Group-IB Digital Risk Protection

Integrations

Group-IB Digital Risk Protection

• Updated the Group-IB Digital Risk Protection integration:
  • Updated the Docker image to: demisto/vendors-sdk:1.0.0.6383083.
  • Logging: added structured debug prefixes and contextual fields across Client and IncidentBuilder.
  • Fetch progress: preserved last_fetch when no new seqUpdate is returned; advance only when a larger seqUpdate is observed to avoid unintended resets.

Scripts

GIBDRPIncidentUpdate

• Updated the GIBDRPIncidentUpdate script:
  • Updated the Docker image to: demisto/python3:3.12.12.6796194.
  • Reliable duplicate prevention: robust gibdrpid extraction (CustomFields/top-level/rawJSON/dbotMirrorId), exact-match search (including closed incidents), and in-place updates of existing incidents with detailed debug logging.

Group-IB Digital Risk Protection (DRP) is a cloud-based solution that continuously monitors online channels for brand abuse, scams, phishing, and other digital threats. It leverages machine learning and human analysis to detect the illegitimate use of logos, trademarks, and content across websites, social media, dark web, and more. The platform not only identifies incidents (called violations) in real-time, but also classifies and scores each violation to determine its severity, thereby prioritizing those that require urgent action. DRP implements a rigorous three-stage takedown process to maximize the elimination of confirmed threats like scam sites and phishing pages. This package includes several incident types, a classifier and mapper, a dedicated layout, and automation for updating received violations. A playbook is also provided to help you respond to violations more efficiently.