Group-IB Digital Risk Protection

Incident Fields

• GIB DRP ID

• Updated the field to be searchable, so the pre-processing rule's lookup by violation ID is indexed.

• New: GIB DRP Stages

• New: Added a new grid field with the take-down stages of a violation: stage, code, date and time, and times.

• New: GIB DRP Indicator Wanted

• New: Added a new field, set by the fetch when the violation type is selected in Create indicators from Violations; the postprocessing playbook creates the indicator when it is set.

• New: GIB DRP Expire Indicator On Close

• New: Added a new field, set by the fetch from Expire the indicator when the violation is closed; the pre-processing rule and the Reject Violation button expire the violation's indicator when they close an incident that has it set.

Incident Types

• GIB DRP Violation
• Updated the incident type to run the Group-IB Digital Risk Protection - Violation Incident Postprocessing playbook automatically on every new incident.

Integrations

Group-IB Digital Risk Protection

• Updated the integration to the ciaops SDK (3.1.0), which replaces the deprecated cyberintegrations SDK.
• Added the gibdrp-create-violation command, which submits one or more URLs (comma-separated, up to 100 per call) to Group-IB DRP as violations of the given violation_subtype for the given brand_id. A partially accepted batch reports the accepted and the rejected URLs in GIBDRP.CreatedViolation.succeeded and GIBDRP.CreatedViolation.failed; a URL already submitted for the same brand and subtype is rejected by Group-IB DRP as This URL already exists.
• Updated the Filter by Violation Type parameter name to Filter by Violation Section, which is what it filters by: Web, Mobile Apps, Marketplace, Social Networks, Advertising, Instant Messengers.
• Added the Filter by Violation Type parameter, which limits the fetch to the selected violation types: Counterfeit, Piracy, Partner policy compliance, Trademark, Malware, Phishing, Scam, No violation. A single selected type is filtered by the API; two or more are filtered by the integration, because the SDK forwards only one type to the API.
• Added the Filter by Violation Status parameter (default: detected, in_response), which limits the violations that create incidents to the selected DRP statuses. A violation that arrives already over - resolved, solved, legal, false_status, or rejected by the customer - never creates an incident, whatever the filter says.
• Added the Fetch only Violations awaiting approval parameter, which creates incidents only for violations Group-IB DRP has sent for a decision (approve state under_review) - the ones the Approve Violation and Reject Violation layout buttons act on.
• Added the Maximum incidents per fetch parameter (default: 200), which throttles a burst of violations into a steady stream. The cap is applied per API page: the page that reaches it is processed in full, and the remaining violations are fetched on the next run. Set it to 0 to disable the cap.
• Updated the Number of requests per collection parameter name to Number of requests per execution, and fixed an issue where the fetch performed one list request more than the configured number.
• Added the Known violations retention (days) parameter (default: 365), which sets how long a violation the instance created an incident for is remembered. The fetch reads the update stream of its section, types and brands without status filters and passes every remembered violation to the pre-processing rule whatever its state has become, so an incident is updated - and closed - when its violation is resolved, rejected or found false in Group-IB DRP; only a violation the instance does not remember has to pass the creation filters.
• Added the Incident severity parameter, which is applied to every incident the instance creates, so violations can be graded by running one instance per severity.
• Added the Create indicators from Violations parameter, which selects the violation types whose incidents get an indicator. The indicator is created from the incident by the Group-IB Digital Risk Protection - Violation Incident Postprocessing playbook: linked to the incident, with Group-IB Digital Risk Protection as its source, first and last seen dates, tags, and a verdict that follows the violation type - Counterfeit, Scam, Malware and Phishing as Malicious, Partner policy compliance, Piracy and Trademark as Suspicious, No violation as Benign. Only an http or https URL, a domain or an IPv4 address becomes an indicator.
• Added the Expire the indicator when the violation is closed parameter, which expires the violation's indicator when the pre-processing rule or the Reject Violation button closes the incident.
• Added the Close the incident when a violation is approved parameter (off by default). When enabled, approving a violation closes its incident as Resolved; rejecting a violation always closes it as False Positive.
• Updated the GIB DRP URL parameter name to GIB DRP API URL, and fixed an issue where a URL entered without a trailing slash sent every request to the wrong endpoint.
• Updated the Filter by Brand parameter to accept a comma-separated list of brand IDs. The SDK forwards only the first ID to the API; when several are configured, the integration logs which one was sent.
• Updated the Trust any certificate (not secure) parameter to also apply to the SDK session used by fetch-incidents and the violation commands; it applied to image downloads only.
• Updated the incident name to Type · Brand · URI (for example, Phishing · Acme · acme-login.example/verify) instead of the DRP title, which is identical for every violation of a type. A part the violation lacks is left out, and the title stays in GIB DRP Title.
• Updated the incident's occurred time: it is the violation's detection date unless that date is missing or more than a year old, in which case the current status date, then the creation date, is used, so a violation that resurfaced years after its first detection is no longer dated years back.
• Added the take-down stages of a violation to the incident, in the new GIB DRP Stages grid, with readable stage labels.
• Updated the GIB DRP Type field to show readable labels (Counterfeit, Piracy, Trademark, Malware, Phishing, Scam, …) instead of the DRP subtype codes; the types are recognized both by the names the DRP API returns and by the letter codes of the API specification.
• Fixed an issue where a date Group-IB DRP does not know, sent as the Unix epoch, reached the incident's date fields as 1970-01-01; such a date is now left empty.
• Updated the approval and rejection of a violation to go through the SDK. A violation that is not in a changeable state (status detected, approve state under_review) is refused with its actual state instead of appearing to succeed, and a decision that reached Group-IB DRP on a retried request is no longer reported as a failure.
• Updated the gibdrp-change-violation-status command to populate GIBDRP.ViolationDecision (id, status, approveState, closeIncident).
• Fixed an issue where gibdrp-get-violation-by-id wrote its outputs to the context root instead of GIBDRP.Violation.
• Fixed an issue where gibdrp-get-violation-by-id failed for a violation without a position score, and where GIB DRP Current Status Date stayed empty for a violation whose payload carries dates.currentDate only.
• Fixed an issue where gibdrp-get-violation-by-id attached the same screenshot once per take-down stage.
• Added the download_images argument (default: true) to gibdrp-get-violation-by-id; with false, the command reads the violation without downloading its screenshots.
• Updated the outputs of gibdrp-get-brands and gibdrp-get-subscriptions to GIBDRP.Brand and GIBDRP.Subscription.
• Fixed an issue where an unknown violation ID surfaced as an internal error in gibdrp-get-violation-by-id and gibdrp-change-violation-status; it is now reported as Violation '' was not found in Group-IB DRP.
• Fixed an issue where the connection test failed for a company with no configured brands.
• Fixed an issue where a violation with an unknown or missing source broke the fetch.
• Updated the inline violation images to be capped at 2 MB each and 5 MB per incident; a larger image is skipped and stays retrievable with gibdrp-get-violation-by-id.
• Updated the file download to retry transient 502, 503 and 504 errors.
• Updated the War Room output of the violation commands to be excluded from indicator auto-extraction, so a violation ID is no longer turned into a File indicator on every call.
• Updated the integration to declare the pack's classifier and mapper as the defaults of a new instance.
• Updated the error reporting: an expected failure (a request Group-IB DRP refuses, an unknown violation ID, a bad argument) is reported as one message, and the traceback is kept for unexpected errors only.

Layouts

• GIB DRP Violation Layout
• Improved layout: added the GIB DRP Stages grid to the Information from Group-IB section and the GIB DRP Created date to the Group-IB Dates section.
• Improved layout: the Approve Violation and Reject Violation buttons run the GIBDRPResolveViolation script and are shown only while GIB DRP Approve State is under_review.

Mappers

Group-IB Digital Risk Protection (mapper)

• Updated the occurred and name mappings to the keys the integration computes, so the values the fetch sets and the values the mapper writes cannot disagree.
• Added the GIB DRP Stages, GIB DRP Indicator Wanted and GIB DRP Expire Indicator On Close mappings.

Playbooks

Group-IB Digital Risk Protection - Violation Incident Postprocessing

• Playbook now supports closing the incident by the state of the violation in Group-IB DRP: as Resolved when the violation arrives resolved (or solved) or legal, as False Positive when it arrives rejected or false_status. There is no close-after-approve task; the incident of an approved violation is closed by the pre-processing rule once Group-IB DRP resolves it.
• Playbook now supports creating the violation's indicator with GIBDRPCreateViolationIndicator when GIB DRP Indicator Wanted is set.
• Updated the approve and reject tasks to run GIBDRPResolveViolation on the instance that fetched the incident (using: ${incident.sourceInstance}), so a deployment with several instances no longer fails the task on the instances that do not own the violation.
• Added the Later answer to the decision question, which ends the playbook without touching the violation and leaves the decision to the incident's buttons, so an analyst who is not ready to decide no longer has to reject.

Pre Process Rules

New: GIB DRP Rule All Types

• New: Added a new pre-processing rule that runs GIBDRPIncidentUpdate for every incoming Group-IB DRP incident with a GIB DRP ID, searching closed incidents as well, so a violation that already has an incident updates it instead of creating a duplicate.

Scripts

GIBDRPIncidentUpdate

• Updated the script to update every incident of the violation in place, closed ones included, with the violation's own fields plus name, occurred and details in one setIncident call per incident. status and severity are never written, so an update cannot reopen a closed incident or undo an analyst's severity.
• Added support for closing the incident once the work on the violation is over: as Resolved when the violation is resolved (older API versions: solved) or legal, as False Positive when Group-IB DRP found it false (false_status) or the customer rejected it. Approving closes nothing; the take-down is still ahead.
• Added support for expiring the violation's indicator with the close when GIB DRP Expire Indicator On Close is set on the incident.
• Fixed an issue where the incoming incident was dropped when its existing incident could not be updated; it is now created, so the new state of the violation is never lost.
• Updated the duplicate search to stream incidents page by page, with a ceiling of 1000 updates per pre-processing call and the violation ID quoted safely in the search query.
• Updated the Docker image to: demisto/python3:3.12.14.12343672.

New: GIBDRPResolveViolation

• New: Added a new script that approves or rejects a Group-IB DRP violation from the Approve Violation and Reject Violation layout buttons and from the postprocessing playbook. The decision is sent through the instance that fetched the incident, the resulting approve state is recorded in GIB DRP Approve State, rejecting closes the incident as False Positive, and approving closes it as Resolved only when the instance has Close the incident when a violation is approved enabled. Outputs GIBDRP.ViolationResolution (id, status, approveState, incidentUpdated, incidentClosed, indicatorExpired).

New: GIBDRPCreateViolationIndicator

• New: Added a new script that creates the indicator of a violation from its incident: linked to the incident, with Group-IB Digital Risk Protection as its source, the violation's first detection and current status date as first and last seen, the type and brand as tags, and a verdict that follows the violation type. Only an http or https URL, a domain or an IPv4 address becomes an indicator; any other violation URI is reported and skipped. Outputs GIBDRP.ViolationIndicator (uri, created, value, type, verdict).

Integrations

Group-IB Digital Risk Protection

• Updated the Docker image to: demisto/vendors-sdk:1.0.0.11778894.

Scripts

GIBDRPIncidentUpdate

• Updated the Docker image to: demisto/python3:3.12.13.10116658.

Integrations

Group-IB Digital Risk Protection

• Updated the Docker image to: demisto/vendors-sdk:1.0.0.10120494.

Integrations

Group-IB Digital Risk Protection

• Updated the Group-IB Digital Risk Protection integration:
  • Updated the Docker image to: demisto/vendors-sdk:1.0.0.6383083.
  • Logging: added structured debug prefixes and contextual fields across Client and IncidentBuilder.
  • Fetch progress: preserved last_fetch when no new seqUpdate is returned; advance only when a larger seqUpdate is observed to avoid unintended resets.

Scripts

GIBDRPIncidentUpdate

• Updated the GIBDRPIncidentUpdate script:
  • Updated the Docker image to: demisto/python3:3.12.12.6796194.
  • Reliable duplicate prevention: robust gibdrpid extraction (CustomFields/top-level/rawJSON/dbotMirrorId), exact-match search (including closed incidents), and in-place updates of existing incidents with detailed debug logging.

Group-IB Digital Risk Protection (DRP) is a cloud-based solution that continuously monitors online channels for brand abuse, scams, phishing, and other digital threats. It leverages machine learning and human analysis to detect the illegitimate use of logos, trademarks, and content across websites, social media, dark web, and more. The platform not only identifies incidents (called violations) in real-time, but also classifies and scores each violation to determine its severity, thereby prioritizing those that require urgent action. DRP implements a rigorous three-stage takedown process to maximize the elimination of confirmed threats like scam sites and phishing pages. This package includes several incident types, a classifier and mapper, a dedicated layout, and automation for updating received violations. A playbook is also provided to help you respond to violations more efficiently.