Group-IB Threat Intelligence

Details
Content
Dependencies
Version History

Group-IB Threat Intelligence is a system for analyzing and attributing cyberattacks, threat hunting, and protecting network infrastructure based on data relating to adversary tactics, tools, and activity. Use this pack to fast receive incidents related to you, attribute them to adversaries to do instant response, enrich your security with an enormous IOCs collection, and provide possibilities for manual investigation through Group-IB data via Cortex XSOAR interface.

Nowadays businesses in any sphere may have problems with their cybersecurity: from simple phishing to professional cybercriminals, so it is very important to respond to incidents quickly.

Group-IB Threat Intelligence Pack can help you with managing your incident and indicators from Group-IB within the SOAR system.

What does this pack do?

Receive incidents and attribute them to adversaries.
Enrich security system with IOCs.
Provide possibilities for manual investigation through Group-IB data via Cortex XSOAR interface.

As part of this pack, you will also get incident types, fields, and layouts; indicator types, fields, and layouts; the classifier and mapper for properly delivering data to these types and fields. Also, you will get a playbook, that enriches incidents, upcoming from Group-IB with threat reports and threat actor information.

Incident Postprocessing - Group-IB Threat Intelligence

Nowadays businesses in any sphere may have problems with their cybersecurity: from simple phishing to professional cybercriminals, so it is very important to respond to incidents quickly.

Group-IB Threat Intelligence Pack can help you with managing your incident and indicators from Group-IB within the SOAR system.

What does this pack do?

Receive incidents and attribute them to adversaries.
Enrich security system with IOCs.
Provide possibilities for manual investigation through Group-IB data via Cortex interface.

Incident Postprocessing - Group-IB Threat Intelligence

Automations

Name	Description
GIBIncidentUpdateAllTypes	This script prevents duplication of existing incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GIBIncidentUpdateIncludingClosed	This script prevents duplication of existing incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GIBIncidentUpdate	This script prevents duplication of existing incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Classifiers

Name	Description
Group-IB Threat Intelligence (classifier)
Group-IB Threat Intelligence (mapper)

Incident Fields

Name	Description
GIB Report Number
GIB Card Valid Thru Date	Valid thru date of the card
GIB SPD Type
GIB DDOS Type
GIB Threat Actor ID
GIB Nation-State Cybercriminals Threat Actor Labels
GIB Data Hash
GIB Nation-State Cybercriminals Threat Regions
GIB Target Domain Provider
GIB VPN Names
GIB Deface Date
GIB Nation-State Cybercriminals Threat Countries
GIB CNC URL
GIB Target Provider
GIB Cybercriminal Expertises
GIB Cybercriminal Threat Actor Aliases
GIB SPD Value
GIB Email Domains
GIB Malware Name
GIB Phishing Objectives
GIB DDOS Request Body
GIB Title
GIB Cybercriminal Threat Actor Reports Table
GIB Proxy Port
GIB DDOS Request Body Hash
GIB Person
GIB SPD Events Table
GIB Date Published
GIB Owner Country Code
GIB CVSS Vector
GIB Nation-State Cybercriminals Threat Actor Roles
GIB Update Time
GIB Admiralty Code	The Admiralty System or NATO System is a method for evaluating collected items of intelligence. It consists of a two-character notation, evaluating the reliability of the source and the assessed level of confidence on the information.
GIB Has Exploit
GIB Cybercriminal Malware
GIB Nation-State Cybercriminals Threat Description
GIB Threat Actor is APT
GIB Target ASN
GIB Malware Aliases
GIB Target City
GIB Bulletin Family
GIB Nation-State Cybercriminals Malware
GIB Is Dump	Whether the card record is marked as dump by Group-IB
GIB Cybercriminal Sectors
GIB HTML
GIB SPD Sources Table
GIB SPD Malware Table
GIB Malware Langs
GIB TLP
GIB Affected Software Table
GIB Card Number
GIB Extended CVSS Base
GIB DDOS Date Registration
GIB DDOS Protocol
GIB Card BIN	BIN value of the card
GIB Organization BSB
GIB Card Dump	Dump value of the card
GIB OSI Git Repository Files Table
GIB Malware ID
GIB Nation-State Cybercriminals Regions
GIB Target Category
GIB Card Valid Thru
GIB Malware Table
GIB CNC IP
GIB Target Domain
GIB Malware Categories
GIB Date Modified
GIB Is Masked	Whether the card record is marked as masked by Group-IB
GIB Phishing Kit Email
GIB Card Issuer Country Code	Country code of the card issuer
GIB Phishing Kit Table
GIB Is Expired	Whether the card record is marked as expired by Group-IB
GIB Deface Contacts
GIB Severity
GIB Owner ZIP
GIB Owner Birthday
GIB DDOS Request Headers Hash
GIB Repository
GIB DDOS Request Headers Body
GIB Price Currency
GIB DDOS Target Country Code
GIB Phishing Date Updated
GIB Organization CLABE
GIB Nation-State Cybercriminals Threat Report Number
GIB Nation-State Cybercriminals Expertises
GIB Date of Detection
GIB Email
GIB VPN Sources
GIB Nation-State Cybercriminals Sectors
GIB Client Country Name
GIB Target IP
GIB Phishing Registrar
GIB Downloaded From Table
GIB Parsed Login Domain
GIB Link List Table
GIB Card Issuer Country Name	Country name of the card issuer
GIB Phishing Kit Emails
GIB Phishing Domain
GIB Malware Short Description
GIB Nation-State Cybercriminals Threat Sectors
GIB Matches Table
GIB DDOS Target Port
GIB Organization IBAN
GIB CNC Domain
GIB Malware STIX GUID
GIB Extended CVSS Impact
GIB Downloaded From
GIB Favicon
GIB Date Created At
GIB SPD Service Type
GIB Proxy Source
GIB Revisions
GIB Extended CVSS Temporal
GIB SPD Illegal Score
GIB Provider Domain
GIB Malware CNC Domain
GIB Victim IP
GIB Client Region
GIB Card Category	Category of the card
GIB SPD Owner Name
GIB Country Name
GIB DDOS Request Data Link
GIB Address
GIB Scanner Categories
GIB Source	Where the feed comes from to GIB
GIB Card Issuer	Issuer of compromised card
GIB GIT Source
GIB Compromised Login
GIB Nation-State Cybercriminals Threat Actor Aliases
GIB Malware Source Countries
GIB Href
GIB Inject Dump
GIB Organization BIC
GIB Leak Published
GIB Threat Level
GIB DDOS Target ASN
GIB Phishing Date Added
GIB DDOS Date Begin
GIB Date Last Seen
GIB Date Add
GIB Client ASN
GIB DDOS Target Domain
GIB Phishing Type
GIB Phishing Domain Expiration Date
GIB Mirror Link
GIB Phishing Date Detected
GIB Reliability	Reliability of the source
GIB Phishing Kit Source
GIB DDOS Target URL
GIB Threat Actor STIX GUID
GIB Matches
GIB Password
GIB Nation-State Cybercriminal Forums Table
GIB Malware File hash
GIB Cybercriminal Threat Description
GIB DDOS Target Country Name
GIB Passwords
GIB Nation-State Cybercriminals Threat Expertises
GIB Link List
GIB Compromised Events Information Table
GIB Drop Email
GIB CNC Port
GIB Cybercriminal Threat Actor Report Authors
GIB Upload Time
GIB Phishing Status
GIB Date Compromised
GIB Is Tailored
GIB Screenshot
GIB Organization Name
GIB Vulnerability Type
GIB Date Incident
GIB Date Expired
GIB Credibility	Level of confidence on the information
GIB ID	ID of event in GIB TI
GIB Track	Track information from the masked card record in Group-IB
GIB Phishing Kit Hash
GIB CNC
GIB CNC ASN
GIB CNC Country Code
GIB SPD Threat Actor Table
GIB Nation-State Cybercriminals Threat Title
GIB Client Provider
GIB Merged Cvss
GIB Phishing Brand
GIB Phishing Domain Puny
GIB Parsed Login IP
GIB DDOS Date End
GIB Scanner Sources
GIB Leaked File Name
GIB Drop Email Domain
GIB Malware Description
GIB Date Created
GIB Compromised Events Table
GIB Organization SWIFT
GIB Nation-State Cybercriminals Threat Actor Description
GIB Nation-State Cybercriminals Threat Actor Reports Table
GIB Source Link	Source link of the masked card record in Group-IB
GIB Proxy Sources
GIB Service IP
GIB Owner Passport
GIB Name Servers
GIB CPE Table
GIB DDOS Target City
GIB CNC Provider
GIB Target Brand
GIB Owner State
GIB DDOS Target Category
GIB Emails
GIB CVSS Score
GIB Nation-State Cybercriminals Threat Actor Country
GIB Date Last Compromised
GIB Proxy Type
GIB Phishing Date Blocked
GIB Price Value
GIB DDOS Duration
GIB Extended Description
GIB Owner Tax Number
GIB CNC Country Name
GIB Cybercriminal Regions
GIB Extended CVSS Overall
GIB Nation-State Cybercriminals Threat Actor Goals
GIB Date First Compromised
GIB Phishing Sources
GIB Nation-State Cybercriminals Threat Actor CVE
GIB DDOS Source
GIB Portal Link
GIB Deface Source
GIB Malware Regions
GIB CNC City
GIB DDOS Target Provider
GIB Malware Platforms
GIB Cybercriminal Threat Actor Description
GIB Threat Actor Country
GIB Payment System
GIB Service Domain
GIB DDOS Target Region
GIB Card Type
GIB Owner City
GIB Threat Actor Name
GIB Socks Proxy Source
GIB Service URL
GIB Phishing IP Table
GIB DDOS Target IP
GIB Base Name	Base name of the masked card record in Group-IB
GIB Card PIN	PIN value of the card
GIB Threat Actors Table
GIB Compromised Account
GIB Deface Site URL
GIB Reporter
GIB TTL
GIB Cybercriminal Threat Title
GIB CVV	Compromised card CVV
GIB Related Indicators Data
GIB Extended CVSS Exploitability
GIB Country Code
GIB Cybercriminal Forums Table
GIB Client IP
GIB Phishing URLs
GIB Client City
GIB Date Updated At
GIB Nation-State Cybercriminals Threat Langs
GIB Leaked Data
GIB Inject MD5
GIB Phishing Kit Path
GIB Leak Name
GIB Client Country Code
GIB Date First Seen
GIB CNC Region
GIB Target Region

