f5410bba9a6c206bdff66555 false FRK48 2021-01-21T11:19:52+00:00 http://some.com

URL indicator

gibid severity value
6009637a1135cd001ef46e21 orange http://some.com

Domain indicator

gibid severity value
6009637a1135cd001ef46e21 orange some.com

IP indicator

geocountry gibid severity value
Indonesia 6009637a1135cd001ef46e21 orange 11.11.11.11

gibti-get-phishing-kit-info

Command performs Group-IB event lookup in attacks/phishing_kit collection with provided ID.

Base Command

gibti-get-phishing-kit-info

Legacy alias gibtia-get-phishing-kit-info remains available for backward compatibility.

Input

Argument Name Description Required
id GIB event id. Required

Command Example

!gibti-get-phishing-kit-info id=<phishing-kit-id>

gibti-get-threat-info

Command performs Group-IB event lookup in hi/threat (or in apt/threat if the APT flag is true) collection with provided ID.

Base Command

gibti-get-threat-info

Input

Argument Name Description Required
id GIB event id.
e.g.: 1b09d389d016121afbffe481a14b30ea995876e4.		 Required
isAPT Is threat APT. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
GIBTIA.Threat.contacts.account String Threat accounts found in this threat action.
GIBTIA.Threat.contacts.flag String Is account fake or not
GIBTIA.Threat.contacts.service String Account service
GIBTIA.Threat.contacts.type String Type of account(social_network/email/wallet etc.)
GIBTIA.Threat.countries String Affected countries
GIBTIA.Threat.createdAt Date Threat report creation date
GIBTIA.Threat.cveList.name String List of abused CVE
GIBTIA.Threat.dateFirstSeen Date Attack first seen date
GIBTIA.Threat.dateLastSeen Date Attack last seen date
GIBTIA.Threat.datePublished Date Date published
GIBTIA.Threat.description String Threat description
GIBTIA.Threat.forumsAccounts.url String Related forum URL
GIBTIA.Threat.forumsAccounts.nickname String Related forums account
GIBTIA.Threat.forumsAccounts.registeredAt Date Related forums account registration date
GIBTIA.Threat.forumsAccounts.messageCount Number Related forums messages count
GIBTIA.Threat.id String GIB internal threat ID
GIBTIA.Threat.indicators String Can be either network or file indicators
GIBTIA.Threat.langs String Languages actors related
GIBTIA.Threat.malwareList.name String Related Malware Name
GIBTIA.Threat.malwareList.id String Related malware GIB internal ID
GIBTIA.Threat.mitreMatrix.attackPatternId String MITRE attack pattern ID
GIBTIA.Threat.mitreMatrix.attackTactic String MITRE attack tactic name
GIBTIA.Threat.mitreMatrix.attackType String MITRE attack type
GIBTIA.Threat.mitreMatrix.id String MITRE attack id
GIBTIA.Threat.regions String Regions affected by attack
GIBTIA.Threat.reportNumber String GIB report number
GIBTIA.Threat.sectors String Affected sectors
GIBTIA.Threat.shortDescription String Short description
GIBTIA.Threat.title String Threat title
GIBTIA.Threat.targetedCompany String Targeted company name
GIBTIA.Threat.ThreatActor.name String Threat actor name
GIBTIA.Threat.ThreatActor.id String Threat actor ID
GIBTIA.Threat.ThreatActor.isAPT Boolean Is threat actor APT group
GIBTIA.Threat.sources String Sources links
GIBTIA.Threat.evaluation.severity String Event severity

Command Example

!gibti-get-threat-info id=1b09d389d016121afbffe481a14b30ea995876e4 isAPT=true

Human Readable Output

Feed from threat with ID 1b09d389d016121afbffe481a14b30ea995876e4

createdAt dateFirstSeen dateLastSeen datePublished deleted description evaluation admiraltyCode evaluation credibility evaluation reliability evaluation severity evaluation tlp id isPublished isTailored langs oldId reportNumber sectors threatActor country threatActor id threatActor isAPT threatActor name title type updatedAt
2021-01-15T16:53:20+03:00 2021-01-15 2021-01-15 2021-01-15 false Big description B1 100 80 orange amber 1b09d389d016121afbffe481a14b30ea995876e4 true false en,
com		 4c01c2d4-5ebb-44d8-9e91-be89231b0eb3 CP-2501-1653 financial-services,
finance		 KP 5e9f20fdcf5876b5772b3d09b432f4080711ac5f true Lazarus Lazarus launches new attack with cryptocurrency trading platforms threat 2021-04-02T14:08:03+03:00

