Group-IB Threat Intelligence

Details
Content
Dependencies
Version History

Group-IB Threat Intelligence is a system for analyzing and attributing cyberattacks, threat hunting, and protecting network infrastructure based on data relating to adversary tactics, tools, and activity. Use this pack to fast receive incidents related to you, attribute them to adversaries to do instant response, enrich your security with an enormous IOCs collection, and provide possibilities for manual investigation through Group-IB data via Cortex XSOAR interface.

Nowadays businesses in any sphere may have problems with their cybersecurity: from simple phishing to professional cybercriminals, so it is very important to respond to incidents quickly.

Group-IB Threat Intelligence Pack can help you with managing your incident and indicators from Group-IB within the SOAR system.

What does this pack do?

Receive incidents and attribute them to adversaries.
Enrich security system with IOCs.
Provide possibilities for manual investigation through Group-IB data via Cortex XSOAR interface.

As part of this pack, you will also get incident types, fields, and layouts; indicator types, fields, and layouts; the classifier and mapper for properly delivering data to these types and fields. Also, you will get a playbook, that enriches incidents, upcoming from Group-IB with threat reports and threat actor information.

Incident Postprocessing - Group-IB Threat Intelligence

Nowadays businesses in any sphere may have problems with their cybersecurity: from simple phishing to professional cybercriminals, so it is very important to respond to incidents quickly.

Group-IB Threat Intelligence Pack can help you with managing your incident and indicators from Group-IB within the SOAR system.

What does this pack do?

Receive incidents and attribute them to adversaries.
Enrich security system with IOCs.
Provide possibilities for manual investigation through Group-IB data via Cortex XSOAR interface.

Incident Postprocessing - Group-IB Threat Intelligence

Automations

Name	Description
GIBIncidentUpdateIncludingClosed	This script prevents duplication of existing incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GIBIncidentUpdate	This script prevents duplication of existing incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Name

Description

GIBIncidentUpdateIncludingClosed

This script prevents duplication of existing incidents.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

GIBIncidentUpdate

This script prevents duplication of existing incidents.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Classifiers

Name	Description
Group-IB Threat Intelligence (classifier)
Group-IB Threat Intelligence (mapper)

Incident Fields

Name	Description
GIB Inject Dump
GIB Card Valid Thru
GIB Malware Name
GIB Leaked Data
GIB Phishing Type
GIB Revisions
GIB Person
GIB Title
GIB Link List
GIB Data Hash
GIB Leak Name
GIB Admiralty Code	The Admiralty System or NATO System is a method for evaluating collected items of intelligence. It consists of a two-character notation, evaluating the reliability of the source and the assessed level of confidence on the information.
GIB Repository
GIB Card Number
GIB Phishing Domain
GIB Date Compromised
GIB Downloaded From
GIB Date Expired
GIB Threat Actor is APT
GIB Target Domain
GIB Phishing Kit Emails
GIB Email
GIB Drop Email Domain
GIB Payment System
GIB Leaked File Name
GIB Source	Where the feed comes from to GIB
GIB Screenshot
GIB Date of Detection
GIB Inject MD5
GIB Related Indicators Data
GIB Target Category
GIB Drop Email
GIB Portal Link
GIB Threat Actor Name
GIB HTML
GIB Threat Actor ID
GIB ID	ID of event in GIB TIA
GIB Password
GIB Phishing Date Blocked
GIB Severity
GIB CVV	Compromised card CVV
GIB Phishing Kit Hash
GIB Matches
GIB Compromised Login
GIB Address
GIB Reliability	Reliability of the source
GIB Card Issuer	Issuer of compromised card
GIB Favicon
GIB Name Servers
GIB Target Brand
GIB Credibility	Level of confidence on the information
GIB Phishing Status
GIB Victim IP
GIB Date Created
GIB Card Type

Incident Types

Name	Description
GIB OSI Public Leak
GIB Compromised Card
GIB Brand Protection Phishing Kit
GIB Data Breach
GIB OSI Git Leak
GIB Brand Protection Phishing
GIB Compromised Account
GIB Targeted Malware