Incident Types

Name	Description
GIB OSI Public Leak
GIB OSI Git Leak
GIB Compromised Masked Card
GIB Cybercriminal Threat
GIB Malware
GIB Suspicious IP Socks Proxy
GIB Attacks Phishing Group
GIB Suspicious IP VPN
GIB OSI Vulnerability
GIB Attacks DDOS
GIB Brand Protection Phishing Kit
GIB APT Threat
GIB Data Breach
GIB Nation-State Cybercriminals Threat
GIB Attacks Deface
GIB Compromised Account
GIB Suspicious IP Scanner
GIB Suspicious IP TOR Node
GIB Compromised Mule
GIB Compromised Account Group
GIB Attacks Phishing Kit
GIB Cybercriminal Threat Actor
GIB Compromised Card
GIB Targeted Malware
GIB Nation-State Cybercriminals Threat Actor
GIB Compromised Card Group
GIB SPD
GIB Suspicious IP Open Proxy
GIB Malware CNC
GIB Brand Protection Phishing

Indicator Fields

Name	Description
GIB Phishing Title
GIB Admiralty Code	The Admiralty System or NATO System is a method for evaluating collected items of intelligence. It consists of a two-character notation, evaluating the reliability of the source and the assessed level of confidence on the information.
GIB Credibility	Level of confidence on the information
GIB Collection
GIB Proxy Port
GIB ID	ID of event in GIB TI&A
GIB Threat Actor ID
GIB Date Compromised
GIB Target Brand	What brand was targeted by phishing
GIB Software Mixed
GIB File Name
GIB Target Category	What category was targeted by phishing
GIB Malware Name
GIB Severity
GIB Proxy Anonymous	Level of anonymous
GIB Threat Actor is APT
GIB CVSS Vector
GIB Threat Actor Name
GIB Reliability	Reliability of the source
GIB Target Domain	What domain was targeted by phishing
GIB Hash

Integrations

Name	Description
Group-IB Threat Intelligence (Partner Contribution)	Pack helps to integrate Group-IB Threat Intelligence and get incidents directly into Cortex XSOAR. The list of included collections: Compromised Accounts, Compromised Cards, Compromised Masked Cards, Brand Protection Phishing, Brand Protection Phishing Kit, OSI Git Leak, OSI Public Leak, Targeted Malware.
Group-IB Threat Intelligence Feed (Partner Contribution)	Use Group-IB Threat Intelligence Feed integration to fetch IOCs from various Group-IB collections.

Layouts

Name	Description
GIB Victim IP Layout	Layout for GIB Victim IP
GIB Suspicious IP Open Proxy Layout	Layout for GIB Suspicious IP Open Proxy
GIB Compromised Account Layout	Layout for GIB Compromised Account
GIB Targeted Malware Layout	Layout for GIB Targeted Malware
GIB Cybercriminal Threat Actor Layout	Layout for GIB Cybercriminal Threat Actor
GIB Malware CNC Layout	Layout for GIB Malware CNC
GIB Nation-State Cybercriminals Threat Actor Layout	Layout for Nation-State Cybercriminals Threat Actor
GIB Cybercriminal Threat Layout	Layout for GIB Cybercriminal Threat
GIB APT Threat Layout	Layout for GIB APT Threat
GIB Compromised Account Group Layout	Layout for GIB Compromised Account Group
GIB Compromised Card Layout	Layout for GIB Compromised Card
GIB Brand Protection Phishing Kit Layout	Layout for GIB Brand Protection Phishing Kit
GIB Compromised IMEI Layout	Layout for GIB Compromised IMEI
GIB Suspicious IP Scanner Layout	Layout for GIB Suspicious IP Scanner
GIB Compromised Mule Layout	Layout for GIB Compromised Mule
GIB Malware Layout	Layout for GIB Malware
GIB OSI Git Leak Layout	Layout for GIB OSI Git Leak
GIB Compromised Masked Card Layout	Layout for GIB Compromised Masked Card
GIB OSI Vulnerability Layout	Layout for GIB OSI Vulnerability
GIB Data Breach Layout	Layout for GIB Data Breach
GIB SPD Layout	Layout for GIB SPD
GIB Suspicious IP Socks Proxy Layout	Layout for GIB Suspicious IP Socks Proxy
GIB Suspicious IP VPN Layout	Layout for GIB Suspicious IP VPN
GIB Attacks DDOS Layout	Layout for GIB Attacks DDOS
GIB Attacks Deface Layout	Layout for GIB Attacks Deface
GIB Attacks Phishing Kit Layout	Layout for GIB Attacks Phishing Kit
GIB Suspicious IP TOR Node Layout	Layout for GIB Suspicious IP TOR Node
GIB Brand Protection Phishing Layout	Layout for GIB Brand Protection Phishing
GIB Nation-State Cybercriminals Threat Layout	Layout for Nation-State Cybercriminals Threat
GIB Compromised Card Group Layout	Layout for GIB Compromised Card Group
GIB Attacks Phishing Group Layout	Layout for GIB Attacks Phishing Group
GIB OSI Public Leak Layout	Layout for GIB OSI Public Leak

Playbooks

Name	Description
Incident Postprocessing - Group-IB Threat Intelligence & Attribution	Obtains additional information on the threat actor involved in the incident and associates related indicators to the incident.

Preprocessrule

Name	Description
GIB Rule
GIB Rule All Types

Indicator Types

Name	Description
GIB Compromised IMEI
GIB Compromised Mule
GIB Victim IP

Automations

Name	Description
GIBIncidentUpdate	This script prevents duplication of existing incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GIBAlertUpdate	This script prevents duplication of existing alerts. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GIBIncidentUpdateIncludingClosed	This script prevents duplication of existing incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GIBAlertUpdateIncludingClosed	This script prevents duplication of existing alerts. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GIBIncidentUpdateAllTypes	This script prevents duplication of existing incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GIBAlertUpdateAllTypes	This script prevents duplication of existing alerts. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Classifiers

Name	Description
Group-IB Threat Intelligence (classifier)
Group-IB Threat Intelligence (mapper)

