Group-IB Threat Intelligence v3.0.1
Group-IB Threat Intelligence is a system for analyzing and attributing cyberattacks, threat hunting, and protecting network infrastructure based on data relating to adversary tactics, tools, and activity. Use this pack to fast receive incidents related to you, attribute them to adversaries to do instant response, enrich your security with an enormous IOCs collection, and provide possibilities for manual investigation through Group-IB data via Cortex XSOAR interface.
- Author:
- Group-IB
- Support:
- partner
agentixxsiam
Data Enrichment & Threat Intelligence
Incident fields (269)
- GIB Address
- GIB Admiralty Code
- GIB Affected Software Table
- GIB Base Name
- GIB Bulletin Family
- GIB CNC
- GIB CNC ASN
- GIB CNC City
- GIB CNC Country Code
- GIB CNC Country Name
- GIB CNC Domain
- GIB CNC IP
- GIB CNC Port
- GIB CNC Provider
- GIB CNC Region
- GIB CNC URL
- GIB CPE Table
- GIB CVSS Score
- GIB CVSS Vector
- GIB CVV
- GIB Card BIN
- GIB Card Category
- GIB Card Dump
- GIB Card Issuer
- GIB Card Issuer Country Code
- GIB Card Issuer Country Name
- GIB Card Number
- GIB Card PIN
- GIB Card Type
- GIB Card Valid Thru
- GIB Card Valid Thru Date
- GIB Client ASN
- GIB Client City
- GIB Client Country Code
- GIB Client Country Name
- GIB Client IP
- GIB Client Provider
- GIB Client Region
- GIB Compromised Account
- GIB Compromised Events Information Table
- GIB Compromised Events Table
- GIB Compromised Login
- GIB Country Code
- GIB Country Name
- GIB Credibility
- GIB Cybercriminal Expertises
- GIB Cybercriminal Forums Table
- GIB Cybercriminal Malware
- GIB Cybercriminal Regions
- GIB Cybercriminal Sectors
- GIB Cybercriminal Threat Actor Aliases
- GIB Cybercriminal Threat Actor Description
- GIB Cybercriminal Threat Actor Report Authors
- GIB Cybercriminal Threat Actor Reports Table
- GIB Cybercriminal Threat Description
- GIB Cybercriminal Threat Title
- GIB DDOS Date Begin
- GIB DDOS Date End
- GIB DDOS Date Registration
- GIB DDOS Duration
- GIB DDOS Protocol
- GIB DDOS Request Body
- GIB DDOS Request Body Hash
- GIB DDOS Request Data Link
- GIB DDOS Request Headers Body
- GIB DDOS Request Headers Hash
- GIB DDOS Source
- GIB DDOS Target ASN
- GIB DDOS Target Category
- GIB DDOS Target City
- GIB DDOS Target Country Code
- GIB DDOS Target Country Name
- GIB DDOS Target Domain
- GIB DDOS Target IP
- GIB DDOS Target Port
- GIB DDOS Target Provider
- GIB DDOS Target Region
- GIB DDOS Target URL
- GIB DDOS Type
- GIB Data Hash
- GIB Date Add
- GIB Date Compromised
- GIB Date Created
- GIB Date Created At
- GIB Date Expired
- GIB Date First Compromised
- GIB Date First Seen
- GIB Date Incident
- GIB Date Last Compromised
- GIB Date Last Seen
- GIB Date Modified
- GIB Date Published
- GIB Date Updated At
- GIB Date of Detection
- GIB Deface Contacts
- GIB Deface Date
- GIB Deface Site URL
- GIB Deface Source
- GIB Downloaded From
- GIB Downloaded From Table
- GIB Drop Email
- GIB Drop Email Domain
- GIB Email
- GIB Email Domains
- GIB Emails
- GIB Extended CVSS Base
- GIB Extended CVSS Exploitability
- GIB Extended CVSS Impact
- GIB Extended CVSS Overall
- GIB Extended CVSS Temporal
- GIB Extended Description
- GIB Favicon
- GIB GIT Source
- GIB HTML
- GIB Has Exploit
- GIB Href
- GIB ID
- GIB Inject Dump
- GIB Inject MD5
- GIB Is Dump
- GIB Is Expired
- GIB Is Masked
- GIB Is Tailored
- GIB Leak Name
- GIB Leak Published
- GIB Leaked Data
- GIB Leaked File Name
- GIB Link List