files table

hash mime name size
fa5b6b2f074ba6eb58f8b093f0e92cb8ff44b655dc8e9ce93f850e71474e4e11 image/png fa5b6b2f074ba6eb58f8b093f0e92cb8ff44b655dc8e9ce93f850e71474e4e11 284731
a6851a6b91759d00afce8e65c0e5087429812b8c49d39631793d8b6bdeb08711 image/png a6851a6b91759d00afce8e65c0e5087429812b8c49d39631793d8b6bdeb08711 129240
644f5b8e38f55b82f811240af7c4abdaf8c8bc18b359f8f169074ba881d93b1d image/png 644f5b8e38f55b82f811240af7c4abdaf8c8bc18b359f8f169074ba881d93b1d 556552
623102f6cf9d2e6c978898117b7b5b85035b3d5e67c4ee266879868c9eb24dd2 image/png 623102f6cf9d2e6c978898117b7b5b85035b3d5e67c4ee266879868c9eb24dd2 209254

mitreMatrix table

attackPatternId attackTactic attackType id params
attack-pattern–45242287-2964-4a3e-9373-159fad4d8195 establish-&-maintain-infrastructure pre_attack_tactics PRE-T1105 data:

indicatorRelationships table

sourceId targetId
9f3a2a244570a38e772a35d7c9171eed92bec6f7 12cad1ca535a92a2ed306c0edf3025e7d9776693

indicators table

deleted id langs params seqUpdate type
false 9f3a2a244570a38e772a35d7c9171eed12bec6f7 en hashes: {“md4”: “”, “md5”: “8397ea747d2ab50da4f876a36d631272”, “md6”: “”, “ripemd160”: “”, “sha1”: “48a6d5141e25b6c63ad8da20b954b56afe512031”, “sha224”: “”, “sha256”: “89b5e248c222ebf2cb3b525d3650259e01cf7d8fff5e1aa15ccd7512b1e63957”, “sha384”: “”, “sha512”: “”, “whirlpool”: “”}
name: some.com
size: null		 16107188499162 file
false 8b96c56cbc980c1e3362060ffa953e65281fb1df en domain: some.com
ipv4:
ipv6:
ssl:
url: https://some.com		 16107188498393 network
false 42a9929807fd954918f9bb603135754be7a6e11c en hashes: {“md4”: “”, “md5”: “5d43baf1c9e9e3a939e5defd8f3fbd1d”, “md6”: “”, “ripemd120”: “”, “sha1”: “d5ff73c043f3bb75dd749636307500b60a336150”, “sha224”: “”, “sha256”: “867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc3dd12”, “sha384”: “”, “sha512”: “”, “whirlpool”: “”}
name: 5d43baf1c9e9e3a939e5defd8f8fbd1d
size: null		 16107188498634 file
false 12cad1ca535a92a2ed306c0edf3025e7d9776612 en domain: some.com
ipv4:
ipv6:
ssl:
url: https://some.com		 16107188498908 network

gibti-get-threat-actor-info

Command performs Group-IB event lookup in hi/threat_actor (or in apt/threat_actor if the APT flag is true) collection with provided ID.

Base Command

gibti-get-threat-actor-info

Input

Argument Name Description Required
id GIB internal threatActor ID.
e.g.: 0d4496592ac3a0f5511cd62ef29887f48d9cb545.		 Required
isAPT Is threat actor APT group. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
GIBTIA.ThreatActor.aliases String Threat actor aliases
GIBTIA.ThreatActor.country String Threat actor country
GIBTIA.ThreatActor.createdAt Date Threat actor record creation time
GIBTIA.ThreatActor.description String Threat actor description
GIBTIA.ThreatActor.goals String Threat actor goals sectors(financial, diplomatic, etc.)
GIBTIA.ThreatActor.id String Threat actor id
GIBTIA.ThreatActor.isAPT Boolean Threat actor is APT
GIBTIA.ThreatActor.labels String GIB internal threat actor labels(hacker, nation-state, etc.)
GIBTIA.ThreatActor.langs String Threat actor communication language
GIBTIA.ThreatActor.name String Threat actor name
GIBTIA.ThreatActor.roles String Threat actor roles
GIBTIA.ThreatActor.stat.countries String Threat actor countries activity found in
GIBTIA.ThreatActor.stat.dateFirstSeen Date Date first seen
GIBTIA.ThreatActor.stat.dateLastSeen Date Date last seen
GIBTIA.ThreatActor.stat.regions String Threat actor activity regions
GIBTIA.ThreatActor.stat.reports.datePublished Date Related threat report publishing date
GIBTIA.ThreatActor.stat.reports.id String Related threat report id
GIBTIA.ThreatActor.stat.reports.name.en String Related threat report language
GIBTIA.ThreatActor.stat.sectors String Sectors attacked by threat actor

Command Example

!gibti-get-threat-actor-info id=0d4496592ac3a0f5511cd62ef29887f48d9cb545 isAPT=true

Human Readable Output

Feed from threat_actor with ID 0d4496592ac3a0f5511cd62ef29887f48d9cb545

aliases country createdAt deleted description goals id isAPT isPublished labels langs name roles spokenOnLangs stat countries stat dateFirstSeen stat dateLastSeen stat regions stat sectors stixGuid updatedAt
SectorC08 RU 2018-09-26T16:59:50+03:00 false Big description Information 0d4496592ac3a0f5511cd62ef29887f48d9cb545 true true spy en Gamaredon agent com US 2013-06-01 2021-03-19 asia non-profit 63d0e4d4-9f55-4fa2-87af-b6c91ded80e0 2021-04-08T22:09:07+03:00

stat reports table

datePublished id name
2021-02-04 59dec5947c5adac898445e3958b1d05e1c260459 en: Template injection attacks from the Gamaredon group continued: protocol topics

gibti-get-suspicious-ip-tor-node-info

Command performs Group-IB event lookup in suspicious_ip/tor_node collection with provided ID.