Incident Fields

Name	Description
GIB DDOS Date Registration
GIB Target Provider
GIB CPE Table
GIB Phishing Brand
GIB SPD Events Table
GIB Card Issuer Country Code	Country code of the card issuer
GIB Phishing Date Added
GIB Extended CVSS Base
GIB Service URL
GIB Data Hash
GIB Drop Email
GIB SPD Illegal Score
GIB GIT Source
GIB Organization BSB
GIB DDOS Target Country Name
GIB Organization BIC
GIB CVV	Compromised card CVV
GIB Leaked Data
GIB SPD Type
GIB Scanner Sources
GIB Href
GIB Is Expired	Whether the card record is marked as expired by Group-IB
GIB CNC URL
GIB Portal Link
GIB Inject Dump
GIB Socks Proxy Source
GIB Extended Description
GIB DDOS Target Port
GIB Extended CVSS Overall
GIB Phishing Objectives
GIB DDOS Request Body Hash
GIB Name Servers
GIB HTML
GIB Cybercriminal Sectors
GIB Cybercriminal Threat Actor Reports Table
GIB DDOS Type
GIB Card Category	Category of the card
GIB Cybercriminal Threat Actor Aliases
GIB VPN Names
GIB Date Created At
GIB Owner State
GIB Phishing Date Blocked
GIB Owner Tax Number
GIB Mirror Link
GIB Phishing Registrar
GIB Source Link	Source link of the masked card record in Group-IB
GIB Client Region
GIB Cybercriminal Threat Title
GIB Cybercriminal Expertises
GIB Compromised Events Information Table
GIB Card Issuer Country Name	Country name of the card issuer
GIB Price Value
GIB Card Valid Thru
GIB Extended CVSS Impact
GIB Organization SWIFT
GIB Target IP
GIB CNC ASN
GIB Nation-State Cybercriminals Threat Actor Reports Table
GIB Malware Aliases
GIB Malware File hash
GIB DDOS Date End
GIB Phishing Domain Puny
GIB Reliability	Reliability of the source
GIB Vulnerability Type
GIB Organization CLABE
GIB Owner Birthday
GIB SPD Sources Table
GIB Date Add
GIB Malware CNC Domain
GIB Extended CVSS Temporal
GIB Owner City
GIB DDOS Target Country Code
GIB DDOS Duration
GIB Country Name
GIB Target Domain
GIB Card PIN	PIN value of the card
GIB Parsed Login Domain
GIB OSI Git Repository Files Table
GIB Nation-State Cybercriminals Regions
GIB Malware Short Description
GIB Leak Name
GIB Malware Description
GIB Threat Level
GIB DDOS Request Headers Hash
GIB Has Exploit
GIB Upload Time
GIB Malware STIX GUID
GIB Matches Table
GIB CVSS Score
GIB Client City
GIB Revisions
GIB Organization Name
GIB Date Created
GIB Malware Regions
GIB Parsed Login IP
GIB Price Currency
GIB Title
GIB TTL
GIB Phishing Kit Table
GIB DDOS Target Category
GIB DDOS Request Data Link
GIB Nation-State Cybercriminals Threat Description
GIB Cybercriminal Threat Actor Description
GIB CNC Domain
GIB Date of Detection
GIB Date First Seen
GIB CNC Port
GIB Malware Table
GIB SPD Owner Name
GIB Date Last Compromised
GIB Cybercriminal Forums Table
GIB Malware Source Countries
GIB Downloaded From
GIB DDOS Target IP
GIB Malware Categories
GIB Link List Table
GIB Leak Published
GIB Base Name	Base name of the masked card record in Group-IB
GIB Matches
GIB Owner Country Code
GIB Update Time
GIB Nation-State Cybercriminals Threat Expertises
GIB Phishing Domain
GIB Provider Domain
GIB Nation-State Cybercriminals Threat Actor Aliases
GIB ID	ID of event in GIB TI
GIB Threat Actor is APT
GIB DDOS Date Begin
GIB Threat Actor ID
GIB Owner Passport
GIB CVSS Vector
GIB Phishing Status
GIB Nation-State Cybercriminals Expertises
GIB Date First Compromised
GIB CNC Region
GIB Emails
GIB Is Tailored
GIB SPD Threat Actor Table
GIB Target ASN
GIB Malware ID
GIB Organization IBAN
GIB SPD Service Type
GIB Phishing Kit Hash
GIB Phishing Kit Path
GIB Date Compromised
GIB CNC Provider
GIB Target Brand
GIB Nation-State Cybercriminals Threat Title
GIB Phishing Date Updated
GIB Phishing Date Detected
GIB Admiralty Code	The Admiralty System or NATO System is a method for evaluating collected items of intelligence. It consists of a two-character notation, evaluating the reliability of the source and the assessed level of confidence on the information.
GIB Threat Actor Country
GIB Is Dump	Whether the card record is marked as dump by Group-IB
GIB Card Number
GIB DDOS Target ASN
GIB Nation-State Cybercriminals Threat Actor Description
GIB Target City
GIB CNC IP
GIB CNC City
GIB Malware Langs
GIB Is Masked	Whether the card record is marked as masked by Group-IB
GIB Compromised Login
GIB DDOS Source
GIB Nation-State Cybercriminals Threat Sectors
GIB Nation-State Cybercriminals Sectors
GIB Date Updated At
GIB Phishing Kit Source
GIB Country Code
GIB Phishing Sources
GIB TLP
GIB Target Region
GIB Extended CVSS Exploitability
GIB Link List
GIB Threat Actor STIX GUID
GIB Phishing URLs
GIB Phishing Kit Emails
GIB CNC Country Code
GIB Card BIN	BIN value of the card
GIB CNC
GIB Nation-State Cybercriminals Threat Actor CVE
GIB Deface Date
GIB Downloaded From Table
GIB Nation-State Cybercriminals Threat Regions
GIB Card Dump	Dump value of the card
GIB Threat Actors Table
GIB Client Provider
GIB Repository
GIB Client IP
GIB Bulletin Family
GIB Proxy Source
GIB Source	Where the feed comes from to GIB
GIB Related Indicators Data
GIB Date Last Seen
GIB Favicon
GIB Phishing IP Table
GIB Affected Software Table
GIB SPD Value
GIB DDOS Target Region
GIB Merged Cvss
GIB Nation-State Cybercriminals Threat Actor Goals
GIB DDOS Target URL
GIB DDOS Request Body
GIB Owner ZIP
GIB Cybercriminal Threat Description
GIB Client Country Code
GIB Phishing Domain Expiration Date
GIB Victim IP
GIB Compromised Account
GIB Email Domains
GIB Target Domain Provider
GIB Nation-State Cybercriminals Threat Report Number
GIB Proxy Port
GIB Threat Actor Name
GIB Deface Contacts
GIB Card Valid Thru Date	Valid thru date of the card
GIB Date Published
GIB Date Expired
GIB Credibility	Level of confidence on the information
GIB Malware Platforms
GIB Date Modified
GIB Reporter
GIB Deface Source
GIB Service Domain
GIB Card Issuer	Issuer of compromised card
GIB Date Incident
GIB Cybercriminal Threat Actor Report Authors
GIB Malware Name
GIB Nation-State Cybercriminals Threat Actor Roles
GIB VPN Sources
GIB Drop Email Domain
GIB Proxy Type
GIB Deface Site URL
GIB Report Number
GIB Phishing Type
GIB Nation-State Cybercriminals Malware
GIB CNC Country Name
GIB Client ASN
GIB Person
GIB Nation-State Cybercriminals Threat Actor Labels
GIB Service IP
GIB Email
GIB SPD Malware Table
GIB Compromised Events Table
GIB Scanner Categories
GIB Proxy Sources
GIB Address
GIB DDOS Target Provider
GIB DDOS Protocol
GIB Screenshot
GIB Password
GIB Track	Track information from the masked card record in Group-IB
GIB Card Type
GIB Payment System
GIB DDOS Target City
GIB Phishing Kit Email
GIB DDOS Request Headers Body
GIB Passwords
GIB Cybercriminal Regions
GIB Nation-State Cybercriminals Threat Langs
GIB Target Category
GIB Nation-State Cybercriminal Forums Table
GIB DDOS Target Domain
GIB Cybercriminal Malware
GIB Nation-State Cybercriminals Threat Countries
GIB Client Country Name
GIB Nation-State Cybercriminals Threat Actor Country
GIB Severity

Incident Types

Name	Description
GIB Malware CNC
GIB Suspicious IP Scanner
GIB Compromised Card Group
GIB OSI Public Leak
GIB SPD
GIB OSI Git Leak
GIB Attacks Phishing Group
GIB Compromised Mule
GIB Suspicious IP TOR Node
GIB Suspicious IP VPN
GIB Attacks Deface
GIB APT Threat
GIB Compromised Account
GIB Malware
GIB Attacks DDOS
GIB Suspicious IP Socks Proxy
GIB Targeted Malware
GIB Compromised Account Group
GIB Cybercriminal Threat Actor
GIB Compromised Card
GIB Data Breach
GIB Brand Protection Phishing
GIB OSI Vulnerability
GIB Cybercriminal Threat
GIB Suspicious IP Open Proxy
GIB Brand Protection Phishing Kit
GIB Attacks Phishing Kit
GIB Nation-State Cybercriminals Threat
GIB Nation-State Cybercriminals Threat Actor
GIB Compromised Masked Card

Indicator Fields

Name	Description
GIB Target Category	What category was targeted by phishing
GIB Phishing Title
GIB Date Compromised
GIB Threat Actor Name
GIB Malware Name
GIB Proxy Port
GIB ID	ID of event in GIB TI&A
GIB Severity
GIB Proxy Anonymous	Level of anonymous
GIB File Name
GIB Collection
GIB Target Brand	What brand was targeted by phishing
GIB CVSS Vector
GIB Credibility	Level of confidence on the information
GIB Software Mixed
GIB Hash
GIB Admiralty Code	The Admiralty System or NATO System is a method for evaluating collected items of intelligence. It consists of a two-character notation, evaluating the reliability of the source and the assessed level of confidence on the information.
GIB Threat Actor is APT
GIB Target Domain	What domain was targeted by phishing
GIB Threat Actor ID
GIB Reliability	Reliability of the source

Integrations

Name	Description
Group-IB Threat Intelligence (Partner Contribution)	Pack helps to integrate Group-IB Threat Intelligence and get incidents directly into Cortex. The list of included collections: Compromised Accounts, Compromised Cards, Compromised Masked Cards, Brand Protection Phishing, Brand Protection Phishing Kit, OSI Git Leak, OSI Public Leak, Targeted Malware.
Group-IB Threat Intelligence Feed (Partner Contribution)	Use Group-IB Threat Intelligence Feed integration to fetch IOCs from various Group-IB collections.

Layouts

Name	Description
GIB Compromised Masked Card Layout	Layout for GIB Compromised Masked Card
GIB Nation-State Cybercriminals Threat Actor Layout	Layout for Nation-State Cybercriminals Threat Actor
GIB Malware CNC Layout	Layout for GIB Malware CNC
GIB APT Threat Layout	Layout for GIB APT Threat
GIB Compromised IMEI Layout	Layout for GIB Compromised IMEI
GIB Cybercriminal Threat Actor Layout	Layout for GIB Cybercriminal Threat Actor
GIB Attacks DDOS Layout	Layout for GIB Attacks DDOS
GIB Attacks Phishing Kit Layout	Layout for GIB Attacks Phishing Kit
GIB Attacks Deface Layout	Layout for GIB Attacks Deface
GIB OSI Vulnerability Layout	Layout for GIB OSI Vulnerability
GIB SPD Layout	Layout for GIB SPD
GIB Suspicious IP Open Proxy Layout	Layout for GIB Suspicious IP Open Proxy
GIB Suspicious IP TOR Node Layout	Layout for GIB Suspicious IP TOR Node
GIB Attacks Phishing Group Layout	Layout for GIB Attacks Phishing Group
GIB Compromised Card Group Layout	Layout for GIB Compromised Card Group
GIB Victim IP Layout	Layout for GIB Victim IP
GIB Nation-State Cybercriminals Threat Layout	Layout for Nation-State Cybercriminals Threat
GIB Compromised Mule Layout	Layout for GIB Compromised Mule
GIB Suspicious IP VPN Layout	Layout for GIB Suspicious IP VPN
GIB Suspicious IP Socks Proxy Layout	Layout for GIB Suspicious IP Socks Proxy
GIB OSI Public Leak Layout	Layout for GIB OSI Public Leak
GIB Compromised Account Group Layout	Layout for GIB Compromised Account Group
GIB Suspicious IP Scanner Layout	Layout for GIB Suspicious IP Scanner
GIB Compromised Card Layout	Layout for GIB Compromised Card
GIB Malware Layout	Layout for GIB Malware
GIB Data Breach Layout	Layout for GIB Data Breach
GIB Cybercriminal Threat Layout	Layout for GIB Cybercriminal Threat
GIB Compromised Account Layout	Layout for GIB Compromised Account
GIB OSI Git Leak Layout	Layout for GIB OSI Git Leak

Playbooks

Name	Description
Alert Postprocessing - Group-IB Threat Intelligence & Attribution	Obtains additional information on the threat actor involved in the alert and associates related indicators to the alert.

