--- title: Group-IB Intelligence slug: connectors/group-ib-intelligence docTags: createdAt: 2026-06-09T16:30:03.008Z --- The Group-IB Intelligence connector enables seamless integration with Swimlane Turbine, allowing users to access a wide range of cyber threat intelligence directly within their security automation workflows. Group-IB Intelligence is a comprehensive threat intelligence platform that provides actionable insights into cyber threats and fraud. By integrating with Swimlane Turbine, users can automate the retrieval of intelligence data such as compromised credentials, phishing campaigns, and indicators of compromise (IOCs). This connector enables security teams to enhance their threat detection and response capabilities by leveraging Group-IB's extensive dark web monitoring and analysis. The streamlined access to Group-IB's intelligence within Swimlane Turbine's low-code environment empowers users to proactively defend against evolving cyber threats and reduce incident response times. ## Prerequisites To effectively utilize the Group-IB Intelligence connector within Swimlane Turbine, ensure you have the following prerequisites: - HTTP Basic Authentication with the following parameters: - URL: The endpoint URL for the Group-IB Intelligence API. - Username: Your Group-IB Intelligence account username. - API Key: A valid API key provided by Group-IB Intelligence for secure access. ## Asset - The Group-IB Connector requires Username and API Key. - Group-IB accepts connections only from whitelisted IP addresses. If a customer is using Swimlane on-cloud solution, they should contact the Swimlane Infrastructure team to get the public IPs of the instance and whitelist them in Group-IB Portal. - Group-IB has strict rate limiting and raises `429 Client Error: Too Many Requests for url`. The customer should wait for at least 15sec before making another request. ## Capabilities The Group-IB Intelligence Connector provides the following capabilities: - Get Access - Get Account Group - Get Bank Card Group - Get Breached - Get Discord - Get GIT Repository - Get IoC Common List - Get Masked Card - Get Messenger - Get Phishing Info - Get Phishing Kit Info - Get Public Leak - Get Reaper - Get Updated Items(APT.Threat) - Get Updated Items(IocCommon) *... and so on* ## Notes API Documentation: [https://tap.group-ib.com/hc/api](https://tap.group-ib.com/hc/api) ## Additional Documentation - [Group-IB Intelligence Connector Documentation](https://docs.swimlane.com/connectors/group-ib-intelligence) - [Group-IB Intelligence API Documentation](https://tap.group-ib.com/api/) # Configurations ## HTTP Basic Authentication Authenticates using username and password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Username | string | Required | | password | API Key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Access Retrieve the latest compromised data intelligence from dark web marketplaces using Group-IB Intelligence. ### Endpoint - **URL:** `/api/v2/compromised/access/updated` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ------------------------------------------------------ | | `parameters.seqUpdate` | number | Optional | Sequence update number. | | `parameters.limit` | number | Optional | Limit the amount of returned data for this collection. | | `parameters.apply_hunting_rules` | number | Optional | Parameters for the Get Access action | ### Input Example `{"parameters":{"seqUpdate":0,"limit":10,"apply_hunting_rules":1}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.accessType` | string | Type of the resource | | `items.cnc` | object | Output field: items.cnc | | `items.cnc.cnc` | string | Output field: items.cnc.cnc | | `items.cnc.domain` | string | Output field: items.cnc.domain | | `items.cnc.ipv4` | object | Output field: items.cnc.ipv4 | | `items.cnc.ipv4.asn` | string | Output field: items.cnc.ipv4.asn | | `items.cnc.ipv4.city` | string | Output field: items.cnc.ipv4.city | | `items.cnc.ipv4.countryCode` | string | Output field: items.cnc.ipv4.countryCode | | `items.cnc.ipv4.countryName` | string | Name of the resource | | `items.cnc.ipv4.ip` | string | Output field: items.cnc.ipv4.ip | | `items.cnc.ipv4.provider` | string | Unique identifier | | `items.cnc.ipv4.region` | string | Output field: items.cnc.ipv4.region | | `items.cnc.ipv6` | object | Output field: items.cnc.ipv6 | | `items.cnc.ipv6.asn` | string | Output field: items.cnc.ipv6.asn | | `items.cnc.ipv6.city` | string | Output field: items.cnc.ipv6.city | | `items.cnc.ipv6.countryCode` | string | Output field: items.cnc.ipv6.countryCode | | `items.cnc.ipv6.countryName` | string | Name