Base Command

gibti-get-suspicious-ip-tor-node-info

Input

Argument Name Description Required
id GIB event id.
e.g.: 109.70.100.46.		 Required

Context Output

Path Type Description
GIBTIA.SuspiciousIPTorNode.ipv4.asn String Tor node ASN
GIBTIA.SuspiciousIPTorNode.ipv4.countryName String Tor node IP country name
GIBTIA.SuspiciousIPTorNode.ipv4.ip String Tor node IP address
GIBTIA.SuspiciousIPTorNode.ipv4.region String Tor node IP region name
GIBTIA.SuspiciousIPTorNode.id String GIB id
GIBTIA.SuspiciousIPTorNode.evaluation.severity String Event severity

Command Example

!gibti-get-suspicious-ip-tor-node-info id=109.70.100.46

Human Readable Output

Feed from suspicious_ip/tor_node with ID 11.11.11.11

dateFirstSeen dateLastSeen evaluation admiraltyCode evaluation credibility evaluation reliability evaluation severity evaluation tlp evaluation ttl id ipv4 ip portalLink source
2020-09-03T14:15:25+00:00 2021-04-25T03:15:29+00:00 A1 90 90 green green 30 11.11.11.11 11.11.11.11 https://group-ib.com/suspicious/tor?searchValue=id:11.11.11.11 some.com

IP indicator

gibid severity value
11.11.11.11 green 11.11.11.11

gibti-get-suspicious-ip-open-proxy-info

Command performs Group-IB event lookup in suspicious_ip/open_proxy collection with provided ID.

Base Command

gibti-get-suspicious-ip-open-proxy-info

Input

Argument Name Description Required
id GIB event id.
e.g.: cc6a2856da2806b03839f81aa214f22dbcfd7369.		 Required

Context Output

Path Type Description
GIBTIA.SuspiciousIPOpenProxy.ipv4.asn String Proxy ASN
GIBTIA.SuspiciousIPOpenProxy.ipv4.countryName String Proxy IP country name
GIBTIA.SuspiciousIPOpenProxy.ipv4.ip String Proxy IP address
GIBTIA.SuspiciousIPOpenProxy.ipv4.region String Proxy IP region name
GIBTIA.SuspiciousIPOpenProxy.ipv4.port Number Proxy port
GIBTIA.SuspiciousIPOpenProxy.ipv4.source String Information source
GIBTIA.SuspiciousIPOpenProxy.ipv4.anonymous String Proxy anonymous level
GIBTIA.SuspiciousIPOpenProxy.id String GIB event ID
GIBTIA.SuspiciousIPOpenProxy.evaluation.severity String Event severity

Command Example

!gibti-get-suspicious-ip-open-proxy-info id=cc6a2856da2806b03839f81aa214f22dbcfd7369

Human Readable Output

Feed from suspicious_ip/open_proxy with ID cc6a2856da2806b03839f81aa214f22dbcfd7369

anonymous dateDetected dateFirstSeen evaluation admiraltyCode evaluation credibility evaluation reliability evaluation severity evaluation tlp evaluation ttl id ipv4 countryCode ipv4 countryName ipv4 ip ipv4 provider oldId port portalLink source stixGuid type
11.11.11.11 2021-01-21T11:01:02+00:00 2020-03-19T23:01:01+00:00 C3 50 50 green white 15 cc6a2856da2806b03839f81aa214f22dbcfd7369 Country Code Country 11.11.11.11 Some 241549215 80 https://group-ib.com/suspicious/proxies?searchValue=id:cc6a2856da2806b03839f81aa214f22dbcfd7369 some.com c30604ac-94d5-b514-f1d1-7230ec13c739 http

IP indicator

geocountry gibid gibproxyanonymous gibproxyport severity source value
Country cc6a2856da2806b03839f81aa214f22dbcfd7369 11.11.11.11 80 green some.com 11.11.11.11

gibti-get-suspicious-ip-socks-proxy-info

Command performs Group-IB event lookup in suspicious_ip/socks_proxy collection with provided ID.