Indicator Types

Name	Description
GIB Compromised Mule
GIB Victim IP
GIB Compromised IMEI

Required Content Packs (1)

Pack Name	Pack By
Base	By: Cortex XSOAR

Optional Content Packs (3)

Pack Name	Pack By
Common Types	By: Cortex XSOAR
OrionMalware	By: Airbus
PAN-OS by Palo Alto Networks	By: Cortex XSOAR

All level dependencies (2)

Pack Name	Pack By
Aggregated Scripts	By: Cortex XSOAR
Base	By: Cortex XSOAR

3.0.0 - 9383878 (May 26, 2026)

Classifiers

Group-IB Threat Intelligence (classifier)

Updated the Group-IB Threat Intelligence (classifier) classifier to support the GIB SPD incident type for the compromised/spd collection.
Updated the Group-IB Threat Intelligence (classifier) classifier to map compromised/masked_card records to the new GIB Compromised Masked Card incident type.

Incident Fields

GIB Address

Updated to connect to GIB Compromised Masked Card

GIB Base Name

Created to use to the GIB Compromised Masked Card

GIB CNC

Updated to connect to GIB Compromised Masked Card

GIB CNC ASN

Created to use to the GIB Compromised Masked Card

GIB CNC City

Created to use to the GIB Compromised Masked Card

GIB CNC Country Code

Created to use to the GIB Compromised Masked Card

GIB CNC Country Name

Created to use to the GIB Compromised Masked Card

GIB CNC Domain

Created to use to the GIB Compromised Masked Card

GIB CNC IP

Created to use to the GIB Compromised Masked Card

GIB CNC Provider

Created to use to the GIB Compromised Masked Card

GIB CNC Region

Created to use to the GIB Compromised Masked Card

GIB CNC URL

Created to use to the GIB Compromised Masked Card

GIB CVV

Updated to connect to GIB Compromised Masked Card

GIB Card BIN

Created to use to the GIB Compromised Masked Card

GIB Card Category

Created to use to the GIB Compromised Masked Card

GIB Card Dump

Created to use to the GIB Compromised Masked Card

GIB Card Issuer

Created to use to the GIB Compromised Masked Card

GIB Card Issuer Country Code

Created to use to the GIB Compromised Masked Card

GIB Card Issuer Country Name

Created to use to the GIB Compromised Masked Card

GIB Card Number

Created to use to the GIB Compromised Masked Card

GIB Card PIN

Created to use to the GIB Compromised Masked Card

GIB Card Type

Created to use to the GIB Compromised Masked Card

GIB Card Valid Thru

Created to use to the GIB Compromised Masked Card

GIB Card Valid Thru Date

Created to use to the GIB Compromised Masked Card

GIB Client ASN

Created to use to the GIB Compromised Masked Card

GIB Client City

Created to use to the GIB Compromised Masked Card

GIB Client Country Code

Created to use to the GIB Compromised Masked Card

GIB Client Country Name

Created to use to the GIB Compromised Masked Card

GIB Client IP

Created to use to the GIB Compromised Masked Card

GIB Client Provider

Created to use to the GIB Compromised Masked Card

GIB Client Region

Created to use to the GIB Compromised Masked Card

GIB Date Compromised

Updated to connect to GIB Compromised Masked Card

GIB Date of Detection

Updated to connect to GIB Compromised Masked Card

GIB Email

Updated to connect to GIB Compromised Masked Card

GIB Is Dump

Created to use to the GIB Compromised Masked Card

GIB Is Expired

Created to use to the GIB Compromised Masked Card

GIB Is Masked

Created to use to the GIB Compromised Masked Card

GIB Malware ID

Created to use to the GIB Compromised Masked Card

GIB Malware Name

Updated to connect to GIB Compromised Masked Card

GIB Malware STIX GUID

Created to use to the GIB Compromised Masked Card

GIB Owner Birthday

Created to use to the GIB Compromised Masked Card

GIB Owner City

Created to use to the GIB Compromised Masked Card

GIB Owner Country Code

Created to use to the GIB Compromised Masked Card

GIB Owner Passport

Created to use to the GIB Compromised Masked Card

GIB Owner State

Created to use to the GIB Compromised Masked Card

GIB Owner Tax Number

Created to use to the GIB Compromised Masked Card

GIB Owner ZIP

Created to use to the GIB Compromised Masked Card

GIB Payment System

Updated to connect to GIB Compromised Masked Card

GIB Person

Updated to connect to GIB Compromised Masked Card

GIB Price Currency

Created to use to the GIB Compromised Masked Card

GIB Price Value

Created to use to the GIB Compromised Masked Card

Updated to connect to GIB Compromised Masked Card

GIB Source

Updated to connect to GIB Compromised Masked Card

GIB Source Link

Created to use to the GIB Compromised Masked Card

GIB Threat Actor Country

Updated to connect to GIB Compromised Masked Card

GIB Threat Actor ID

Updated to connect to GIB Compromised Masked Card

GIB Threat Actor Name

Updated to connect to GIB Compromised Masked Card

GIB Threat Actor STIX GUID

Created to use to the GIB Compromised Masked Card

GIB Threat Actor is APT

Updated to connect to GIB Compromised Masked Card

GIB Track

Created to use to the GIB Compromised Masked Card
GIB Admiralty Code
Updated the GIB Admiralty Code incident field to support for the new compromised/spd collection.
GIB Credibility
Updated the GIB Credibility incident field to support for the new compromised/spd collection.
GIB Date Created At
Updated the GIB Date Created At incident field to support for the new compromised/spd collection.
GIB Date First Seen
Updated the GIB Date First Seen incident field to support for the new compromised/spd collection.
GIB Date Last Seen
Updated the GIB Date Last Seen incident field to support for the new compromised/spd collection.
GIB Nation-State Cybercriminals Threat Actor Aliases
Updated the GIB Nation-State Cybercriminals Threat Actor Aliases incident field to correct the Incident Field ID.
GIB Phishing Date Updated
Updated the GIB Phishing Date Updated incident field to correct the Incident Field ID.
GIB Portal Link
Updated the GIB Portal Link incident field to support for the new compromised/spd collection.
GIB Reliability
Updated the GIB Reliability incident field to support for the new compromised/spd collection.
New: GIB SPD Events Table
New: Added a new incident field- GIB SPD Events Table that required for the implementation of the new compromised/spd collection.
New: GIB SPD Illegal Score
New: Added a new incident field- GIB SPD Illegal Score that required for the implementation of the new compromised/spd collection.
New: GIB SPD Malware Table
New: Added a new incident field- GIB SPD Malware Table that required for the implementation of the new compromised/spd collection.
New: GIB SPD Owner Name
New: Added a new incident field- GIB SPD Owner Name that required for the implementation of the new compromised/spd collection.
New: GIB SPD Service Type
New: Added a new incident field- GIB SPD Service Type that required for the implementation of the new compromised/spd collection.
New: GIB SPD Sources Table
New: Added a new incident field- GIB SPD Sources Table that required for the implementation of the new compromised/spd collection.
New: GIB SPD Threat Actor Table
New: Added a new incident field- GIB SPD Threat Actor Table that required for the implementation of the new compromised/spd collection/
New: GIB SPD Type
New: Added a new incident field- GIB SPD Type that required for the implementation of the new compromised/spd collection.
New: GIB SPD Value
New: Added a new incident field- GIB SPD Value that required for the implementation of the new compromised/spd collection.
GIB Scanner Sources
Updated the GIB Scanner Sources incident field to correct the Incident Field ID.
GIB Severity
Updated the GIB Severity incident to support for the new compromised/spd collection.
New: GIB TTL
New: Added a new incident field GIB TTL that stores the time-to-live (days) from Group-IB evaluation; associated with GIB SPD.
GIB Compromised Events Table
Updated the GIB Compromised Events Table incident field to include CVV.
GIB ID
Updated the GIB ID incident field description text.
New: GIB TLP
New: Added a new incident field- GIB TLP that stores the Traffic Light Protocol value from Group-IB.

Incident Types

New: GIB SPD
New: Added GIB SPD incident type for the compromised/spd (Suspicious Payment Details) collection, with dedicated layout.
New: GIB Compromised Masked Card
New: Added GIB Compromised Masked Card incident type for the compromised/masked_card collection, with a dedicated layout and the GIB Rule All Types Pre-Processing Rule applied.