Indicator Fields

Name	Description
GIB Threat Actor Name
GIB ID	ID of event in GIB TI&A
GIB Threat Actor ID
GIB Malware Name
GIB Admiralty Code	The Admiralty System or NATO System is a method for evaluating collected items of intelligence. It consists of a two-character notation, evaluating the reliability of the source and the assessed level of confidence on the information.
GIB Reliability	Reliability of the source
GIB Target Category	What category was targeted by phishing
GIB File Name
GIB Proxy Port
GIB Date Compromised
GIB Phishing Title
GIB Severity
GIB Software Mixed
GIB Credibility	Level of confidence on the information
GIB Threat Actor is APT
GIB Target Domain	What domain was targeted by phishing
GIB Proxy Anonymous	Level of anonymous
GIB CVSS Vector
GIB Target Brand	What brand was targeted by phishing
GIB Collection

Integrations

Name	Description
Group-IB Threat Intelligence (Partner Contribution)	Pack helps to integrate Group-IB Threat Intelligence and get incidents directly into Cortex XSOAR. The list of included collections: Compromised Accounts, Compromised Cards, Brand Protection Phishing, Brand Protection Phishing Kit, OSI Git Leak, OSI Public Leak, Targeted Malware.
Group-IB Threat Intelligence Feed (Partner Contribution)	Use Group-IB Threat Intelligence Feed integration to fetch IOCs from various Group-IB collections.

Layouts

Name	Description
GIB Brand Protection Phishing Kit Layout	Layout for GIB Brand Protection Phishing Kit
GIB Compromised IMEI Layout	Layout for GIB Compromised IMEI
GIB Compromised Mule Layout	Layout for GIB Compromised Mule
GIB OSI Git Leak Layout	Layout for GIB OSI Git Leak
GIB Compromised Card Layout	Layout for GIB Compromised Card
GIB OSI Public Leak Layout	Layout for GIB OSI Public Leak
GIB Data Breach Layout	Layout for GIB Data Breach
GIB Victim IP Layout	Layout for GIB Victim IP
GIB Brand Protection Phishing Layout	Layout for GIB Brand Protection Phishing
GIB Compromised Account Layout	Layout for GIB Compromised Account
GIB Targeted Malware Layout	Layout for GIB Targeted Malware

Playbooks

Name	Description
Incident Postprocessing - Group-IB Threat Intelligence & Attribution	Obtains additional information on the threat actor involved in the incident and associates related indicators to the incident.

Indicator Types

Name	Description
GIB Compromised IMEI
GIB Victim IP
GIB Compromised Mule

Automations

Name	Description
GIBIncidentUpdate	This script prevents duplication of existing incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GIBAlertUpdate	This script prevents duplication of existing alerts. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GIBIncidentUpdateIncludingClosed	This script prevents duplication of existing incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GIBAlertUpdateIncludingClosed	This script prevents duplication of existing alerts. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Classifiers

Name	Description
Group-IB Threat Intelligence (classifier)
Group-IB Threat Intelligence (mapper)

Incident Fields

Name	Description
GIB Phishing Type
GIB Phishing Domain
GIB Target Domain
GIB Portal Link
GIB Person
GIB Phishing Kit Emails
GIB Password
GIB Date Compromised
GIB Target Brand
GIB Leak Name
GIB Title
GIB CVV	Compromised card CVV
GIB Phishing Kit Hash
GIB Link List
GIB Malware Name
GIB Threat Actor ID
GIB Admiralty Code	The Admiralty System or NATO System is a method for evaluating collected items of intelligence. It consists of a two-character notation, evaluating the reliability of the source and the assessed level of confidence on the information.
GIB Reliability	Reliability of the source
GIB Compromised Login
GIB Threat Actor Name
GIB Credibility	Level of confidence on the information
GIB Email
GIB Address
GIB Card Issuer	Issuer of compromised card
GIB Severity
GIB Victim IP
GIB Drop Email
GIB Payment System
GIB Leaked Data
GIB Date Expired
GIB Target Category
GIB Source	Where the feed comes from to GIB
GIB Phishing Status
GIB Downloaded From
GIB Card Type
GIB Phishing Date Blocked
GIB Drop Email Domain
GIB Card Valid Thru
GIB Revisions
GIB Threat Actor is APT
GIB Name Servers
GIB Screenshot
GIB ID	ID of event in GIB TIA
GIB Inject Dump
GIB Matches
GIB Card Number
GIB Date Created
GIB Related Indicators Data
GIB Repository
GIB Date of Detection
GIB Favicon
GIB HTML
GIB Data Hash