- GIB Link List Table
- GIB Malware Aliases
- GIB Malware CNC Domain
- GIB Malware Categories
- GIB Malware Description
- GIB Malware File hash
- GIB Malware ID
- GIB Malware Langs
- GIB Malware Name
- GIB Malware Platforms
- GIB Malware Regions
- GIB Malware STIX GUID
- GIB Malware Short Description
- GIB Malware Source Countries
- GIB Malware Table
- GIB Matches
- GIB Matches Table
- GIB Merged Cvss
- GIB Mirror Link
- GIB Name Servers
- GIB Nation-State Cybercriminal Forums Table
- GIB Nation-State Cybercriminals Expertises
- GIB Nation-State Cybercriminals Malware
- GIB Nation-State Cybercriminals Regions
- GIB Nation-State Cybercriminals Sectors
- GIB Nation-State Cybercriminals Threat Actor Aliases
- GIB Nation-State Cybercriminals Threat Actor CVE
- GIB Nation-State Cybercriminals Threat Actor Country
- GIB Nation-State Cybercriminals Threat Actor Description
- GIB Nation-State Cybercriminals Threat Actor Goals
- GIB Nation-State Cybercriminals Threat Actor Labels
- GIB Nation-State Cybercriminals Threat Actor Reports Table
- GIB Nation-State Cybercriminals Threat Actor Roles
- GIB Nation-State Cybercriminals Threat Countries
- GIB Nation-State Cybercriminals Threat Description
- GIB Nation-State Cybercriminals Threat Expertises
- GIB Nation-State Cybercriminals Threat Langs
- GIB Nation-State Cybercriminals Threat Regions
- GIB Nation-State Cybercriminals Threat Report Number
- GIB Nation-State Cybercriminals Threat Sectors
- GIB Nation-State Cybercriminals Threat Title
- GIB OSI Git Repository Files Table
- GIB Organization BIC
- GIB Organization BSB
- GIB Organization CLABE
- GIB Organization IBAN
- GIB Organization Name
- GIB Organization SWIFT
- GIB Owner Birthday
- GIB Owner City
- GIB Owner Country Code
- GIB Owner Passport
- GIB Owner State
- GIB Owner Tax Number
- GIB Owner ZIP
- GIB Parsed Login Domain
- GIB Parsed Login IP
- GIB Password
- GIB Passwords
- GIB Payment System
- GIB Person
- GIB Phishing Brand
- GIB Phishing Date Added
- GIB Phishing Date Blocked
- GIB Phishing Date Detected
- GIB Phishing Date Updated
- GIB Phishing Domain
- GIB Phishing Domain Expiration Date
- GIB Phishing Domain Puny
- GIB Phishing IP Table
- GIB Phishing Kit Email
- GIB Phishing Kit Emails
- GIB Phishing Kit Hash
- GIB Phishing Kit Path
- GIB Phishing Kit Source
- GIB Phishing Kit Table
- GIB Phishing Objectives
- GIB Phishing Registrar
- GIB Phishing Sources
- GIB Phishing Status
- GIB Phishing Type
- GIB Phishing URLs
- GIB Portal Link
- GIB Price Currency
- GIB Price Value
- GIB Provider Domain
- GIB Proxy Port
- GIB Proxy Source
- GIB Proxy Sources
- GIB Proxy Type
- GIB Related Indicators Data
- GIB Reliability
- GIB Report Number
- GIB Reporter
- GIB Repository
- GIB Revisions
- GIB SPD Events Table
- GIB SPD Illegal Score
- GIB SPD Malware Table
- GIB SPD Owner Name
- GIB SPD Service Type
- GIB SPD Sources Table
- GIB SPD Threat Actor Table
- GIB SPD Type
- GIB SPD Value
- GIB Scanner Categories
- GIB Scanner Sources
- GIB Screenshot
- GIB Service Domain
- GIB Service IP
- GIB Service URL
- GIB Severity
- GIB Socks Proxy Source
- GIB Source
- GIB Source Link
- GIB TLP
- GIB TTL
- GIB Target ASN
- GIB Target Brand
- GIB Target Category
- GIB Target City
- GIB Target Domain
- GIB Target Domain Provider
- GIB Target IP
- GIB Target Provider
- GIB Target Region
- GIB Threat Actor Country
- GIB Threat Actor ID
- GIB Threat Actor Name
- GIB Threat Actor STIX GUID
- GIB Threat Actor is APT
- GIB Threat Actors Table