Integrations

Group-IB Threat Intelligence

Added built-in fetch-time incident deduplication for Group-IB incident IDs using the official Cortex XSOAR duplicate filtering utilities.
Added support for Skip updated incidents (prevent duplicates) integration parameter. Disabled by default, it can be enabled in environments where Pre-Processing Rules do not work reliably and duplicate suppression must happen directly in fetch logic.
Added support for Deduplication lookback (days) integration parameter to control how long fetched Group-IB incident IDs are retained in the deduplication cache while built-in deduplication is enabled. Recommended value is 365 days.
Reworked the deduplication cache cleanup so the Deduplication lookback (days) parameter is honored 1:1: an ID added today is dropped exactly dedup_lookback_days days later, with no hidden multipliers and without pinning the most recent ID forever. The on-disk cache layout (found_incident_ids) is unchanged, preserving forward and backward compatibility with existing last_run state. Upgrade note: previous releases retained IDs for up to 2 × dedup_lookback_days and kept the latest ID indefinitely; after upgrade, IDs older than dedup_lookback_days are pruned on the next fetch. If long-tail duplicates are expected, raise the parameter (for example to 1095 for a three-year window).
Removed compromised/mule from the Collections to fetch selector so it is no longer exposed as a fetch-incidents option in the integration instance configuration.
Added first-class support for the new compromised/masked_card collection in the incident integration, including a dedicated incident type and lookup command.
Added support for the compromised/masked_card collection in the feed integration so top-level CNC domain/IP values can be emitted as indicators.
Cached the granted-collections check per integration instance to remove duplicate /user/granted_collections calls during fetch, info-by-id and search commands; collection availability is now validated once per command with a single, actionable error message listing all unknown collections.
Added support for the compromised/spd (Suspicious Payment Details) collection: fetch incidents and map payment-related observables (e.g. cryptocurrency wallets) with type, value, events, sources, malware, threat actors, and evaluation (severity, TLP, TTL).
Added support for gibti-get-compromised-masked-card-info command that performs Group-IB event lookup in the compromised/masked_card collection by provided ID.
Added support for gibti-get-compromised-spd-info command that performs Group-IB event lookup in the compromised/spd collection by provided ID.
Added support for Enable reputation commands parameter that select which reputation commands should be enabled for this integration instance.
default is none enabled. only the selected commands will perform enrichment and return dbotscore.
Added support for Ignore Source Reliability override parameter that if true, ignore the instance source reliability setting and use the integration’s computed reliability per indicator.
Added support for Source Reliability parameter that reliability of the source providing the intelligence data.
Added support for gibti-get-compromised-account-info command that command performs group ib event lookup in compromised/account collection with provided id.
Added support for gibti-get-suspicious-ip-vpn-info command that command performs group ib event lookup in suspicious_ip/vpn collection by provided id.
Added support for gibti-global-search command that command performs global group ib search.
Added support for gibti-get-compromised-breached-info command that command performs group ib event lookup in compromised/breached collection with provided id.
Added support for gibti-get-phishing-group-info command that command performs group ib event lookup in attacks/phishing_group collection by provided id.
Added support for gibti-get-osi-public-leak-info command that command performs group ib event lookup in osi/public_leak collection with provided id.
Added support for gibti-local-search command that command performs group ib search in selected collection.
Deprecated the date_from and date_to arguments in gibti-local-search; they are now ignored and seq_update should be used for update-based iteration control.
Added support for gibti-get-threat-info command that command performs group ib event lookup in hi/threat (or in apt/threat if the apt flag is true) collection with provided id.
Added support for ip command that runs reputation on ips.
Added support for gibti-get-osi-git-leak-info command that command performs group ib event lookup in osi/git_leak collection with provided id.
Added support for gibti-get-suspicious-ip-socks-proxy-info command that command performs group ib event lookup in suspicious_ip/socks_proxy collection with provided id.
Added support for file command that runs reputation on files.
Added support for gibti-get-compromised-mule-info command that command performs group ib event lookup in compromised/mule collection with provided id.
Added support for gibti-get-compromised-card-group-info command that command performs group ib event lookup in compromised/bank_card_group collection by provided id.
Added support for gibti-get-suspicious-ip-scanner-info command that command performs group ib event lookup in suspicious_ip/scanner collection by provided id.
Added support for gibti-ip-scoring command that returns groupib scoring for ips (numeric and dbotscore).
Added support for gibti-get-malware-cnc-info command that command performs group ib event lookup in malware/cnc collection by provided id.
Added support for gibti-get-available-collections command that returns list of available collections.
Added support for gibti-get-suspicious-ip-open-proxy-info command that command performs group ib event lookup in suspicious_ip/open_proxy collection with provided id.
Added support for gibti-get-attacks-ddos-info command that command performs group ib event lookup in attacks/ddos collection with provided id.
Added support for gibti-get-suspicious-ip-tor-node-info command that command performs group ib event lookup in suspicious_ip/tor_node collection with provided id.
Added support for gibti-get-osi-vulnerability-info command that command performs group ib event lookup in osi/vulnerability collection with provided id.
Added support for gibti-get-malware-malware-info command that command performs group ib event lookup in malware/malware collection by provided id.
Added support for gibti-get-threat-actor-info command that command performs group ib event lookup in hi/threat_actor (or in apt/threat_actor if the apt flag is true) collection with provided id.
Added support for gibti-get-attacks-deface-info command that command performs group ib event lookup in attacks/deface collection with provided id.
Added support for domain command that runs reputation on domains.
Added support for requests_limit argument in the gibtia-local-search command.
Added support for include_raw_feed argument in the gibtia-local-search command.
Added support for page_size_limit argument in the gibtia-local-search command.
Added support for seq_update argument in the gibtia-local-search command.
Updated the Docker image to: demisto/vendors-sdk:1.0.0.8307504.

Group-IB Threat Intelligence Feed

Updated the Group-IB Threat Intelligence & Attribution Feed integration to include TLP metadata in incident enrichment.
Added support for Use TLP from source (per indicator) parameter.
TLP from source is now supported for the following collections when Use TLP from source is enabled: compromised/account_group, compromised/bank_card_group, compromised/masked_card, attacks/ddos, attacks/deface, attacks/phishing_kit, attacks/phishing_group, apt/threat, hi/threat, osi/vulnerability, osi/git_repository, osi/public_leak, suspicious_ip/tor_node, suspicious_ip/open_proxy, suspicious_ip/socks_proxy, suspicious_ip/vpn, suspicious_ip/scanner. For ioc/common, TLP is always set to AMBER when the option is enabled.
Fixed a long-standing mapping gap: source TLP (evaluation.tlp) is now propagated for osi/git_repository and osi/public_leak indicators (previously dropped during parsing).
Aligned ipv4_country_mame parser keys for attacks/phishing_kit and suspicious_ip/scanner collections so geocountry enrichment is now actually populated on the resulting indicators.
Cached granted-collections check per integration instance and replaced per-collection availability calls with a single batched validation that reports all unknown collections in one error.
Updated the Docker image to: demisto/vendors-sdk:1.0.0.8307504.

Layouts

GIB Attacks Deface Layout
Updated the GIB Attacks Deface Layout layout to add support for GIB TLP.
New: GIB SPD Layout
New: Added GIB SPD Layout for the GIB SPD incident type.
GIB SPD Layout
Trimmed GIB SPD Layout by removing the unused Linked Incidents, Child Incidents, Evidence and Team Members widgets from the Incident Info tab and the Evidence Board / Related Incidents tabs to keep the layout focused on payment-detail context.
New: GIB Compromised Masked Card Layout
New: Added GIB Compromised Masked Card Layout for the GIB Compromised Masked Card incident type, surfacing card / client / CNC / owner / malware / threat actor / source / evaluation context with the related-indicators grid.
GIB Attacks DDOS Layout
Updated the GIB Attacks DDOS Layout to add the GIB TLP field.
GIB Attacks Phishing Group Layout
Updated the GIB Attacks Phishing Group Layout to add the GIB TLP field.
GIB Attacks Phishing Kit Layout
Updated the GIB Attacks Phishing Kit Layout to add the GIB TLP field.
Updated the GIB Compromised Account Group Layout to add the GIB TLP field.
GIB Compromised Account Group Layout
Updated the GIB Compromised Card Group Layout to add the GIB TLP field.
GIB Compromised Card Group Layout
Updated the GIB Compromised Mule Layout to add the GIB TLP field.
GIB Compromised Mule Layout
Updated the GIB Cybercriminal Threat Layout to add the GIB TLP field.
GIB Cybercriminal Threat Layout
Updated the GIB Data Breach Layout to add the GIB TLP field.
GIB Data Breach Layout
Updated the GIB Nation-State Cybercriminals Threat Layout to add the GIB TLP field.
GIB Nation-State Cybercriminals Threat Layout
Updated the GIB OSI Git Leak Layout to add the GIB TLP field.
GIB OSI Git Leak Layout
Updated the GIB OSI Public Leak Layout to add the GIB TLP field.
GIB OSI Public Leak Layout
Updated the GIB OSI Vulnerability Layout to add the GIB TLP field.
GIB OSI Vulnerability Layout
Updated the GIB Suspicious IP Open Proxy Layout to add the GIB TLP field.
GIB Suspicious IP Open Proxy Layout
Updated the GIB Suspicious IP Scanner Layout to add the GIB TLP field.
GIB Suspicious IP Scanner Layout
Updated the GIB Suspicious IP Socks Proxy Layout to add the GIB TLP field.
GIB Suspicious IP Socks Proxy Layout
Updated the GIB Suspicious IP TOR Node Layout to add the GIB TLP field.
GIB Suspicious IP TOR Node Layout
Updated the GIB Suspicious IP TOR Node Layout to add the GIB TLP field.
GIB Suspicious IP VPN Layout
Updated the GIB Suspicious IP VPN Layout to add the GIB TLP field.

Mappers

Group-IB Threat Intelligence (mapper)

Updated the Group-IB Threat Intelligence (mapper) mapper to populate the GIB TLP field from the source evaluation data.
Updated the Group-IB Threat Intelligence (mapper) mapper to support GIB SPD incident type: full mapping for type, value, serviceType, ownerName, illegalScore, dates (createdAt, firstSeenAt, lastSeenAt), portalLink, events table, sources table, malware table, threat actor table, and evaluation (admiraltyCode, credibility, reliability, severity, TLP, TTL).
Updated the Group-IB Threat Intelligence (mapper) mapper to support GIB Compromised Masked Card incident type: full mapping for card data (BIN, number, CVV, dump, PIN, type, category, payment system, valid-thru), client geo/network context, CNC observables (URL, domain, IPv4 with ASN/region/provider/country), owner data (name, address, birthday, passport, tax number, ZIP, state, city, country, email, phone), price (currency, value), source (sourceType, sourceLink, portalLink), malware (name, ID, STIX GUID), threat actor (name, ID, STIX GUID, country, isAPT), evaluation (admiraltyCode, credibility, reliability, severity, TLP, TTL), and the boolean status flags (isDump, isExpired, isMasked).

Pre Process Rules

GIB Rule

Disabled by default

GIB Rule All Types

Created to work with a new, improved script for a continuous process of deduplication and incident updates

Scripts

GIBIncidentUpdate

Updated the Docker image to: demisto/python3:3.12.13.8428455.

GIBIncidentUpdateAllTypes

Bumped script fromversion to 6.10.0 to align with the rest of the pack.
Added a new fallback Pre-Processing Rule script for customers who want the improved duplicate-handling logic without excluding the GIB Data Breach incident type in rule filters.
Reworked existing-duplicate retrieval to stream getIncidents pages on demand instead of materializing up to MAX_INCIDENTS matches in memory. Memory usage is now bounded by PAGE_SIZE regardless of how many duplicates exist, and setIncident calls are interleaved with page fetches so failures on later pages do not waste work on already-collected updates.
Hardened gibid extraction to look up the incoming incident in CustomFields → top-level → labels → rawJSON order, and guarded reserved keys (id, CustomFields) on setIncident calls so the update payload cannot accidentally redirect to the incoming incident.
The public find_existing_incidents helper is preserved as a backward-compatible adapter (now backed by the new streaming iterator), so existing playbooks and tests continue to work unchanged.

GIBIncidentUpdateIncludingClosed

Updated the Docker image to: demisto/python3:3.12.13.8428455.

Related pull requests:
- 42688
- 44426

Download

2.2.4 - 9117230 (May 18, 2026)

Pre Process Rules

gib_rule

Documentation and metadata improvements.

Related pull requests:
- 43937

Download

2.2.3 - 7827247 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43566

Download

2.2.2 - 6088397 (December 1, 2025)

Integrations

Group-IB Threat Intelligence

Breaking Changes: Removed the exclude_combolist parameter (previously named "Exclude All with Combolist type"). This parameter has been replaced with the new Include combolist type in data parameter.
Added support for Include combolist type in data parameter that works only for compromised/account_group. if the parameter is enabled, the response contains combolist data. if you enable "include unique type in data" with this filter, the response will contain data of both types. if "include combolist type in data" and "include unique type in data" are disabled, the response will contain data of both types.
Added support for Limit (items per request) parameter that number of items requested per api page. larger values reduce api roundtrips but may increase response size. serverside caps may apply.
Added support for Include unique type in data parameter that works only for compromised/account_group. if the parameter is enabled, the response contains unique data. if you enable “include combolist type in data” with this filter, the response will contain data of both types. if “include combolist type in data” and “include unique type in data” are disabled, the response will contain data of both types.

Group-IB Threat Intelligence Feed

Added support for Limit (items per request) parameter that number of items requested per api page. larger values reduce api roundtrips but may increase response size. serverside caps may apply.

Scripts

GIBIncidentUpdate

Updated the Docker image to: demisto/python3:3.12.12.5490952.

GIBIncidentUpdateIncludingClosed

Updated the Docker image to: demisto/python3:3.12.12.5490952.

Related pull requests:
- 42104
- 41803

Download

2.1.2 - 5636304 (October 29, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41629

Download

2.1.1 - 5591931 (October 27, 2025)

Integrations

Group-IB Threat Intelligence Feed

Updated the Docker image to: demisto/vendors-sdk:1.0.0.5505539.

Group-IB Threat Intelligence

Updated the Docker image to: demisto/vendors-sdk:1.0.0.5505539.

Related pull requests:
- 41061

Download

2.1.0 - R5469292 (October 20, 2025)

Integrations

Group-IB Threat Intelligence

Added support for Exclude All with Combolist type parameter to exclude all data in the compromised/account_group collection whose SourceType is Combolist.
Added support for Enable filter "Probable Corporate Access parameter allowing the “Probable Corporate Access” filter to be enabled for collection
Fixed a bug with data collection from compromised/account_group and search.

Group-IB Threat Intelligence Feed

Documentation and metadata improvements.

Scripts

GIBIncidentUpdate

Updated the Docker image to: demisto/python3:3.12.8.3296088.

GIBIncidentUpdateIncludingClosed

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 40120
- 40017

Download

3.0.0 - 9383878 (May 26, 2026)

Classifiers

Group-IB Threat Intelligence (classifier)

Updated the Group-IB Threat Intelligence (classifier) classifier to support the GIB SPD incident type for the compromised/spd collection.
Updated the Group-IB Threat Intelligence (classifier) classifier to map compromised/masked_card records to the new GIB Compromised Masked Card incident type.

Incident Fields

GIB Address

Updated to connect to GIB Compromised Masked Card

GIB Base Name

Created to use to the GIB Compromised Masked Card

GIB CNC

Updated to connect to GIB Compromised Masked Card

GIB CNC ASN

Created to use to the GIB Compromised Masked Card

GIB CNC City

Created to use to the GIB Compromised Masked Card

GIB CNC Country Code

Created to use to the GIB Compromised Masked Card

GIB CNC Country Name

Created to use to the GIB Compromised Masked Card

GIB CNC Domain

Created to use to the GIB Compromised Masked Card

GIB CNC IP

Created to use to the GIB Compromised Masked Card

GIB CNC Provider

Created to use to the GIB Compromised Masked Card

GIB CNC Region

Created to use to the GIB Compromised Masked Card

GIB CNC URL

Created to use to the GIB Compromised Masked Card

GIB CVV

Updated to connect to GIB Compromised Masked Card

GIB Card BIN

Created to use to the GIB Compromised Masked Card

GIB Card Category

Created to use to the GIB Compromised Masked Card

GIB Card Dump

Created to use to the GIB Compromised Masked Card

GIB Card Issuer

Created to use to the GIB Compromised Masked Card

GIB Card Issuer Country Code

Created to use to the GIB Compromised Masked Card

GIB Card Issuer Country Name

Created to use to the GIB Compromised Masked Card

GIB Card Number

Created to use to the GIB Compromised Masked Card

GIB Card PIN

Created to use to the GIB Compromised Masked Card

GIB Card Type

Created to use to the GIB Compromised Masked Card

GIB Card Valid Thru

Created to use to the GIB Compromised Masked Card

GIB Card Valid Thru Date

Created to use to the GIB Compromised Masked Card

GIB Client ASN

Created to use to the GIB Compromised Masked Card

GIB Client City

Created to use to the GIB Compromised Masked Card

GIB Client Country Code

Created to use to the GIB Compromised Masked Card

GIB Client Country Name

Created to use to the GIB Compromised Masked Card

GIB Client IP

Created to use to the GIB Compromised Masked Card

GIB Client Provider

Created to use to the GIB Compromised Masked Card

GIB Client Region

Created to use to the GIB Compromised Masked Card

GIB Date Compromised

Updated to connect to GIB Compromised Masked Card

GIB Date of Detection

Updated to connect to GIB Compromised Masked Card

GIB Email

Updated to connect to GIB Compromised Masked Card

GIB Is Dump

Created to use to the GIB Compromised Masked Card

GIB Is Expired

Created to use to the GIB Compromised Masked Card

GIB Is Masked

Created to use to the GIB Compromised Masked Card

GIB Malware ID

Created to use to the GIB Compromised Masked Card

GIB Malware Name

Updated to connect to GIB Compromised Masked Card

GIB Malware STIX GUID

Created to use to the GIB Compromised Masked Card

GIB Owner Birthday

Created to use to the GIB Compromised Masked Card

GIB Owner City

Created to use to the GIB Compromised Masked Card

GIB Owner Country Code

Created to use to the GIB Compromised Masked Card

GIB Owner Passport

Created to use to the GIB Compromised Masked Card

GIB Owner State

Created to use to the GIB Compromised Masked Card

GIB Owner Tax Number

Created to use to the GIB Compromised Masked Card

GIB Owner ZIP

Created to use to the GIB Compromised Masked Card

GIB Payment System

Updated to connect to GIB Compromised Masked Card

GIB Person

Updated to connect to GIB Compromised Masked Card

GIB Price Currency

Created to use to the GIB Compromised Masked Card

GIB Price Value

Created to use to the GIB Compromised Masked Card

Updated to connect to GIB Compromised Masked Card

GIB Source

Updated to connect to GIB Compromised Masked Card

GIB Source Link

Created to use to the GIB Compromised Masked Card

GIB Threat Actor Country

Updated to connect to GIB Compromised Masked Card

GIB Threat Actor ID

Updated to connect to GIB Compromised Masked Card

GIB Threat Actor Name

Updated to connect to GIB Compromised Masked Card

GIB Threat Actor STIX GUID

Created to use to the GIB Compromised Masked Card

GIB Threat Actor is APT

Updated to connect to GIB Compromised Masked Card

GIB Track

Created to use to the GIB Compromised Masked Card
GIB Admiralty Code
Updated the GIB Admiralty Code incident field to support for the new compromised/spd collection.
GIB Credibility
Updated the GIB Credibility incident field to support for the new compromised/spd collection.
GIB Date Created At
Updated the GIB Date Created At incident field to support for the new compromised/spd collection.
GIB Date First Seen
Updated the GIB Date First Seen incident field to support for the new compromised/spd collection.
GIB Date Last Seen
Updated the GIB Date Last Seen incident field to support for the new compromised/spd collection.
GIB Nation-State Cybercriminals Threat Actor Aliases
Updated the GIB Nation-State Cybercriminals Threat Actor Aliases incident field to correct the Incident Field ID.
GIB Phishing Date Updated
Updated the GIB Phishing Date Updated incident field to correct the Incident Field ID.
GIB Portal Link
Updated the GIB Portal Link incident field to support for the new compromised/spd collection.
GIB Reliability
Updated the GIB Reliability incident field to support for the new compromised/spd collection.
New: GIB SPD Events Table
New: Added a new incident field- GIB SPD Events Table that required for the implementation of the new compromised/spd collection.
New: GIB SPD Illegal Score
New: Added a new incident field- GIB SPD Illegal Score that required for the implementation of the new compromised/spd collection.
New: GIB SPD Malware Table
New: Added a new incident field- GIB SPD Malware Table that required for the implementation of the new compromised/spd collection.
New: GIB SPD Owner Name
New: Added a new incident field- GIB SPD Owner Name that required for the implementation of the new compromised/spd collection.
New: GIB SPD Service Type
New: Added a new incident field- GIB SPD Service Type that required for the implementation of the new compromised/spd collection.
New: GIB SPD Sources Table
New: Added a new incident field- GIB SPD Sources Table that required for the implementation of the new compromised/spd collection.
New: GIB SPD Threat Actor Table
New: Added a new incident field- GIB SPD Threat Actor Table that required for the implementation of the new compromised/spd collection/
New: GIB SPD Type
New: Added a new incident field- GIB SPD Type that required for the implementation of the new compromised/spd collection.
New: GIB SPD Value
New: Added a new incident field- GIB SPD Value that required for the implementation of the new compromised/spd collection.
GIB Scanner Sources
Updated the GIB Scanner Sources incident field to correct the Incident Field ID.
GIB Severity
Updated the GIB Severity incident to support for the new compromised/spd collection.
New: GIB TTL
New: Added a new incident field GIB TTL that stores the time-to-live (days) from Group-IB evaluation; associated with GIB SPD.
GIB Compromised Events Table
Updated the GIB Compromised Events Table incident field to include CVV.
GIB ID
Updated the GIB ID incident field description text.
New: GIB TLP
New: Added a new incident field- GIB TLP that stores the Traffic Light Protocol value from Group-IB.

Incident Types

New: GIB SPD
New: Added GIB SPD incident type for the compromised/spd (Suspicious Payment Details) collection, with dedicated layout.
New: GIB Compromised Masked Card
New: Added GIB Compromised Masked Card incident type for the compromised/masked_card collection, with a dedicated layout and the GIB Rule All Types Pre-Processing Rule applied.

Integrations

Group-IB Threat Intelligence

Added built-in fetch-time incident deduplication for Group-IB incident IDs using the official Cortex XSOAR duplicate filtering utilities.
Added support for Skip updated incidents (prevent duplicates) integration parameter. Disabled by default, it can be enabled in environments where Pre-Processing Rules do not work reliably and duplicate suppression must happen directly in fetch logic.
Added support for Deduplication lookback (days) integration parameter to control how long fetched Group-IB incident IDs are retained in the deduplication cache while built-in deduplication is enabled. Recommended value is 365 days.
Reworked the deduplication cache cleanup so the Deduplication lookback (days) parameter is honored 1:1: an ID added today is dropped exactly dedup_lookback_days days later, with no hidden multipliers and without pinning the most recent ID forever. The on-disk cache layout (found_incident_ids) is unchanged, preserving forward and backward compatibility with existing last_run state. Upgrade note: previous releases retained IDs for up to 2 × dedup_lookback_days and kept the latest ID indefinitely; after upgrade, IDs older than dedup_lookback_days are pruned on the next fetch. If long-tail duplicates are expected, raise the parameter (for example to 1095 for a three-year window).
Removed compromised/mule from the Collections to fetch selector so it is no longer exposed as a fetch-incidents option in the integration instance configuration.
Added first-class support for the new compromised/masked_card collection in the incident integration, including a dedicated incident type and lookup command.
Added support for the compromised/masked_card collection in the feed integration so top-level CNC domain/IP values can be emitted as indicators.
Cached the granted-collections check per integration instance to remove duplicate /user/granted_collections calls during fetch, info-by-id and search commands; collection availability is now validated once per command with a single, actionable error message listing all unknown collections.
Added support for the compromised/spd (Suspicious Payment Details) collection: fetch incidents and map payment-related observables (e.g. cryptocurrency wallets) with type, value, events, sources, malware, threat actors, and evaluation (severity, TLP, TTL).
Added support for gibti-get-compromised-masked-card-info command that performs Group-IB event lookup in the compromised/masked_card collection by provided ID.
Added support for gibti-get-compromised-spd-info command that performs Group-IB event lookup in the compromised/spd collection by provided ID.
Added support for Enable reputation commands parameter that select which reputation commands should be enabled for this integration instance.
default is none enabled. only the selected commands will perform enrichment and return dbotscore.
Added support for Ignore Source Reliability override parameter that if true, ignore the instance source reliability setting and use the integration’s computed reliability per indicator.
Added support for Source Reliability parameter that reliability of the source providing the intelligence data.
Added support for gibti-get-compromised-account-info command that command performs group ib event lookup in compromised/account collection with provided id.
Added support for gibti-get-suspicious-ip-vpn-info command that command performs group ib event lookup in suspicious_ip/vpn collection by provided id.
Added support for gibti-global-search command that command performs global group ib search.
Added support for gibti-get-compromised-breached-info command that command performs group ib event lookup in compromised/breached collection with provided id.
Added support for gibti-get-phishing-group-info command that command performs group ib event lookup in attacks/phishing_group collection by provided id.
Added support for gibti-get-osi-public-leak-info command that command performs group ib event lookup in osi/public_leak collection with provided id.
Added support for gibti-local-search command that command performs group ib search in selected collection.
Deprecated the date_from and date_to arguments in gibti-local-search; they are now ignored and seq_update should be used for update-based iteration control.
Added support for gibti-get-threat-info command that command performs group ib event lookup in hi/threat (or in apt/threat if the apt flag is true) collection with provided id.
Added support for ip command that runs reputation on ips.
Added support for gibti-get-osi-git-leak-info command that command performs group ib event lookup in osi/git_leak collection with provided id.
Added support for gibti-get-suspicious-ip-socks-proxy-info command that command performs group ib event lookup in suspicious_ip/socks_proxy collection with provided id.
Added support for file command that runs reputation on files.
Added support for gibti-get-compromised-mule-info command that command performs group ib event lookup in compromised/mule collection with provided id.
Added support for gibti-get-compromised-card-group-info command that command performs group ib event lookup in compromised/bank_card_group collection by provided id.
Added support for gibti-get-suspicious-ip-scanner-info command that command performs group ib event lookup in suspicious_ip/scanner collection by provided id.
Added support for gibti-ip-scoring command that returns groupib scoring for ips (numeric and dbotscore).
Added support for gibti-get-malware-cnc-info command that command performs group ib event lookup in malware/cnc collection by provided id.
Added support for gibti-get-available-collections command that returns list of available collections.
Added support for gibti-get-suspicious-ip-open-proxy-info command that command performs group ib event lookup in suspicious_ip/open_proxy collection with provided id.
Added support for gibti-get-attacks-ddos-info command that command performs group ib event lookup in attacks/ddos collection with provided id.
Added support for gibti-get-suspicious-ip-tor-node-info command that command performs group ib event lookup in suspicious_ip/tor_node collection with provided id.
Added support for gibti-get-osi-vulnerability-info command that command performs group ib event lookup in osi/vulnerability collection with provided id.
Added support for gibti-get-malware-malware-info command that command performs group ib event lookup in malware/malware collection by provided id.
Added support for gibti-get-threat-actor-info command that command performs group ib event lookup in hi/threat_actor (or in apt/threat_actor if the apt flag is true) collection with provided id.
Added support for gibti-get-attacks-deface-info command that command performs group ib event lookup in attacks/deface collection with provided id.
Added support for domain command that runs reputation on domains.
Added support for requests_limit argument in the gibtia-local-search command.
Added support for include_raw_feed argument in the gibtia-local-search command.
Added support for page_size_limit argument in the gibtia-local-search command.
Added support for seq_update argument in the gibtia-local-search command.
Updated the Docker image to: demisto/vendors-sdk:1.0.0.8307504.

Group-IB Threat Intelligence Feed

Updated the Group-IB Threat Intelligence & Attribution Feed integration to include TLP metadata in incident enrichment.
Added support for Use TLP from source (per indicator) parameter.
TLP from source is now supported for the following collections when Use TLP from source is enabled: compromised/account_group, compromised/bank_card_group, compromised/masked_card, attacks/ddos, attacks/deface, attacks/phishing_kit, attacks/phishing_group, apt/threat, hi/threat, osi/vulnerability, osi/git_repository, osi/public_leak, suspicious_ip/tor_node, suspicious_ip/open_proxy, suspicious_ip/socks_proxy, suspicious_ip/vpn, suspicious_ip/scanner. For ioc/common, TLP is always set to AMBER when the option is enabled.
Fixed a long-standing mapping gap: source TLP (evaluation.tlp) is now propagated for osi/git_repository and osi/public_leak indicators (previously dropped during parsing).
Aligned ipv4_country_mame parser keys for attacks/phishing_kit and suspicious_ip/scanner collections so geocountry enrichment is now actually populated on the resulting indicators.
Cached granted-collections check per integration instance and replaced per-collection availability calls with a single batched validation that reports all unknown collections in one error.
Updated the Docker image to: demisto/vendors-sdk:1.0.0.8307504.