Incident Types

Name	Description
GIB Compromised Account
GIB Targeted Malware
GIB Data Breach
GIB OSI Public Leak
GIB Compromised Card
GIB Brand Protection Phishing
GIB OSI Git Leak
GIB Brand Protection Phishing Kit

Indicator Fields

Name	Description
GIB Software Mixed
GIB Target Domain	What domain was targeted by phishing
GIB Target Brand	What brand was targeted by phishing
GIB Severity
GIB Threat Actor is APT
GIB Credibility	Level of confidence on the information
GIB Phishing Title
GIB Malware Name
GIB Proxy Port
GIB Threat Actor Name
GIB CVSS Vector
GIB Collection
GIB Admiralty Code	The Admiralty System or NATO System is a method for evaluating collected items of intelligence. It consists of a two-character notation, evaluating the reliability of the source and the assessed level of confidence on the information.
GIB Threat Actor ID
GIB Reliability	Reliability of the source
GIB Proxy Anonymous	Level of anonymous
GIB Target Category	What category was targeted by phishing
GIB Date Compromised
GIB ID	ID of event in GIB TI&A
GIB File Name

Integrations

Name	Description
Group-IB Threat Intelligence (Partner Contribution)	Pack helps to integrate Group-IB Threat Intelligence and get incidents directly into Cortex. The list of included collections: Compromised Accounts, Compromised Cards, Brand Protection Phishing, Brand Protection Phishing Kit, OSI Git Leak, OSI Public Leak, Targeted Malware.
Group-IB Threat Intelligence Feed (Partner Contribution)	Use Group-IB Threat Intelligence Feed integration to fetch IOCs from various Group-IB collections.

Layouts

Name	Description
GIB Compromised IMEI Layout	Layout for GIB Compromised IMEI
GIB Compromised Mule Layout	Layout for GIB Compromised Mule
GIB Victim IP Layout	Layout for GIB Victim IP

Playbooks

Name	Description
Incident Postprocessing - Group-IB Threat Intelligence & Attribution	Obtains additional information on the threat actor involved in the incident and associates related indicators to the incident.

Indicator Types

Name	Description
GIB Compromised Mule
GIB Compromised IMEI
GIB Victim IP

Required Content Packs (2)

Pack Name	Pack By
Base	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (1)

Pack Name	Pack By
Common Types	By: Cortex XSOAR

All level dependencies (2)

Pack Name	Pack By
Base	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	May 13, 2021
Last Release	December 18, 2024

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.

Group-IB Threat Intelligence

What does this pack do?

What does this pack do?

Scripts

GIBIncidentUpdate

GIBIncidentUpdateIncludingClosed

Integrations

Group-IB Threat Intelligence Feed

Integrations

Group-IB Threat Intelligence

Scripts

GIBIncidentUpdate

GIBIncidentUpdateIncludingClosed

Integrations

Group-IB Threat Intelligence Feed

GroupIB_ThreatIntelligenceAttribution

Integrations

Group-IB Threat Intelligence

Group-IB Threat Intelligence Feed

Scripts

GIBIncidentUpdate

GIBIncidentUpdateIncludingClosed

Classifiers

Group-IB Threat Intelligence (classifier)

Integrations

Group-IB Threat Intelligence

Group-IB Threat Intelligence Feed

Mappers

Group-IB Threat Intelligence (mapper)

Scripts

GIBIncidentUpdateIncludingClosed

GIBIncidentUpdate

PUBLISHER

PLATFORMS

INFO

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER