Group-IB Intelligence

The Group-IB Intelligence connector enables seamless integration with Swimlane Turbine, allowing users to access a wide range of cyber threat intelligence directly within their security automation workflows.

Group-IB Intelligence is a comprehensive threat intelligence platform that provides actionable insights into cyber threats and fraud. By integrating with Swimlane Turbine, users can automate the retrieval of intelligence data such as compromised credentials, phishing campaigns, and indicators of compromise (IOCs). This connector enables security teams to enhance their threat detection and response capabilities by leveraging Group-IB's extensive dark web monitoring and analysis. The streamlined access to Group-IB's intelligence within Swimlane Turbine's low-code environment empowers users to proactively defend against evolving cyber threats and reduce incident response times.

Prerequisites

To effectively utilize the Group-IB Intelligence connector within Swimlane Turbine, ensure you have the following prerequisites:

HTTP Basic Authentication with the following parameters:

URL: The endpoint URL for the Group-IB Intelligence API.

Username: Your Group-IB Intelligence account username.

API Key: A valid API key provided by Group-IB Intelligence for secure access.

Asset

The Group-IB Connector requires Username and API Key.

Group-IB accepts connections only from whitelisted IP addresses. If a customer is using Swimlane on-cloud solution, they should contact the Swimlane Infrastructure team to get the public IPs of the instance and whitelist them in Group-IB Portal.

Group-IB has strict rate limiting and raises 429 Client Error: Too Many Requests for url. The customer should wait for at least 15sec before making another request.

Capabilities

The Group-IB Intelligence Connector provides the following capabilities:

Get Access

Get Account Group

Get Bank Card Group

Get Breached

Get Discord

Get GIT Repository

Get IoC Common List

Get Masked Card

Get Messenger

Get Phishing Info

Get Phishing Kit Info

Get Public Leak

Get Reaper

Get Updated Items(APT.Threat)

Get Updated Items(IocCommon) ... and so on

Notes

API Documentation: https://tap.group-ib.com/hc/api

Additional Documentation

Group-IB Intelligence Connector Documentation

Group-IB Intelligence API Documentation

Configurations

HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	API Key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Access

Retrieve the latest compromised data intelligence from dark web marketplaces using Group-IB Intelligence.

Endpoint

URL: /api/v2/compromised/access/updated

Method: GET

Input

Argument Name	Type	Required	Description
parameters.seqUpdate	number	Optional	Sequence update number.
parameters.limit	number	Optional	Limit the amount of returned data for this collection.
parameters.apply_hunting_rules	number	Optional	Parameters for the Get Access action

Input Example

{"parameters":{"seqUpdate":0,"limit":10,"apply_hunting_rules":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.accessType	string	Type of the resource
items.cnc	object	Output field: items.cnc
items.cnc.cnc	string	Output field: items.cnc.cnc
items.cnc.domain	string	Output field: items.cnc.domain
items.cnc.ipv4	object	Output field: items.cnc.ipv4
items.cnc.ipv4.asn	string	Output field: items.cnc.ipv4.asn
items.cnc.ipv4.city	string	Output field: items.cnc.ipv4.city
items.cnc.ipv4.countryCode	string	Output field: items.cnc.ipv4.countryCode
items.cnc.ipv4.countryName	string	Name of the resource
items.cnc.ipv4.ip	string	Output field: items.cnc.ipv4.ip
items.cnc.ipv4.provider	string	Unique identifier
items.cnc.ipv4.region	string	Output field: items.cnc.ipv4.region
items.cnc.ipv6	object	Output field: items.cnc.ipv6
items.cnc.ipv6.asn	string	Output field: items.cnc.ipv6.asn
items.cnc.ipv6.city	string	Output field: items.cnc.ipv6.city
items.cnc.ipv6.countryCode	string	Output field: items.cnc.ipv6.countryCode
items.cnc.ipv6.countryName	string	Name of the resource
items.cnc.ipv6.ip	string	Output field: items.cnc.ipv6.ip
items.cnc.ipv6.provider	string	Unique identifier
items.cnc.ipv6.region	string	Output field: items.cnc.ipv6.region
items.cnc.url	string	URL endpoint for the request
items.dateCompromised	string	Output field: items.dateCompromised

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"count":1}}

Get Account Group

Retrieve the latest account group information from Group-IB Intelligence for up-to-date data access.

Endpoint

URL: /api/v2/compromised/account_group/updated

Method: GET

Input

Argument Name	Type	Required	Description
parameters.seqUpdate	number	Optional	Sequence update number.
parameters.limit	number	Optional	Limit the amount of returned data for this collection.
parameters.apply_hunting_rules	number	Optional	Parameters for the Get Account Group action

Input Example

{"parameters":{"seqUpdate":0,"limit":10,"apply_hunting_rules":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.dateFirstCompromised	string	Output field: items.dateFirstCompromised
items.dateFirstSeen	string	Output field: items.dateFirstSeen
items.dateLastCompromised	string	Output field: items.dateLastCompromised
items.dateLastSeen	string	Output field: items.dateLastSeen
items.displayOptions	object	Output field: items.displayOptions
items.evaluation	object	Output field: items.evaluation
items.evaluation.admiraltyCode	string	Output field: items.evaluation.admiraltyCode
items.evaluation.credibility	number	Output field: items.evaluation.credibility
items.evaluation.reliability	number	Output field: items.evaluation.reliability
items.evaluation.severity	string	Output field: items.evaluation.severity
items.evaluation.tlp	string	Output field: items.evaluation.tlp
items.evaluation.ttl	number	Output field: items.evaluation.ttl
items.eventCount	number	Count value
items.events	array	Output field: items.events
items.events.client	object	Output field: items.events.client
items.events.client.ipv4	object	Output field: items.events.client.ipv4
items.events.client.ipv4.asn	string	Output field: items.events.client.ipv4.asn
items.events.client.ipv4.city	string	Output field: items.events.client.ipv4.city
items.events.client.ipv4.countryCode	string	Output field: items.events.client.ipv4.countryCode
items.events.client.ipv4.countryName	string	Name of the resource
items.events.client.ipv4.ip	string	Output field: items.events.client.ipv4.ip
items.events.client.ipv4.provider	string	Unique identifier

Output Example

{"items":[{"dateFirstCompromised":"string","dateFirstSeen":"string","dateLastCompromised":"string","dateLastSeen":"string","displayOptions":{},"evaluation":{},"eventCount":123,"events":[],"id":"12345678-1234-1234-1234-123456789abc","login":"string","malware":[],"parsedLogin":{},"password":"string","port":123,"seqUpdate":123}],"count":123}

Get Bank Card Group

Retrieve grouped data on compromised bank cards from various sources as collected by Group-IB Intelligence.

Endpoint

URL: /api/v2/compromised/bank_card_group/updated

Method: GET

Input

Argument Name	Type	Required	Description
parameters.seqUpdate	number	Optional	Parameters for the Get Bank Card Group action
parameters.limit	number	Optional	Parameters for the Get Bank Card Group action
parameters.apply_hunting_rules	number	Optional	Parameters for the Get Bank Card Group action

Input Example

{"parameters":{"seqUpdate":0,"limit":10,"apply_hunting_rules":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.baseName	string	Name of the resource
items.cardInfo	object	Output field: items.cardInfo
items.cardInfo.bin	array	Output field: items.cardInfo.bin
items.cardInfo.issuer	object	Output field: items.cardInfo.issuer
items.cardInfo.issuer.countryCode	string	Output field: items.cardInfo.issuer.countryCode
items.cardInfo.issuer.countryName	string	Name of the resource
items.cardInfo.issuer.issuer	string	Output field: items.cardInfo.issuer.issuer
items.cardInfo.number	string	Output field: items.cardInfo.number
items.cardInfo.system	string	Output field: items.cardInfo.system
items.cardInfo.type	string	Type of the resource
items.dateFirstCompromised	string	Output field: items.dateFirstCompromised
items.dateFirstSeen	string	Output field: items.dateFirstSeen
items.dateLastCompromised	string	Output field: items.dateLastCompromised
items.dateLastSeen	string	Output field: items.dateLastSeen
items.displayOptions	object	Output field: items.displayOptions
items.evaluation	object	Output field: items.evaluation
items.evaluation.admiraltyCode	string	Output field: items.evaluation.admiraltyCode
items.evaluation.credibility	number	Output field: items.evaluation.credibility
items.evaluation.reliability	number	Output field: items.evaluation.reliability
items.evaluation.severity	string	Output field: items.evaluation.severity
items.evaluation.tlp	string	Output field: items.evaluation.tlp
items.evaluation.ttl	number	Output field: items.evaluation.ttl

Output Example

{"items":[{"baseName":"Example Name","cardInfo":{},"dateFirstCompromised":"string","dateFirstSeen":"string","dateLastCompromised":"string","dateLastSeen":"string","displayOptions":{},"evaluation":{},"eventCount":123,"events":[],"id":"12345678-1234-1234-1234-123456789abc","malware":[],"seqUpdate":123,"serviceCode":"string","source":[]}],"count":123}

Get Breached

Obtain a list of breached items from Group-IB Intelligence, offering insights into compromised data.

Endpoint

URL: /api/v2/compromised/breached

Method: GET

Input

Argument Name	Type	Required	Description
parameters.q	string	Optional	Search query.
parameters.df	string	Optional	Date from.
parameters.dt	string	Optional	Date to.
parameters.limit	number	Optional	Limit the number of results.
parameters.resultId	string	Optional	Result ID is to get the next data chunk.
parameters.apply_hunting_rules	number	Optional	Parameters for the Get Breached action

Input Example

{"parameters":{"q":"test","df":"2019-08-20T14:15:22Z","dt":"2019-08-24T14:15:22Z","limit":10,"resultId":"1234567890","apply_hunting_rules":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
resultId	string	Unique identifier
items	array	Output field: items
items.addInfo	object	Output field: items.addInfo
items.email	array	Output field: items.email
items.evaluation	object	Output field: items.evaluation
items.evaluation.admiraltyCode	string	Output field: items.evaluation.admiraltyCode
items.evaluation.credibility	number	Output field: items.evaluation.credibility
items.evaluation.reliability	number	Output field: items.evaluation.reliability
items.evaluation.severity	string	Output field: items.evaluation.severity
items.evaluation.tlp	string	Output field: items.evaluation.tlp
items.evaluation.ttl	number	Output field: items.evaluation.ttl
items.id	array	Unique identifier
items.leakName	string	Name of the resource
items.password	array	Output field: items.password
items.updateTime	string	Time value
items.uploadTime	string	Time value
count	number	Count value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"resultId":"1234567890","items":[{}],"count":0}}

Get Discord

Retrieve Discord-related threat intelligence data from Group-IB Intelligence, with no specific input parameters needed.

Endpoint

URL: /api/v2/compromised/discord/updated

Method: GET

Input

Argument Name	Type	Required	Description
parameters.seqUpdate	number	Optional	Sequence update number.
parameters.limit	number	Optional	Limit the amount of returned data for this collection.
parameters.apply_hunting_rules	number	Optional	Parameters for the Get Discord action

Input Example

{"parameters":{"seqUpdate":0,"limit":10,"apply_hunting_rules":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.author	object	Output field: items.author
items.author.avatar	string	Output field: items.author.avatar
items.author.discriminator	string	Output field: items.author.discriminator
items.author.id	string	Unique identifier
items.author.name	string	Name of the resource
items.channel	object	Output field: items.channel
items.channel.avatar	string	Output field: items.channel.avatar
items.channel.description	object	Output field: items.channel.description
items.channel.description.topic	string	Output field: items.channel.description.topic
items.channel.id	string	Unique identifier
items.channel.name	string	Name of the resource
items.channel.parsedCounters	object	Output field: items.channel.parsedCounters
items.channel.parsedCounters.channels	number	Output field: items.channel.parsedCounters.channels
items.channel.parsedCounters.domain	number	Output field: items.channel.parsedCounters.domain
items.channel.parsedCounters.files	number	Output field: items.channel.parsedCounters.files
items.channel.parsedCounters.ip	number	Output field: items.channel.parsedCounters.ip
items.channel.parsedCounters.links	number	Output field: items.channel.parsedCounters.links
items.channel.parsedCounters.media	number	Output field: items.channel.parsedCounters.media
items.channel.server	string	Output field: items.channel.server
items.channel.serverId	string	Unique identifier
items.channel.stat	object	Output field: items.channel.stat
items.channel.stat.firstMessageDate	string	Response message

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"count":1}}

Get GIT Repository

Retrieve the latest updates from a specified Git repository within the Group-IB Intelligence platform.

