GIB Rule All Types

Group-IB Threat Intelligence Enabled

Details

IDgib_rule_all_types
ActionScript
Links Tooldest
ScriptGIBIncidentUpdateAllTypes
Order0
Search Closed IncidentsNo
Look Back30 days
From Version6.10.0

New event must match

  • gibid isNotEmpty
{
    "action": "script",
    "enabled": true,
    "id": "gib_rule_all_types",
    "index": 0,
    "itemVersion": "3.0.0",
    "linkTo": "oldest",
    "locked": false,
    "name": "GIB Rule All Types",
    "newEventFilters": [
        [
            {
                "left": {
                    "isContext": true,
                    "value": {
                        "simple": "gibid"
                    }
                },
                "operator": "isNotEmpty",
                "right": {
                    "value": {}
                },
                "type": "shortText"
            }
        ]
    ],
    "packID": "GroupIB_ThreatIntelligenceAttribution",
    "period": {
        "by": "days",
        "fromValue": 30
    },
    "readyNewEventFilters": [
        [
            {
                "left": {
                    "isContext": true,
                    "value": {
                        "simple": "gibid"
                    }
                },
                "operator": "isNotEmpty",
                "right": {
                    "value": {}
                },
                "type": "shortText"
            }
        ]
    ],
    "scriptName": "GIBIncidentUpdateAllTypes",
    "searchClosed": false,
    "system": true,
    "toServerVersion": "",
    "version": -1,
    "fromVersion": "6.10.0"
}