Layouts

GIB Attacks Deface Layout
Updated the GIB Attacks Deface Layout layout to add support for GIB TLP.
New: GIB SPD Layout
New: Added GIB SPD Layout for the GIB SPD incident type.
GIB SPD Layout
Trimmed GIB SPD Layout by removing the unused Linked Incidents, Child Incidents, Evidence and Team Members widgets from the Incident Info tab and the Evidence Board / Related Incidents tabs to keep the layout focused on payment-detail context.
New: GIB Compromised Masked Card Layout
New: Added GIB Compromised Masked Card Layout for the GIB Compromised Masked Card incident type, surfacing card / client / CNC / owner / malware / threat actor / source / evaluation context with the related-indicators grid.
GIB Attacks DDOS Layout
Updated the GIB Attacks DDOS Layout to add the GIB TLP field.
GIB Attacks Phishing Group Layout
Updated the GIB Attacks Phishing Group Layout to add the GIB TLP field.
GIB Attacks Phishing Kit Layout
Updated the GIB Attacks Phishing Kit Layout to add the GIB TLP field.
Updated the GIB Compromised Account Group Layout to add the GIB TLP field.
GIB Compromised Account Group Layout
Updated the GIB Compromised Card Group Layout to add the GIB TLP field.
GIB Compromised Card Group Layout
Updated the GIB Compromised Mule Layout to add the GIB TLP field.
GIB Compromised Mule Layout
Updated the GIB Cybercriminal Threat Layout to add the GIB TLP field.
GIB Cybercriminal Threat Layout
Updated the GIB Data Breach Layout to add the GIB TLP field.
GIB Data Breach Layout
Updated the GIB Nation-State Cybercriminals Threat Layout to add the GIB TLP field.
GIB Nation-State Cybercriminals Threat Layout
Updated the GIB OSI Git Leak Layout to add the GIB TLP field.
GIB OSI Git Leak Layout
Updated the GIB OSI Public Leak Layout to add the GIB TLP field.
GIB OSI Public Leak Layout
Updated the GIB OSI Vulnerability Layout to add the GIB TLP field.
GIB OSI Vulnerability Layout
Updated the GIB Suspicious IP Open Proxy Layout to add the GIB TLP field.
GIB Suspicious IP Open Proxy Layout
Updated the GIB Suspicious IP Scanner Layout to add the GIB TLP field.
GIB Suspicious IP Scanner Layout
Updated the GIB Suspicious IP Socks Proxy Layout to add the GIB TLP field.
GIB Suspicious IP Socks Proxy Layout
Updated the GIB Suspicious IP TOR Node Layout to add the GIB TLP field.
GIB Suspicious IP TOR Node Layout
Updated the GIB Suspicious IP TOR Node Layout to add the GIB TLP field.
GIB Suspicious IP VPN Layout
Updated the GIB Suspicious IP VPN Layout to add the GIB TLP field.

Mappers

Group-IB Threat Intelligence (mapper)

Updated the Group-IB Threat Intelligence (mapper) mapper to populate the GIB TLP field from the source evaluation data.
Updated the Group-IB Threat Intelligence (mapper) mapper to support GIB SPD incident type: full mapping for type, value, serviceType, ownerName, illegalScore, dates (createdAt, firstSeenAt, lastSeenAt), portalLink, events table, sources table, malware table, threat actor table, and evaluation (admiraltyCode, credibility, reliability, severity, TLP, TTL).
Updated the Group-IB Threat Intelligence (mapper) mapper to support GIB Compromised Masked Card incident type: full mapping for card data (BIN, number, CVV, dump, PIN, type, category, payment system, valid-thru), client geo/network context, CNC observables (URL, domain, IPv4 with ASN/region/provider/country), owner data (name, address, birthday, passport, tax number, ZIP, state, city, country, email, phone), price (currency, value), source (sourceType, sourceLink, portalLink), malware (name, ID, STIX GUID), threat actor (name, ID, STIX GUID, country, isAPT), evaluation (admiraltyCode, credibility, reliability, severity, TLP, TTL), and the boolean status flags (isDump, isExpired, isMasked).

Pre Process Rules

GIB Rule

Disabled by default

GIB Rule All Types

Created to work with a new, improved script for a continuous process of deduplication and incident updates

Scripts

GIBIncidentUpdate

Updated the Docker image to: demisto/python3:3.12.13.8428455.

GIBIncidentUpdateAllTypes

Bumped script fromversion to 6.10.0 to align with the rest of the pack.
Added a new fallback Pre-Processing Rule script for customers who want the improved duplicate-handling logic without excluding the GIB Data Breach incident type in rule filters.
Reworked existing-duplicate retrieval to stream getIncidents pages on demand instead of materializing up to MAX_INCIDENTS matches in memory. Memory usage is now bounded by PAGE_SIZE regardless of how many duplicates exist, and setIncident calls are interleaved with page fetches so failures on later pages do not waste work on already-collected updates.
Hardened gibid extraction to look up the incoming incident in CustomFields → top-level → labels → rawJSON order, and guarded reserved keys (id, CustomFields) on setIncident calls so the update payload cannot accidentally redirect to the incoming incident.
The public find_existing_incidents helper is preserved as a backward-compatible adapter (now backed by the new streaming iterator), so existing playbooks and tests continue to work unchanged.

GIBIncidentUpdateIncludingClosed

Updated the Docker image to: demisto/python3:3.12.13.8428455.

Related pull requests:
- 42688
- 44426

Download

2.2.4 - 9117230 (May 18, 2026)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 43937

Download

2.2.3 - 7827247 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43566

Download

2.2.2 - 6088397 (December 1, 2025)

Integrations

Group-IB Threat Intelligence

Breaking Changes: Removed the exclude_combolist parameter (previously named "Exclude All with Combolist type"). This parameter has been replaced with the new Include combolist type in data parameter.
Added support for Include combolist type in data parameter that works only for compromised/account_group. if the parameter is enabled, the response contains combolist data. if you enable "include unique type in data" with this filter, the response will contain data of both types. if "include combolist type in data" and "include unique type in data" are disabled, the response will contain data of both types.
Added support for Limit (items per request) parameter that number of items requested per api page. larger values reduce api roundtrips but may increase response size. serverside caps may apply.
Added support for Include unique type in data parameter that works only for compromised/account_group. if the parameter is enabled, the response contains unique data. if you enable “include combolist type in data” with this filter, the response will contain data of both types. if “include combolist type in data” and “include unique type in data” are disabled, the response will contain data of both types.

Group-IB Threat Intelligence Feed

Added support for Limit (items per request) parameter that number of items requested per api page. larger values reduce api roundtrips but may increase response size. serverside caps may apply.

Scripts

GIBIncidentUpdate

Updated the Docker image to: demisto/python3:3.12.12.5490952.

GIBIncidentUpdateIncludingClosed

Updated the Docker image to: demisto/python3:3.12.12.5490952.

Related pull requests:
- 42104
- 41803

Download

2.1.2 - 5636304 (October 29, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41629

Download

2.1.1 - 5591931 (October 27, 2025)

Integrations

Group-IB Threat Intelligence Feed

Updated the Docker image to: demisto/vendors-sdk:1.0.0.5505539.

Group-IB Threat Intelligence

Updated the Docker image to: demisto/vendors-sdk:1.0.0.5505539.

Related pull requests:
- 41061

Download

2.1.0 - R5469292 (October 20, 2025)

Integrations

Group-IB Threat Intelligence

Added support for Exclude All with Combolist type parameter to exclude all data in the compromised/account_group collection whose SourceType is Combolist.
Added support for Enable filter "Probable Corporate Access parameter allowing the “Probable Corporate Access” filter to be enabled for collection
Fixed a bug with data collection from compromised/account_group and search.

Group-IB Threat Intelligence Feed

Documentation and metadata improvements.

Scripts

GIBIncidentUpdate

Updated the Docker image to: demisto/python3:3.12.8.3296088.

GIBIncidentUpdateIncludingClosed

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 40120
- 40017

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	May 13, 2021
Last Release	May 26, 2026

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.

Group-IB Threat Intelligence

What does this pack do?

What does this pack do?

Classifiers

Group-IB Threat Intelligence (classifier)

Incident Fields

GIB Address

GIB Base Name

GIB CNC

GIB CNC ASN

GIB CNC City

GIB CNC Country Code

GIB CNC Country Name

GIB CNC Domain

GIB CNC IP

GIB CNC Provider

GIB CNC Region

GIB CNC URL

GIB CVV

GIB Card BIN

GIB Card Category

GIB Card Dump

GIB Card Issuer

GIB Card Issuer Country Code

GIB Card Issuer Country Name

GIB Card Number

GIB Card PIN

GIB Card Type

GIB Card Valid Thru

GIB Card Valid Thru Date

GIB Client ASN

GIB Client City

GIB Client Country Code

GIB Client Country Name

GIB Client IP

GIB Client Provider

GIB Client Region

GIB Date Compromised

GIB Date of Detection

GIB Email

GIB Is Dump

GIB Is Expired

GIB Is Masked

GIB Malware ID

GIB Malware Name

GIB Malware STIX GUID

GIB Owner Birthday

GIB Owner City

GIB Owner Country Code

GIB Owner Passport

GIB Owner State

GIB Owner Tax Number

GIB Owner ZIP

GIB Payment System

GIB Person

GIB Price Currency

GIB Price Value

GIB Related Indicators Data

GIB Source

GIB Source Link

GIB Threat Actor Country

GIB Threat Actor ID

GIB Threat Actor Name

GIB Threat Actor STIX GUID

GIB Threat Actor is APT

GIB Track

Incident Types

Integrations

Group-IB Threat Intelligence

Group-IB Threat Intelligence Feed

Layouts

Mappers

Group-IB Threat Intelligence (mapper)

Pre Process Rules

GIB Rule

GIB Rule All Types

Scripts

GIBIncidentUpdate

GIBIncidentUpdateAllTypes

GIBIncidentUpdateIncludingClosed