category: Data Enrichment & Threat Intelligence
provider: Group IB
commonfields:
  id: Group-IB Threat Intelligence & Attribution Feed
  version: -1
configuration:
- additionalinfo: The FQDN/IP the integration should connect to.
  defaultvalue: https://tap.group-ib.com/api/v2/
  display: GIB TI URL
  name: url
  required: true
  type: 0
  section: Connect
- additionalinfo: The API Key and Username required to authenticate to the service.
  display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- additionalinfo: Whether to allow connections without verifying SSL certificates validity.
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- additionalinfo: Whether to use XSOAR system proxy settings to connect to the API.
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- additionalinfo: Incremental feeds pull only new or modified indicators that have been sent from the integration. The determination if the indicator is new or modified happens on the 3rd-party vendor's side, so only indicators that are new or modified are sent to Cortex XSOAR. Therefore, all indicators coming from these feeds are labeled new or modified.
  defaultvalue: 'true'
  display: Incremental feed
  hidden: true
  name: feedIncremental
  type: 8
  required: false
  section: Collect
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  type: 8
  required: false
  section: Collect
- additionalinfo: Indicators from this integration instance will be marked with this reputation
  defaultvalue: Suspicious
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
  section: Collect
- additionalinfo: Reliability of the source providing the intelligence data
  defaultvalue: A - Completely reliable
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  section: Collect
- defaultvalue: '1'
  display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
  section: Collect
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
- additionalinfo: Collections List to include for fetching.
  display: Indicator collections
  name: indicator_collections
  options:
  - compromised/account_group
  - compromised/bank_card_group
  - compromised/masked_card
  - compromised/mule
  - attacks/ddos
  - attacks/deface
  - attacks/phishing_kit
  - attacks/phishing_group
  - hi/threat
  - apt/threat
  - osi/vulnerability
  - osi/git_repository
  - suspicious_ip/tor_node
  - suspicious_ip/open_proxy
  - suspicious_ip/socks_proxy
  - suspicious_ip/vpn
  - suspicious_ip/scanner
  - malware/cnc
  - ioc/common
  type: 16
  required: false
  hidden: false
  section: Collect
- additionalinfo: Date to start fetching indicators from.
  defaultvalue: 3 days
  display: Indicator first fetch
  name: indicators_first_fetch
  type: 0
  required: false
  hidden: false
  section: Collect
- additionalinfo: A number of requests per collection that integration sends in one fetch iteration (each request picks up to 200 objects with different amount of indicators). If you face some runtime errors, lower the value.
  defaultvalue: '2'
  display: Number of requests per collection
  section: Collect
  name: requests_count
  options:
  - '1'
  - '2'
  - '3'
  - '4'
  - '5'
  type: 15
  required: false
  hidden: false
- additionalinfo: Supports CSV values.
  display: Tags
  section: Collect
  name: feedTags
  type: 0
  required: false
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  display: Traffic Light Protocol Color
  name: tlp_color
  section: Collect
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
- display: 'Use TLP from source (per indicator)'
  name: use_tlp_from_source
  type: 8
  section: Collect
  defaultvalue: 'false'
  required: false
  additionalinfo: When enabled, each indicator gets its TLP from Group-IB when the source provides it. For ioc/common, TLP defaults to AMBER. The Traffic Light Protocol Color setting is then used only as a fallback when the source has no TLP. When disabled, all indicators use the selected Traffic Light Protocol Color.
- display: 'Limit (items per request)'
  name: limit
  type: 0
  section: Collect
  defaultvalue: '100'
  required: false
  additionalinfo: Number of items requested per API page. Larger values reduce API round-trips but may increase response size. Server-side caps may apply.
- display: ''
  name: feedExpirationPolicy
  type: 17
  section: Collect
  options:
  - never
  - interval
  - indicatorType
- display: ''
  name: feedExpirationInterval
  type: 1
  required: false
  section: Collect
description: Use Group-IB Threat Intelligence Feed integration to fetch IOCs from various Group-IB collections.
display: Group-IB Threat Intelligence Feed
name: Group-IB Threat Intelligence & Attribution Feed
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      description: GIB Collection to get indicators from.
      name: collection
      predefined:
      - compromised/account_group
      - compromised/bank_card_group
      - compromised/masked_card
      - compromised/mule
      - attacks/ddos
      - attacks/deface
      - attacks/phishing_kit
      - attacks/phishing_group
      - hi/threat
      - apt/threat
      - osi/vulnerability
      - osi/git_repository
      - suspicious_ip/tor_node
      - suspicious_ip/open_proxy
      - suspicious_ip/socks_proxy
      - suspicious_ip/vpn
      - suspicious_ip/scanner
      - malware/cnc
      - ioc/common
      required: true
      default: false
      isArray: false
      secret: false
    - description: Incident Id to get indicators(if set, all the indicators will be provided from particular incident).
      name: id
      default: false
      isArray: false
      required: false
      secret: false
    - auto: PREDEFINED
      default: true
      defaultValue: '50'
      description: Limit of indicators to display in War Room.
      name: limit
      predefined:
      - '10'
      - '20'
      - '30'
      - '40'
      - '50'
      isArray: false
      required: false
      secret: false
    description: Get limited count of indicators for specified collection and get all indicators from particular events by id.
    name: gibtia-get-indicators
    deprecated: false
    execution: false
  dockerimage: demisto/vendors-sdk:1.0.0.10120494
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
  isfetch: false
  longRunning: false
  longRunningPort: false
tests:
- No tests (auto formatted)
fromversion: 6.0.0
sectionorder:
- Connect
- Collect