Endpoint

URL: /api/v2/osi/git_repository/updated

Method: GET

Input

Argument Name	Type	Required	Description
parameters.seqUpdate	number	Optional	Sequence update number.
parameters.limit	number	Optional	Limit the amount of returned data for this collection.
parameters.apply_hunting_rules	number	Optional	Parameters for the Get GIT Repository action

Input Example

{"parameters":{"seqUpdate":0,"limit":10,"apply_hunting_rules":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.contributors	array	Output field: items.contributors
items.contributors.authorEmail	string	Output field: items.contributors.authorEmail
items.contributors.authorName	string	Name of the resource
items.dataFound	object	Response data
items.dataFound.property1	number	Response data
items.dataFound.property2	number	Response data
items.dateCreated	string	Output field: items.dateCreated
items.dateDetected	string	Output field: items.dateDetected
items.evaluation	object	Output field: items.evaluation
items.evaluation.admiraltyCode	string	Output field: items.evaluation.admiraltyCode
items.evaluation.credibility	number	Output field: items.evaluation.credibility
items.evaluation.reliability	number	Output field: items.evaluation.reliability
items.evaluation.severity	string	Output field: items.evaluation.severity
items.evaluation.tlp	string	Output field: items.evaluation.tlp
items.evaluation.ttl	number	Output field: items.evaluation.ttl
items.files	array	Output field: items.files
items.files.dataFound	object	Response data
items.files.dateCreated	string	Output field: items.files.dateCreated
items.files.dateDetected	string	Output field: items.files.dateDetected
items.files.evaluation	object	Output field: items.files.evaluation
items.files.evaluation.admiraltyCode	string	Output field: items.files.evaluation.admiraltyCode
items.files.evaluation.credibility	number	Output field: items.files.evaluation.credibility

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"count":1}}

Get IOC Common List

Retrieve a list of common Indicators of Compromise (IOCs) from Group-IB Intelligence.

Endpoint

URL: api/v2/ioc/common

Method: GET

Input

Argument Name	Type	Required	Description
parameters.q	string	Optional	Parameters for the Get IOC Common List action
parameters.df	string	Optional	Parameters for the Get IOC Common List action
parameters.dt	string	Optional	Parameters for the Get IOC Common List action
parameters.resultId	string	Optional	Parameters for the Get IOC Common List action

Input Example

{"parameters":{"q":"string","df":"string","dt":"string","resultId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
resultId	string	Unique identifier
items	array	Output field: items
items.ThreatActorList	array	Output field: items.ThreatActorList
items.ThreatActorList.id	string	Unique identifier
items.ThreatActorList.isAPT	boolean	Output field: items.ThreatActorList.isAPT
items.ThreatActorList.name	string	Name of the resource
items.dateFirstSeen	string	Output field: items.dateFirstSeen
items.dateLastSeen	string	Output field: items.dateLastSeen
items.domain	string	Output field: items.domain
items.hash	array	Output field: items.hash
items.id	string	Unique identifier
items.ip	array	Output field: items.ip
items.malwareList	array	Output field: items.malwareList
items.malwareList.category	array	Output field: items.malwareList.category
items.malwareList.class	string	Output field: items.malwareList.class
items.malwareList.id	string	Unique identifier
items.malwareList.name	string	Name of the resource
items.malwareList.platform	array	Output field: items.malwareList.platform
items.malwareList.stixGuid	string	Unique identifier
items.malwareList.threatLevel	string	Output field: items.malwareList.threatLevel
items.seqUpdate	number	Date value
items.sources	object	Output field: items.sources
items.sources.additionalProp1	object	Output field: items.sources.additionalProp1

Output Example

{"status_code":200,"response_headers":{"Allow":"GET","Cache-Control":"no-cache, private","Content-Encoding":"gzip","Content-Security-Policy":"frame-ancestors 'self';","Content-Type":"application/json","Date":"Fri, 29 Sep 2023 06:22:29 GMT","Feature-Policy":"camera 'none';microphone 'none';geolocation 'none';encrypted-media 'none';paymen...","Permissions-Policy":"camera=(),microphone=(),geolocation=(),encrypted-media=(),payment=(),speaker=(),...","Referrer-Policy":"strict-origin-when-cross-origin...

Get Masked Card

Retrieves details on compromised masked cards from various sources within Group-IB Intelligence.

Endpoint

URL: /api/v2/compromised/masked_card/updated

Method: GET

Input

Argument Name	Type	Required	Description
parameters.seqUpdate	number	Optional	Parameters for the Get Masked Card action
parameters.limit	number	Optional	Parameters for the Get Masked Card action
parameters.apply_hunting_rules	number	Optional	Parameters for the Get Masked Card action

Input Example

{"parameters":{"seqUpdate":0,"limit":10,"apply_hunting_rules":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.baseName	string	Name of the resource
items.cardInfo	object	Output field: items.cardInfo
items.cardInfo.cvv	string	Output field: items.cardInfo.cvv
items.cardInfo.dump	string	Output field: items.cardInfo.dump
items.cardInfo.issuer	object	Output field: items.cardInfo.issuer
items.cardInfo.issuer.countryCode	string	Output field: items.cardInfo.issuer.countryCode
items.cardInfo.issuer.countryName	string	Name of the resource
items.cardInfo.issuer.issuer	string	Output field: items.cardInfo.issuer.issuer
items.cardInfo.number	string	Output field: items.cardInfo.number
items.cardInfo.pin	string	Output field: items.cardInfo.pin
items.cardInfo.system	string	Output field: items.cardInfo.system
items.cardInfo.type	string	Type of the resource
items.cardInfo.validThru	string	Unique identifier
items.client	object	Output field: items.client
items.client.ipv4	object	Output field: items.client.ipv4
items.client.ipv4.asn	string	Output field: items.client.ipv4.asn
items.client.ipv4.city	string	Output field: items.client.ipv4.city
items.client.ipv4.countryCode	string	Output field: items.client.ipv4.countryCode
items.client.ipv4.countryName	string	Name of the resource
items.client.ipv4.ip	string	Output field: items.client.ipv4.ip
items.client.ipv4.provider	string	Unique identifier
items.client.ipv4.region	string	Output field: items.client.ipv4.region

Output Example

{"items":[{"baseName":"Example Name","cardInfo":{},"client":{},"cnc":{},"dateCompromised":"string","dateDetected":"string","evaluation":{},"externalId":"string","id":"12345678-1234-1234-1234-123456789abc","malware":{},"oldId":"string","owner":{},"price":{},"seqUpdate":123,"serviceCode":"string"}],"count":123}

Get Messenger

Retrieve messenger-related intelligence, including account details and associated data from Group-IB Intelligence.

Endpoint

URL: /api/v2/compromised/messenger/updated

Method: GET

Input

Argument Name	Type	Required	Description
parameters.seqUpdate	number	Optional	Sequence update number.
parameters.limit	number	Optional	Limit the amount of returned data for this collection.
parameters.apply_hunting_rules	number	Optional	Parameters for the Get Messenger action

Input Example

{"parameters":{"seqUpdate":0,"limit":10,"apply_hunting_rules":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.author	object	Output field: items.author
items.author.id	string	Unique identifier
items.author.userName	string	Name of the resource
items.chatStat	object	Output field: items.chatStat
items.chatStat.avatar	object	Output field: items.chatStat.avatar
items.chatStat.avatar.detected	string	Output field: items.chatStat.avatar.detected
items.chatStat.avatar.hash	string	Output field: items.chatStat.avatar.hash
items.chatStat.avatar.id	string	Unique identifier
items.chatStat.firstMessageTs	string	Response message
items.chatStat.id	number	Unique identifier
items.chatStat.lastMessageTs	string	Response message
items.chatStat.messageNum	number	Response message
items.chatStat.name	string	Name of the resource
items.chatStat.title	string	Output field: items.chatStat.title
items.chatStat.type	string	Type of the resource
items.chatStat.userNum	number	Output field: items.chatStat.userNum
items.edits	object	Output field: items.edits
items.highlight	array	Output field: items.highlight
items.id	string	Unique identifier
items.isReply	boolean	Output field: items.isReply
items.lastEditTs	string	Output field: items.lastEditTs
items.message	string	Response message

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"count":1}}

Get Phishing

Retrieve detailed phishing campaign data from Group-IB Intelligence, including threat actor details and attack vectors.

Endpoint

URL: api/v2/attacks/phishing

Method: GET

Input

Argument Name	Type	Required	Description
parameters.q	string	Optional	Parameters for the Get Phishing action
parameters.df	string	Optional	Parameters for the Get Phishing action
parameters.dt	string	Optional	Parameters for the Get Phishing action
parameters.resultId	string	Optional	Parameters for the Get Phishing action

Input Example

{"parameters":{"q":"string","df":"string","dt":"string","resultId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
resultId	string	Unique identifier
count	number	Count value
items	array	Output field: items
items.file_name	string	Name of the resource
items.file	string	Output field: items.file

Output Example

{"status_code":200,"response_headers":{"Allow":"GET","Cache-Control":"max-age=0, must-revalidate, private","Content-Encoding":"gzip","Content-Security-Policy":"frame-ancestors 'self';","Content-Type":"application/json","Date":"Fri, 29 Sep 2023 03:57:56 GMT","Expires":"Fri, 29 Sep 2023 03:57:56 GMT","Feature-Policy":"camera 'none';microphone 'none';geolocation 'none';encrypted-media 'none';paymen...","Permissions-Policy":"camera=(),microphone=(),geolocation=(),encrypted-media=(),payment=(),speake...

Get Phishing Kit

Retrieve detailed information about phishing kits from Group-IB Intelligence for analysis and threat response.

Endpoint

URL: api/v2/attacks/phishing_kit

Method: GET

Input

Argument Name	Type	Required	Description
parameters.q	string	Optional	Parameters for the Get Phishing Kit action
parameters.df	string	Optional	Parameters for the Get Phishing Kit action
parameters.dt	string	Optional	Parameters for the Get Phishing Kit action
parameters.resultId	string	Optional	Parameters for the Get Phishing Kit action

Input Example

{"parameters":{"q":"string","df":"string","dt":"string","resultId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
resultId	string	Unique identifier
count	number	Count value
items	array	Output field: items
items.dateDetected	string	Output field: items.dateDetected
items.dateFirstSeen	string	Output field: items.dateFirstSeen
items.dateLastSeen	string	Output field: items.dateLastSeen
items.downloadedFrom	array	Output field: items.downloadedFrom
items.downloadedFrom.date	string	Date value
items.downloadedFrom.url	string	URL endpoint for the request
items.downloadedFrom.domain	string	Output field: items.downloadedFrom.domain
items.downloadedFrom.filename	object	Name of the resource
items.emails	array	Output field: items.emails
items.evaluation	object	Output field: items.evaluation
items.evaluation.admiraltyCode	string	Output field: items.evaluation.admiraltyCode
items.evaluation.credibility	number	Output field: items.evaluation.credibility
items.evaluation.reliability	number	Output field: items.evaluation.reliability
items.evaluation.severity	string	Output field: items.evaluation.severity
items.evaluation.tlp	string	Output field: items.evaluation.tlp
items.evaluation.ttl	number	Output field: items.evaluation.ttl
items.hash	string	Output field: items.hash
items.id	string	Unique identifier
items.isFavourite	boolean	Output field: items.isFavourite
items.isHidden	boolean	Unique identifier

Output Example

{"resultId":"string","count":123,"items":[{"dateDetected":"string","dateFirstSeen":"string","dateLastSeen":"string","downloadedFrom":[],"emails":[],"evaluation":{},"hash":"string","id":"12345678-1234-1234-1234-123456789abc","isFavourite":true,"isHidden":true,"oldId":"string","path":"string","portalLink":"string","seqUpdate":123,"targetBrand":[]}]}

Get Public Leak

Retrieve details and metadata of a public data leak from Group-IB Intelligence.

Endpoint

URL: /api/v2/osi/public_leak/updated

Method: GET

Input

Argument Name	Type	Required	Description
parameters.seqUpdate	number	Optional	Sequence update number.
parameters.limit	number	Optional	Limit the amount of returned data for this collection.
parameters.apply_hunting_rules	number	Optional	Parameters for the Get Public Leak action

Input Example

{"parameters":{"seqUpdate":0,"limit":10,"apply_hunting_rules":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.bind	array	Output field: items.bind
items.bind.id	string	Unique identifier
items.bind.key	string	Output field: items.bind.key
items.bind.ruleValue	string	Value for the parameter
items.bind.type	string	Type of the resource
items.created	string	Output field: items.created
items.data	string	Response data
items.displayOptions	object	Output field: items.displayOptions
items.evaluation	object	Output field: items.evaluation
items.evaluation.admiraltyCode	string	Output field: items.evaluation.admiraltyCode
items.evaluation.credibility	number	Output field: items.evaluation.credibility
items.evaluation.reliability	number	Output field: items.evaluation.reliability
items.evaluation.severity	string	Output field: items.evaluation.severity
items.evaluation.tlp	string	Output field: items.evaluation.tlp
items.evaluation.ttl	number	Output field: items.evaluation.ttl
items.hash	string	Output field: items.hash
items.id	string	Unique identifier
items.language	string	Output field: items.language
items.linkList	array	Output field: items.linkList
items.linkList.author	string	Output field: items.linkList.author
items.linkList.dateDetected	string	Output field: items.linkList.dateDetected
items.linkList.datePublished	string	Output field: items.linkList.datePublished

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"count":1}}

Get Reaper

Retrieve messages from the Reaper collection in Group-IB Intelligence, encompassing closed forum communications for cybercriminal attack planning.

Endpoint

URL: /api/v2/compromised/reaper

Method: GET

Input

Argument Name	Type	Required	Description
parameters.q	string	Optional	Search query.
parameters.df	string	Optional	Date from.
parameters.dt	string	Optional	Date to.
parameters.limit	number	Optional	Limit the number of results.
parameters.resultId	string	Optional	Result ID is to get the next data chunk.
parameters.apply_hunting_rules	number	Optional	Parameters for the Get Reaper action

Input Example

{"parameters":{"q":"test","df":"2019-08-20T14:15:22Z","dt":"2019-08-24T14:15:22Z","limit":10,"resultId":"1234567890","apply_hunting_rules":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
resultId	string	Unique identifier
items	array	Output field: items
items.id	string	Unique identifier
items.topic	string	Output field: items.topic
items.topicHash	string	Output field: items.topicHash
items.message	string	Response message
items.message_hash	string	Response message
items.lang	object	Output field: items.lang
items.lang.detected	string	Output field: items.lang.detected
items.lang.confidence	number	Unique identifier
items.message_lang	object	Response message
items.message_lang.detected	string	Response message
items.message_lang.confidence	number	Unique identifier
items.message_len	number	Response message
items.datetime	string	Time value
items.last_post	string	Output field: items.last_post
items.first_post	boolean	Output field: items.first_post
items.forum	string	Output field: items.forum
items.domain	string	Output field: items.domain
items.url	string	URL endpoint for the request
items.nickname	string	Name of the resource
items.nicknameUrl	string	URL endpoint for the request
items.uploadTime	string	Time value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"resultId":"res-7fa921bc","items":[{}],"count":1}}

Get Updated Items APT Threat

Retrieve the latest APT threat intelligence updates from Group-IB Intelligence.

Endpoint

URL: api/v2/apt/threat/updated

Method: GET

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	Parameters for the Get Updated Items APT Threat action

Input Example

{"parameters":{"limit":25}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.contacts	array	Output field: items.contacts
items.contacts.account	string	Count value
items.contacts.flag	string	Output field: items.contacts.flag
items.contacts.service	string	Output field: items.contacts.service
items.contacts.type	string	Type of the resource
items.countries	string	Output field: items.countries
items.createdAt	string	Output field: items.createdAt
items.cveList	array	Output field: items.cveList
items.cveList.name	string	Name of the resource
items.dateFirstSeen	string	Output field: items.dateFirstSeen
items.dateLastSeen	string	Output field: items.dateLastSeen
items.datePublished	string	Output field: items.datePublished
items.description	string	Output field: items.description
items.displayOptions	object	Output field: items.displayOptions
items.evaluation	object	Output field: items.evaluation
items.evaluation.admiraltyCode	string	Output field: items.evaluation.admiraltyCode
items.evaluation.credibility	number	Output field: items.evaluation.credibility
items.evaluation.reliability	number	Output field: items.evaluation.reliability
items.evaluation.severity	string	Output field: items.evaluation.severity
items.evaluation.tlp	string	Output field: items.evaluation.tlp
items.evaluation.ttl	number	Output field: items.evaluation.ttl
items.expertise	array	Output field: items.expertise

Output Example

{"status_code":200,"response_headers":{"Cache-Control":"no-cache, private","Content-Encoding":"gzip","Content-Security-Policy":"frame-ancestors 'self';","Content-Type":"application/json","Date":"Tue, 09 Jan 2024 09:06:07 GMT","Feature-Policy":"camera 'none';microphone 'none';geolocation 'none';encrypted-media 'none';paymen...","Permissions-Policy":"camera=(),microphone=(),geolocation=(),encrypted-media=(),payment=(),speaker=(),...","Referrer-Policy":"strict-origin-when-cross-origin","Server":"is...

Get Updated Items IocCommon

Retrieve the latest updates for IocCommon items from Group-IB Intelligence, ensuring current threat intelligence.

Endpoint

URL: api/v2/ioc/common/updated

Method: GET

Input

Argument Name	Type	Required	Description
parameters.seqUpdate	number	Optional	Parameters for the Get Updated Items IocCommon action
parameters.limit	number	Optional	Parameters for the Get Updated Items IocCommon action

Input Example

{"parameters":{"seqUpdate":1,"limit":25}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.ThreatActorList	array	Output field: items.ThreatActorList
items.ThreatActorList.id	string	Unique identifier
items.ThreatActorList.isAPT	boolean	Output field: items.ThreatActorList.isAPT
items.ThreatActorList.name	string	Name of the resource
items.dateFirstSeen	string	Output field: items.dateFirstSeen
items.dateLastSeen	string	Output field: items.dateLastSeen
items.domain	string	Output field: items.domain
items.hash	array	Output field: items.hash
items.id	string	Unique identifier
items.ip	array	Output field: items.ip
items.malwareList	array	Output field: items.malwareList
items.malwareList.category	array	Output field: items.malwareList.category
items.malwareList.class	string	Output field: items.malwareList.class
items.malwareList.id	string	Unique identifier
items.malwareList.name	string	Name of the resource
items.malwareList.platform	array	Output field: items.malwareList.platform
items.malwareList.stixGuid	string	Unique identifier
items.malwareList.threatLevel	string	Output field: items.malwareList.threatLevel
items.seqUpdate	number	Date value
items.sources	object	Output field: items.sources
items.threatList	array	Output field: items.threatList
items.threatList.name	string	Name of the resource

Output Example

Search API

Retrieve search results from Group-IB Intelligence using specified query parameters.

Endpoint

URL: api/v2/search

Method: GET

Input

Argument Name	Type	Required	Description
parameters.q	string	Optional	Parameters for the Search API action
parameters.lang	string	Optional	Parameters for the Search API action

Input Example

{"parameters":{"q":"","lang":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

Response Headers

Header	Description	Example
Allow	HTTP response header: Allow	GET
Cache-Control	Directives for caching mechanisms	max-age=0, must-revalidate, private
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Security-Policy	HTTP response header: Content-Security-Policy	frame-ancestors 'self';
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Fri, 29 Sep 2023 06:22:29 GMT
Expires	The date/time after which the response is considered stale	Fri, 29 Sep 2023 03:57:56 GMT
Feature-Policy	HTTP response header: Feature-Policy	camera 'none';microphone 'none';geolocation 'none';encrypted-media 'none';payment 'none';speaker 'none';usb 'none';
Permissions-Policy	HTTP response header: Permissions-Policy	camera=(),microphone=(),geolocation=(),encrypted-media=(),payment=(),speaker=(),usb=(),
Referrer-Policy	HTTP response header: Referrer-Policy	strict-origin-when-cross-origin
Server	Information about the software used by the origin server	istio-envoy
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=31536000; includeSubDomains
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
Vary	HTTP response header: Vary	Accept-Encoding
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
X-Dns-Prefetch-Control	HTTP response header: X-Dns-Prefetch-Control	off
X-Download-Options	HTTP response header: X-Download-Options	noopen
X-Frame-Options	HTTP response header: X-Frame-Options	sameorigin
X-Xss-Protection	HTTP response header: X-Xss-Protection	1; mode=block