Base Command

gibti-get-suspicious-ip-socks-proxy-info

Input

Argument Name Description Required
id GIB event id.
e.g.: 02e385600dfc5bf9b3b3656df8e0e20f5fc5c86e.		 Required

Context Output

Path Type Description
GIBTIA.SuspiciousIPSocksProxy.ipv4.asn String Proxy IP ASN
GIBTIA.SuspiciousIPSocksProxy.ipv4.countryName String Proxy IP country name
GIBTIA.SuspiciousIPSocksProxy.ipv4.ip String Proxy IP address
GIBTIA.SuspiciousIPSocksProxy.ipv4.region String Proxy IP region name
GIBTIA.SuspiciousIPSocksProxy.id String GIB ID
GIBTIA.SuspiciousIPSocksProxy.evaluation.severity String Event severity

Command Example

!gibti-get-suspicious-ip-socks-proxy-info id=02e385600dfc5bf9b3b3656df8e0e20f5fc5c86e

Human Readable Output

Feed from suspicious_ip/socks_proxy with ID 02e385600dfc5bf9b3b3656df8e0e20f5fc5c86e

dateDetected dateFirstSeen dateLastSeen evaluation admiraltyCode evaluation credibility evaluation reliability evaluation severity evaluation tlp evaluation ttl id ipv4 asn ipv4 countryCode ipv4 countryName ipv4 ip ipv4 provider oldId portalLink source stixGuid
2021-01-19T07:41:11+00:00 2021-01-19T07:41:11+00:00 2021-02-23T20:58:51+00:00 A1 100 90 green amber 2 02e385600dfc5bf9b3b3656df8e0e20f5fc5c86e AS11111 Country Code Country 11.11.11.11 Some 395880626 https://group-ib.com/suspicious/socks?searchValue=id:02e385600dfc5bf9b3b3656df8e0e20f5fc5c86e awmproxy.com 78cd5f78-e542-bf2c-fc40-e2a41b36dd97

IP indicator

asn geocountry gibid severity value
AS11111 Country 02e385600dfc5bf9b3b3656df8e0e20f5fc5c86e green 11.11.11.11

gibti-get-malware-cnc-info

Command performs Group-IB event lookup in malware/cnc collection by provided ID.

Base Command

gibti-get-malware-cnc-info

Input

Argument Name Description Required
id GIB event id.
e.g.: aeed277396e27e375d030a91533aa232444d0089.		 Required

Context Output

Path Type Description
GIBTIA.MalwareCNC.dateDetected Date Date CNC detected
GIBTIA.MalwareCNC.dateLastSeen Date Date CNC last seen
GIBTIA.MalwareCNC.url String CNC URL
GIBTIA.MalwareCNC.domain String CNC domain
GIBTIA.MalwareCNC.ipv4.asn String CNC ASN
GIBTIA.MalwareCNC.ipv4.countryName String CNC IP country name
GIBTIA.MalwareCNC.ipv4.ip String CNC IP address
GIBTIA.MalwareCNC.ipv4.region String CNC region name
GIBTIA.MalwareCNC.malwareList.name String Associated malware
GIBTIA.MalwareCNC.threatActor.id String Associated threat actor ID
GIBTIA.MalwareCNC.threatActor.name String Associated threat actor
GIBTIA.MalwareCNC.threatActor.isAPT Boolean Is APT or not
GIBTIA.MalwareCNC.id String GIB event ID

Command Example

!gibti-get-malware-cnc-info id=aeed277396e27e375d030a91533aa232444d0089

Human Readable Output

Feed from malware/cnc with ID aeed277396e27e375d030a91533aa232444d0089

cnc dateDetected dateLastSeen domain id oldId stixGuid url
««««««««««««««««https://some.com»»»»»»»»»»»»»»»» 2021-04-25T13:37:23+00:00 2021-04-25T13:37:23+00:00 some.com aeed277396e27e375d030a91533aa232444d0089 211146923 417b2644-1105-d65b-4b67-a78e82f59b65 https://some.com

ipv4 table

asn countryCode countryName ip provider
AS1111 US United States 11.11.11.11 Some

malwareList table

id name stixGuid
e99c294ffe7b79655d6ef1f32add638d8a2d4b24 JS Sniffer - Poter 1ac5a303-ef6f-2d6a-ad20-a39196815a1a

URL indicator

gibid value
aeed277396e27e375d030a91533aa232444d0089 https://some.com

Domain indicator

gibid value
aeed277396e27e375d030a91533aa232444d0089 some.com

IP indicator

asn geocountry gibid value
AS1111 United States aeed277396e27e375d030a91533aa232444d0089 11.11.11.11

gibti-get-available-collections

Returns list of available collections.

Base Command

gibti-get-available-collections

Input

There are no input arguments for this command.

Context Output

Path Type Description
GIBTIA.OtherInfo.collections String List of availiable collections

Command Example

!gibti-get-available-collections

Human Readable Output

Available collections

collections
compromised/account,
compromised/card,
bp/phishing,
bp/phishing_kit,
osi/git_leak,
osi/public_leak,
malware/targeted_malware,
compromised/mule,
compromised/imei,
attacks/ddos,
attacks/deface,
attacks/phishing,
attacks/phishing_kit,
apt/threat,
hi/threat,
suspicious_ip/tor_node,
suspicious_ip/open_proxy,
suspicious_ip/socks_proxy,
malware/cnc,
osi/vulnerability,
hi/threat_actor,
apt/threat_actor

gibti-global-search

Command performs global Group-IB search

Base Command

gibti-global-search

Input

Argument Name Description Required
query Query you want to search.
e.g.: 8.8.8.8.		 Required

Context Output

Path Type Description
apiPath String Name of collection in which found matches
count Number Count of feeds matching this query
GIBLink String Link to GIB TI&A interface

Command Example

!gibti-global-search query=100.100.100.100

Human Readable Output

Search results

apiPath count GIBLink
compromised/account 14  
attacks/phishing 1 https://group-ib.com/attacks/phishing?searchValue=100.100.100.100&q=100.100.100.100
bp/phishing 1  
osi/git_leak 5 https://group-ib.com/osi/git_leaks?searchValue=100.100.100.100&q=100.100.100.100
osi/public_leak 23 https://group-ib.com/osi/public_leak?searchValue=100.100.100.100&q=100.100.100.100

gibtia-local-search

Command performs Group-IB search in selected collection.

Base Command

gibtia-local-search

Input

Argument Name Description Required
collection_name Collection you want to search. Possible values are same as collection names in Data Collections Overview . Required
query Query you want to search.
e.g.: 8.8.8.8.		 Required

Context Output

Path Type Description
GIBTI.search.local.id String Id of a feed that matches a query
GIBTI.search.local.additional_info String Additional info about feed
GIBTI.search.local.seqUpdate Number seqUpdate value of the page/portion that returned the feed
GIBTI.search.local.raw_feed String One-line JSON string of the full feed for War Room rendering (only when include_raw_feed=true)

Command Example

!gibtia-local-search collection_name=attacks/phishing query=100.100.100.100

Human Readable Output

Search results

id additional_info
8bd7e5cef2290b0c3f04bf283586406dceffe25d phishingDomain_domain: some.com

Configuration parameters

  • url — GIB TI URL (required)
  • credentials — Username (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integration_reliability — Source Reliability (required)
  • disable_integration_reliability_override — Ignore Source Reliability override
  • enabled_reputation_commands — Enable reputation commands
  • isFetch — Fetch incidents
  • incident_collections — Collections to fetch
  • first_fetch — Incidents first fetch
  • exclude_combolist — Exclude All with Combolist type
  • combolist — Include combolist type in data
  • unique — Include unique type in data
  • enable_probable_corporate_access — Enable filter "Probable Corporate Access"
  • max_fetch — Number of requests per collection
  • skip_updated_incidents — Skip updated incidents (prevent duplicates)
  • dedup_lookback_days — Deduplication lookback (days)
  • limit — Limit (items per request)
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • hunting_rules — Hunting Rules

Commands (51)

  • domain

    Runs reputation on domains.

  • file

    Runs reputation on files.

  • gibti-get-attacks-ddos-info

    Command performs Group IB event lookup in attacks/ddos collection with provided ID.

  • gibti-get-attacks-deface-info

    Command performs Group IB event lookup in attacks/deface collection with provided ID.

  • gibti-get-available-collections

    Returns list of available collections.

  • gibti-get-compromised-account-info

    Command performs Group IB event lookup in compromised/account collection with provided ID.

  • gibti-get-compromised-breached-info

    Command performs Group IB event lookup in compromised/breached collection with provided ID.

  • gibti-get-compromised-card-group-info

    Command performs Group IB event lookup in compromised/bank_card_group collection by provided ID.

  • gibti-get-compromised-masked-card-info

    Command performs Group IB event lookup in compromised/masked_card collection by provided ID.

  • gibti-get-compromised-mule-info

    Command performs Group IB event lookup in compromised/mule collection with provided ID.

  • gibti-get-compromised-spd-info

    Command performs Group IB event lookup in compromised/spd (suspicious payment details) collection with provided ID.

  • gibti-get-malware-cnc-info

    Command performs Group IB event lookup in malware/cnc collection by provided ID.

  • gibti-get-malware-malware-info

    Command performs Group IB event lookup in malware/malware collection by provided ID.

  • gibti-get-osi-git-leak-info

    Command performs Group IB event lookup in osi/git_leak collection with provided ID.

  • gibti-get-osi-public-leak-info

    Command performs Group IB event lookup in osi/public_leak collection with provided ID.

  • gibti-get-osi-vulnerability-info

    Command performs Group IB event lookup in osi/vulnerability collection with provided ID.

  • gibti-get-phishing-group-info

    Command performs Group IB event lookup in attacks/phishing_group collection by provided ID.

  • gibti-get-suspicious-ip-open-proxy-info

    Command performs Group IB event lookup in suspicious_ip/open_proxy collection with provided ID.

  • gibti-get-suspicious-ip-scanner-info

    Command performs Group IB event lookup in suspicious_ip/scanner collection by provided ID.

  • gibti-get-suspicious-ip-socks-proxy-info

    Command performs Group IB event lookup in suspicious_ip/socks_proxy collection with provided ID.

  • gibti-get-suspicious-ip-tor-node-info

    Command performs Group IB event lookup in suspicious_ip/tor_node collection with provided ID.

  • gibti-get-suspicious-ip-vpn-info

    Command performs Group IB event lookup in suspicious_ip/vpn collection by provided ID.

  • gibti-get-threat-actor-info

    Command performs Group IB event lookup in hi/threat_actor (or in apt/threat_actor if the APT flag is true) collection with provided ID.

  • gibti-get-threat-info

    Command performs Group IB event lookup in hi/threat (or in apt/threat if the APT flag is true) collection with provided ID.

  • gibti-global-search

    Command performs global Group IB search.

  • gibti-ip-scoring

    Returns Group-IB scoring for IPs (numeric and DBotScore).

  • gibti-local-search

    Command performs Group IB search in selected collection.

  • gibtia-get-attacks-ddos-info

    Command performs Group IB event lookup in attacks/ddos collection with provided ID.

  • gibtia-get-attacks-deface-info

    Command performs Group IB event lookup in attacks/deface collection with provided ID.

  • gibtia-get-available-collections

    Returns list of available collections.

  • gibtia-get-compromised-account-info

    Command performs Group IB event lookup in compromised/account collection with provided ID.

  • gibtia-get-compromised-breached-info

    Command performs Group IB event lookup in compromised/breached collection with provided ID.

  • gibtia-get-compromised-card-group-info

    Command performs Group IB event lookup in compromised/bank_card_group collection by provided ID.

  • gibtia-get-compromised-mule-info

    Command performs Group IB event lookup in compromised/mule collection with provided ID.

  • gibtia-get-compromised-spd-info

    Command performs Group IB event lookup in compromised/spd (suspicious payment details) collection with provided ID.

  • gibtia-get-malware-cnc-info

    Command performs Group IB event lookup in malware/cnc collection by provided ID.

  • gibtia-get-malware-malware-info

    Command performs Group IB event lookup in malware/malware collection by provided ID.

  • gibtia-get-osi-git-leak-info

    Command performs Group IB event lookup in osi/git_leak collection with provided ID.

  • gibtia-get-osi-public-leak-info

    Command performs Group IB event lookup in osi/public_leak collection with provided ID.

  • gibtia-get-osi-vulnerability-info

    Command performs Group IB event lookup in osi/vulnerability collection with provided ID.

  • gibtia-get-phishing-group-info

    Command performs Group IB event lookup in attacks/phishing_group collection by provided ID.

  • gibtia-get-suspicious-ip-open-proxy-info

    Command performs Group IB event lookup in suspicious_ip/open_proxy collection with provided ID.

  • gibtia-get-suspicious-ip-scanner-info

    Command performs Group IB event lookup in suspicious_ip/scanner collection by provided ID.

  • gibtia-get-suspicious-ip-socks-proxy-info

    Command performs Group IB event lookup in suspicious_ip/socks_proxy collection with provided ID.

  • gibtia-get-suspicious-ip-tor-node-info

    Command performs Group IB event lookup in suspicious_ip/tor_node collection with provided ID.

  • gibtia-get-suspicious-ip-vpn-info

    Command performs Group IB event lookup in suspicious_ip/vpn collection by provided ID.

  • gibtia-get-threat-actor-info

    Command performs Group IB event lookup in hi/threat_actor (or in apt/threat_actor if the APT flag is true) collection with provided ID.

  • gibtia-get-threat-info

    Command performs Group IB event lookup in hi/threat (or in apt/threat if the APT flag is true) collection with provided ID.

  • gibtia-global-search

    Command performs global Group IB search.

  • gibtia-local-search

    Command performs Group IB search in selected collection.

  • ip

    Runs reputation on IPs.

Source

GroupIBTIA.py GroupIBTIA_test.py GroupIBTIA.yml GroupIBTIA_description.md command_examples.txt
Download History Raw 
# Group-IB Threat Intelligence

This section provides step-by-step instructions for configuring the Group-IB Threat Intelligence integration instance in Cortex XSOAR.

## Prerequisites

1. **Access Group-IB Threat Intelligence (TI) Web Interface**
   - Open the Group-IB TI platform at [https://tap.group-ib.com](https://tap.group-ib.com)

2. **Generate API Credentials**
   - In the web interface, click your name in the upper right corner
   - Select **Profile** → **Security and Access** tab
   - Click **Personal token** and follow the instructions to generate your API token
   - **Note**: The API token serves as your password for authentication

3. **Network Configuration**
   - **Important**: Contact Group-IB support to add your Cortex XSOAR server's IP address to the allow list
   - If you are using a proxy, provide the public IP address of the proxy server instead
   - Make sure you have added Group-IB [API IPs/URLs](https://tap.group-ib.com/hc/api?scope=integrations&q=en%2FIntegrations%2FStarting%20Guide%2FInitial%20Steps%2FInitial%20Steps) to you FW/Proxy rules.

## Configuration Steps

1. **Configure Connection Settings**
   - **GIB TI URL**: Enter your Group-IB TI web interface URL (default: `https://tap.group-ib.com/api/v2/`)
   - **Username**: Enter the email address you use to log into the web interface
   - **Password**: Enter your API token (Personal token) generated in step 2

2. **Configure Collection Parameters**

   - **Collections to fetch**: Select the collections you want to fetch incidents from. See the [Collections Overview documentation](https://tap.group-ib.com/hc/api?scope=integrations&q=en%2FIntegrations%2FCollections%20Overview%2FCollections%20Overview). `compromised/masked_card` is supported as a dedicated collection.
   - **Incidents first fetch**: Specify the date range for initial data fetch (default: "3 days")
   - **Number of requests per collection**: Number of API requests per collection in each fetch iteration (default: 3)
   - **Skip updated incidents (prevent duplicates)**: Disabled by default. Enable this only when the integration itself should suppress duplicate incidents because Pre-Processing Rules do not work reliably or cannot be used operationally in your environment
   - **Deduplication lookback (days)**: How many days fetched incident IDs are remembered in the built-in deduplication cache while **Skip updated incidents (prevent duplicates)** is enabled. Recommended value is `365` days
   - **Limit (items per request)**: Specifies the number of records fetched per API request
     - This limit applies to **all collections** configured in the integration instance
     - For optimal performance, check the [official API Limitations documentation](https://tap.group-ib.com/hc/api?scope=integrations&q=en%2FIntegrations%2FStarting%20Guide%2FAPI%20Limitations%2FAPI%20Limitations) for recommended limit values per collection
   - **Best practice**: Create separate integration instances for different collections or groups of collections with similar optimal limit values
   - **Example**: If "Number of requests per collection" is set to 2 and the limit is 500, the integration will fetch up to 1000 records per collection per fetch cycle (2 requests × 500 records each)
   - **Hunting Rules**: Enable to collect data using hunting rules
   - **Enable reputation commands**: Optional multi-select list of reputation commands to enable for this integration instance (supported: ip, domain, file). **Default: none enabled** (fail-safe). Only selected commands perform enrichment and return DBotScore.

   **Collection-Specific Filters** (apply only to `compromised/account_group`). The following three filters control data collection behavior for the `compromised/account_group` collection:
   - **Note**: These filters have no effect on other collections
   - **Include unique type in data**: Filter to include unique data from the compromised/account_group collection
   - **Include combolist type in data**: Filter to include combolist data from the compromised/account_group collection
   - **Enable filter "Probable Corporate Access"**: Filter to limit data collection to only corporate accounts
   - **Filter Logic** (applies to unique and combolist filters):
     - If **both** `Include unique type in data` and `Include combolist type in data` are **disabled**: No filtering is applied, and both types of data are collected
     - If **only** `Include unique type in data` is **enabled**: Only unique records are collected
     - If **only** `Include combolist type in data` is **enabled**: Only combolist records are collected
     - If **both** `Include unique type in data` and `Include combolist type in data` are **enabled**: Both types of data are collected
     - When both unique and combolist filters are **not enabled** (no checkboxes selected): Both unique and combolist data types are collected by default (as stated above). In this state, you can enable `Enable filter "Probable Corporate Access"` to limit the entire feed (both unique and combolist data) to only corporate accounts. You can also combine the corporate access filter with unique or combolist filters, if needed. For example, if you are collecting **only combolist** data (without unique), you can enable `Enable filter "Probable Corporate Access"` to limit the combolist collection to only corporate accounts
   - **Best Practice**: For optimal organization and performance, consider running **two separate integration instances**:
       - **Instance 1**: Enable `Include unique type in data` only
       - **Instance 2**: Enable `Include combolist type in data` only
       - **Instance 3** (optional): Enable 'Probable Corporate Access' - if you need to focus on your company employees compromises only

3. **Configure Classifier and Mapper**
   - Set up the classifier and mapper using the 'Group-IB Threat Intelligence' classifier and mapper, or configure your own custom classifier and mapper as needed

4. **Built-In Deduplication and Optional Pre-Processing Rules**
   - The integration now includes an optional built-in fetch-time deduplication layer
   - This built-in deduplication layer is primarily intended for environments where Pre-Processing Rules are unreliable, unavailable, or operationally difficult to maintain
   - Recommended production configuration:
     - Keep **Skip updated incidents (prevent duplicates)** disabled unless Pre-Processing Rules are not working reliably in your environment
     - Set **Deduplication lookback (days)** to `365` so the integration remembers incident IDs for a long enough period
     - If you rely on Pre-Processing Rule based update propagation, enable the appropriate rule/script combination explicitly
   - Optional fallback workflow:
     - Disable **Skip updated incidents (prevent duplicates)** if you want updated Group-IB records to be re-ingested
     - Navigate to **Settings** → **Integrations** → **Pre-Processing Rules**
     - Enable or create a rule with the following configuration:
       - **Conditions**:
         - `gibid Is not empty (General)`
       - **Action**: Run a script
       - **Script**: Select `GIBIncidentUpdateAllTypes`
   - Behavior summary:
     - If **Skip updated incidents (prevent duplicates)** is enabled and **Deduplication lookback (days)** is greater than `0`, the integration stores fetched Group-IB incident IDs in fetch state and skips future re-sends of the same IDs during that retention window
     - If **Skip updated incidents (prevent duplicates)** is disabled, the lookback setting is ignored and the integration allows re-ingestion of updated incidents, so a Pre-Processing Rule can update an existing incident instead

## Recommended Instance Layout

Use separate integration instances for the following groups:

- Accounts unique
- Accounts combolist
- Cards (masked/unmasked)
- Public leaks/Git Leaks
- Breached
- Vulnerabilities
- Malware reports and threats including profiles
- SPD
- Suspicious IP
- Malware CNC
- DDoS/Deface/phishing/phishing_kit

## Reputation Commands (ip / domain / file)

This integration implements the standard Cortex XSOAR reputation commands:

- `ip`
- `domain`
- `file`

### Required: use a dedicated instance for reputation

We recommend using a **dedicated** integration instance for reputation commands, such as **Group-IB Threat Intelligence (Partner Contribution)**.

### Enabling reputation commands

Reputation commands are **disabled by default** to avoid unexpected auto-enrichment side effects.
To enable them, configure the integration instance parameter **Enable reputation commands** and select the command types you want to allow (`ip`, `domain`, `file`).

### Source Reliability and override behavior

The integration supports **two reliability modes** for reputation commands:

- **Instance override mode (fixed reliability)**:
  - Controlled by the instance parameter **Source Reliability**.
  - When **Ignore Source Reliability override** is **disabled** (unchecked), the integration will attach the configured **Source Reliability** value to **every reputation response**, regardless of indicator-specific findings.

- **Integration-calculated reliability mode (dynamic reliability)**:
  - Enabled by the instance parameter **Ignore Source Reliability override**.
  - When **Ignore Source Reliability override** is **enabled** (checked), the integration ignores the instance **Source Reliability** value and calculates reliability per indicator based on the collections that returned matches (see rules below).

### Score (DBotScore) calculation rules

Score and reliability are calculated independently.

#### `file` score rules

- **BAD**: at least one match in `ioc/common`
- **UNKNOWN (NONE)**: no matches

Note: For `file` reputation, the integration evaluates **only** the `ioc/common` collection for score.

#### `domain` score rules

The integration uses a **3-year recency window** and the following date fields:

- `ioc/common.dateLastSeen`
- `hi/open_threats.detected`
- `attacks/deface.date`

Rules (evaluated top-to-bottom):

- **BAD**: `ioc/common` match with `dateLastSeen` within the last 3 years
- **SUSPICIOUS**: `hi/open_threats` or `attacks/deface` match with a date within the last 3 years
- **SUSPICIOUS**: `ioc/common` has records but `dateLastSeen` is missing or older than 3 years
- **UNKNOWN (NONE)**: no findings (no matches in `ioc/common`, `hi/open_threats`, `attacks/deface`)

#### `ip` score rules

The integration maps the numeric Group-IB `riskScore` (0..100) to DBotScore:

- **GOOD**: 0..49
- **SUSPICIOUS**: 50..84
- **BAD**: 85..100
- **UNKNOWN (NONE)**: score is missing or out of range

### Reliability calculation rules (only when Ignore Source Reliability override is enabled)

When the integration-calculated reliability mode is enabled, reliability is computed as follows:

#### `file` reliability rules

- **A - Completely reliable**: at least one match in `ioc/common`
- **None**: no matches

#### `domain` and `ip` reliability rules

Reliability is derived from which collections returned matches:

- **A - Completely reliable**:
  - any match in `apt/threat` or `apt/threat_actor`, or
  - any match in `ioc/common`

- **B - Usually reliable**:
  - any match in `attacks/deface`, or
  - any match in `hi/open_threats`

Final selection logic:

- If there is at least one **A - Completely reliable** source → reliability is **A - Completely reliable**
- Else if there is at least one **B - Usually reliable** source → reliability is **B - Usually reliable**
- Else → reliability is **None**

## Additional Resources

For detailed information about collections, their structure, available fields, and recommended date ranges, refer to the [Collections Overview](https://tap.group-ib.com/hc/api?scope=integrations&q=en%2FIntegrations%2FCollections%20Overview%2FCollections%20Overview).