- GIB Threat Level
- GIB Title
- GIB Track
- GIB Update Time
- GIB Upload Time
- GIB VPN Names
- GIB VPN Sources
- GIB Victim IP
- GIB Vulnerability Type
Incident types (30)
- GIB APT Threat
- GIB Attacks DDOS
- GIB Attacks Deface
- GIB Attacks Phishing Group
- GIB Attacks Phishing Kit
- GIB Brand Protection Phishing
- GIB Brand Protection Phishing Kit
- GIB Compromised Account
- GIB Compromised Account Group
- GIB Compromised Card
- GIB Compromised Card Group
- GIB Compromised Masked Card
- GIB Compromised Mule
- GIB Cybercriminal Threat
- GIB Cybercriminal Threat Actor
- GIB Data Breach
- GIB Malware
- GIB Malware CNC
- GIB Nation-State Cybercriminals Threat
- GIB Nation-State Cybercriminals Threat Actor
- GIB OSI Git Leak
- GIB OSI Public Leak
- GIB OSI Vulnerability
- GIB SPD
- GIB Suspicious IP Open Proxy
- GIB Suspicious IP Scanner
- GIB Suspicious IP Socks Proxy
- GIB Suspicious IP TOR Node
- GIB Suspicious IP VPN
- GIB Targeted Malware
Indicator fields (21)
- GIB Admiralty Code
- GIB CVSS Vector
- GIB Collection
- GIB Credibility
- GIB Date Compromised
- GIB File Name
- GIB Hash
- GIB ID
- GIB Malware Name
- GIB Phishing Title
- GIB Proxy Anonymous
- GIB Proxy Port
- GIB Reliability
- GIB Severity
- GIB Software Mixed
- GIB Target Brand
- GIB Target Category
- GIB Target Domain
- GIB Threat Actor ID
- GIB Threat Actor Name
- GIB Threat Actor is APT
Indicator types (3)
- reputation-GIB_Compromised_IMEI
- reputation-GIB_Compromised_Mule
- reputation-GIB_Victim_IP
Integrations (2)
Layouts (32)
- GIB APT Threat Layout
- GIB Attacks DDOS Layout
- GIB Attacks Deface Layout
- GIB Attacks Phishing Group Layout
- GIB Attacks Phishing Kit Layout
- GIB Brand Protection Phishing Kit Layout
- GIB Brand Protection Phishing Layout
- GIB Compromised Account Group Layout
- GIB Compromised Account Layout
- GIB Compromised Card Group Layout
- GIB Compromised Card Layout
- GIB Compromised IMEI Layout
- GIB Compromised Masked Card Layout
- GIB Compromised Mule Layout
- GIB Cybercriminal Threat Actor Layout
- GIB Cybercriminal Threat Layout
- GIB Data Breach Layout
- GIB Malware CNC Layout
- GIB Malware Layout
- GIB Nation-State Cybercriminals Threat Actor Layout
- GIB Nation-State Cybercriminals Threat Layout
- GIB OSI Git Leak Layout
- GIB OSI Public Leak Layout
- GIB OSI Vulnerability Layout
- GIB SPD Layout
- GIB Suspicious IP Open Proxy Layout
- GIB Suspicious IP Scanner Layout
- GIB Suspicious IP Socks Proxy Layout
- GIB Suspicious IP TOR Node Layout
- GIB Suspicious IP VPN Layout
- GIB Targeted Malware Layout
- GIB Victim IP Layout
Pre process rules (2)
- GIB Rule
- GIB Rule All Types
README
Nowadays businesses in any sphere may have problems with their cybersecurity: from simple phishing to professional cybercriminals, so it is very important to respond to incidents quickly.
Group-IB Threat Intelligence Pack can help you with managing your incident and indicators from Group-IB within the SOAR system.
What does this pack do?
- Receive incidents and attribute them to adversaries.
- Enrich security system with IOCs.
- Provide possibilities for manual investigation through Group-IB data via Cortex XSOAR interface.
As part of this pack, you will also get incident types, fields, and layouts; indicator types, fields, and layouts; the classifier and mapper for properly delivering data to these types and fields. Also, you will get a playbook, that enriches incidents, upcoming from Group-IB with threat reports and threat actor information.