of the resource | | `items.cnc.ipv6.ip` | string | Output field: items.cnc.ipv6.ip | | `items.cnc.ipv6.provider` | string | Unique identifier | | `items.cnc.ipv6.region` | string | Output field: items.cnc.ipv6.region | | `items.cnc.url` | string | URL endpoint for the request | | `items.dateCompromised` | string | Output field: items.dateCompromised | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"count":1}}` ## Get Account Group Retrieve the latest account group information from Group-IB Intelligence for up-to-date data access. ### Endpoint - **URL:** `/api/v2/compromised/account_group/updated` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ------------------------------------------------------ | | `parameters.seqUpdate` | number | Optional | Sequence update number. | | `parameters.limit` | number | Optional | Limit the amount of returned data for this collection. | | `parameters.apply_hunting_rules` | number | Optional | Parameters for the Get Account Group action | ### Input Example `{"parameters":{"seqUpdate":0,"limit":10,"apply_hunting_rules":1}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | -------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.dateFirstCompromised` | string | Output field: items.dateFirstCompromised | | `items.dateFirstSeen` | string | Output field: items.dateFirstSeen | | `items.dateLastCompromised` | string | Output field: items.dateLastCompromised | | `items.dateLastSeen` | string | Output field: items.dateLastSeen | | `items.displayOptions` | object | Output field: items.displayOptions | | `items.evaluation` | object | Output field: items.evaluation | | `items.evaluation.admiraltyCode` | string | Output field: items.evaluation.admiraltyCode | | `items.evaluation.credibility` | number | Output field: items.evaluation.credibility | | `items.evaluation.reliability` | number | Output field: items.evaluation.reliability | | `items.evaluation.severity` | string | Output field: items.evaluation.severity | | `items.evaluation.tlp` | string | Output field: items.evaluation.tlp | | `items.evaluation.ttl` | number | Output field: items.evaluation.ttl | | `items.eventCount` | number | Count value | | `items.events` | array | Output field: items.events | | `items.events.client` | object | Output field: items.events.client | | `items.events.client.ipv4` | object | Output field: items.events.client.ipv4 | | `items.events.client.ipv4.asn` | string | Output field: items.events.client.ipv4.asn | | `items.events.client.ipv4.city` | string | Output field: items.events.client.ipv4.city | | `items.events.client.ipv4.countryCode` | string | Output field: items.events.client.ipv4.countryCode | | `items.events.client.ipv4.countryName` | string | Name of the resource | | `items.events.client.ipv4.ip` | string | Output field: items.events.client.ipv4.ip | | `items.events.client.ipv4.provider` | string | Unique identifier | ### Output Example `{"items":[{"dateFirstCompromised":"string","dateFirstSeen":"string","dateLastCompromised":"string","dateLastSeen":"string","displayOptions":{},"evaluation":{},"eventCount":123,"events":[],"id":"12345678-1234-1234-1234-123456789abc","login":"string","malware":[],"parsedLogin":{},"password":"string","port":123,"seqUpdate":123}],"count":123}` ## Get Bank Card Group Retrieve grouped data on compromised bank cards from various sources as collected by Group-IB Intelligence. ### Endpoint - **URL:** `/api/v2/compromised/bank_card_group/updated` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | --------------------------------------------- | | `parameters.seqUpdate` | number | Optional | Parameters for the Get Bank Card Group action | | `parameters.limit` | number | Optional | Parameters for the Get Bank Card Group action | | `parameters.apply_hunting_rules` | number | Optional | Parameters for the Get Bank Card Group action | ### Input Example `{"parameters":{"seqUpdate":0,"limit":10,"apply_hunting_rules":1}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | ----------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.baseName` | string | Name of the resource | | `items.cardInfo` | object | Output field: items.cardInfo | | `items.cardInfo.bin` | array | Output field: items.cardInfo.bin | | `items.cardInfo.issuer` | object | Output field: items.cardInfo.issuer | | `items.cardInfo.issuer.countryCode` | string | Output field: items.cardInfo.issuer.countryCode | | `items.cardInfo.issuer.countryName` | string | Name of the resource | | `items.cardInfo.issuer.issuer` | string | Output field: items.cardInfo.issuer.issuer | | `items.cardInfo.number` | string | Output field: items.cardInfo.number | | `items.cardInfo.system` | string | Output field: items.cardInfo.system | | `items.cardInfo.type` | string | Type of the resource | | `items.dateFirstCompromised` | string | Output field: items.dateFirstCompromised | | `items.dateFirstSeen` | string | Output field: items.dateFirstSeen | | `items.dateLastCompromised` | string | Output field: items.dateLastCompromised | | `items.dateLastSeen` | string | Output field: items.dateLastSeen | | `items.displayOptions` | object | Output field: items.displayOptions | | `items.evaluation` | object | Output field: items.evaluation | | `items.evaluation.admiraltyCode` | string | Output field: items.evaluation.admiraltyCode | | `items.evaluation.credibility` | number | Output field: items.evaluation.credibility | | `items.evaluation.reliability` | number | Output field: items.evaluation.reliability | | `items.evaluation.severity` | string | Output field: items.evaluation.severity | | `items.evaluation.tlp` | string | Output field: items.evaluation.tlp | | `items.evaluation.ttl` | number | Output field: items.evaluation.ttl | ### Output Example `{"items":[{"baseName":"Example Name","cardInfo":{},"dateFirstCompromised":"string","dateFirstSeen":"string","dateLastCompromised":"string","dateLastSeen":"string","displayOptions":{},"evaluation":{},"eventCount":123,"events":[],"id":"12345678-1234-1234-1234-123456789abc","malware":[],"seqUpdate":123,"serviceCode":"string","source":[]}],"count":123}` ## Get Breached Obtain a list of breached items from Group-IB Intelligence, offering insights into compromised data. ### Endpoint - **URL:** `/api/v2/compromised/breached` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ---------------------------------------- | | `parameters.q` | string | Optional | Search query. | | `parameters.df` | string | Optional | Date from. | | `parameters.dt` | string | Optional | Date to. | | `parameters.limit` | number | Optional | Limit the number of results. | | `parameters.resultId` | string | Optional | Result ID is to get the next data chunk. | | `parameters.apply_hunting_rules` | number | Optional | Parameters for the Get Breached action | ### Input Example `{"parameters":{"q":"test","df":"2019-08-20T14:15:22Z","dt":"2019-08-24T14:15:22Z","limit":10,"resultId":"1234567890","apply_hunting_rules":1}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `resultId` | string | Unique identifier | | `items` | array | Output field: items | | `items.addInfo` | object | Output field: items.addInfo | | `items.email` | array | Output field: items.email | | `items.evaluation` | object | Output field: items.evaluation | | `items.evaluation.admiraltyCode` | string | Output field: items.evaluation.admiraltyCode | | `items.evaluation.credibility` | number | Output field: items.evaluation.credibility | | `items.evaluation.reliability` | number | Output field: items.evaluation.reliability | | `items.evaluation.severity` | string | Output field: items.evaluation.severity | | `items.evaluation.tlp` | string | Output field: items.evaluation.tlp | | `items.evaluation.ttl` | number | Output field: items.evaluation.ttl | | `items.id` | array | Unique identifier | | `items.leakName` | string | Name of the resource | | `items.password` | array | Output field: items.password | | `items.updateTime` | string | Time value | | `items.uploadTime` | string | Time value | | `count` | number | Count value | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"resultId":"1234567890","items":[{}],"count":0}}` ## Get Discord Retrieve Discord-related threat intelligence data from Group-IB Intelligence, with no specific input parameters needed. ### Endpoint - **URL:** `/api/v2/compromised/discord/updated` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ------------------------------------------------------ | | `parameters.seqUpdate` | number | Optional | Sequence update number. | | `parameters.limit` | number | Optional | Limit the amount of returned data for this collection. | | `parameters.apply_hunting_rules` | number | Optional | Parameters for the Get Discord action | ### Input Example `{"parameters":{"seqUpdate":0,"limit":10,"apply_hunting_rules":1}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | --------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.author` | object | Output field: items.author | | `items.author.avatar` | string | Output field: items.author.avatar | | `items.author.discriminator` | string | Output field: items.author.discriminator | | `items.author.id` | string | Unique identifier | | `items.author.name` | string | Name of the resource | | `items.channel` | object | Output field: items.channel | | `items.channel.avatar` | string | Output field: items.channel.avatar | | `items.channel.description` | object | Output field: items.channel.description | | `items.channel.description.topic` | string | Output field: items.channel.description.topic | | `items.channel.id` | string | Unique identifier | | `items.channel.name` | string | Name of the resource | | `items.channel.parsedCounters` | object | Output field: items.channel.parsedCounters | | `items.channel.parsedCounters.channels` | number | Output field: items.channel.parsedCounters.channels | | `items.channel.parsedCounters.domain` | number | Output field: items.channel.parsedCounters.domain | | `items.channel.parsedCounters.files` | number | Output field: items.channel.parsedCounters.files | | `items.channel.parsedCounters.ip` | number | Output field: items.channel.parsedCounters.ip | | `items.channel.parsedCounters.links` | number | Output field: items.channel.parsedCounters.links | | `items.channel.parsedCounters.media` | number | Output field: items.channel.parsedCounters.media | | `items.channel.server` | string | Output field: items.channel.server | | `items.channel.serverId` | string | Unique identifier | | `items.channel.stat` | object | Output field: items.channel.stat | | `items.channel.stat.firstMessageDate` | string | Response message | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"count":1}}` ## Get GIT Repository Retrieve the latest updates from a specified Git repository within the Group-IB Intelligence platform. ### Endpoint - **URL:** `/api/v2/osi/git_repository/updated` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ------------------------------------------------------ | | `parameters.seqUpdate` | number | Optional | Sequence update number. | | `parameters.limit` | number | Optional | Limit the amount of returned data for this collection. | | `parameters.apply_hunting_rules` | number | Optional | Parameters for the Get GIT Repository action | ### Input Example `{"parameters":{"seqUpdate":0,"limit":10,"apply_hunting_rules":1}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | -------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.contributors` | array | Output field: items.contributors | | `items.contributors.authorEmail` | string | Output field: items.contributors.authorEmail | | `items.contributors.authorName` | string | Name of the resource | | `items.dataFound` | object | Response data | | `items.dataFound.property1` | number | Response data | | `items.dataFound.property2` | number | Response data | | `items.dateCreated` | string | Output field: items.dateCreated | | `items.dateDetected` | string | Output field: items.dateDetected | | `items.evaluation` | object | Output field: items.evaluation | | `items.evaluation.admiraltyCode` | string | Output field: items.evaluation.admiraltyCode | | `items.evaluation.credibility` | number | Output field: items.evaluation.credibility | | `items.evaluation.reliability` | number | Output field: items.evaluation.reliability | | `items.evaluation.severity` | string | Output field: items.evaluation.severity | | `items.evaluation.tlp` | string | Output field: items.evaluation.tlp | | `items.evaluation.ttl` | number | Output field: items.evaluation.ttl | | `items.files` | array | Output field: items.files | | `items.files.dataFound` | object | Response data | | `items.files.dateCreated` | string | Output field: items.files.dateCreated | | `items.files.dateDetected` | string | Output field: items.files.dateDetected | | `items.files.evaluation` | object | Output field: items.files.evaluation | | `items.files.evaluation.admiraltyCode` | string | Output field: items.files.evaluation.admiraltyCode | | `items.files.evaluation.credibility` | number | Output field: items.files.evaluation.credibility | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"count":1}}` ## Get IOC Common List Retrieve a list of common Indicators of Compromise (IOCs) from Group-IB Intelligence. ### Endpoint - **URL:** `api/v2/ioc/common` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | --------------------------------------------- | | `parameters.q` | string | Optional | Parameters for the Get IOC Common List action | | `parameters.df` | string | Optional | Parameters for the Get IOC Common List action | | `parameters.dt` | string | Optional | Parameters for the Get IOC Common List action | | `parameters.resultId` | string | Optional | Parameters for the Get IOC Common List action | ### Input Example `{"parameters":{"q":"string","df":"string","dt":"string","resultId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `resultId` | string | Unique identifier | | `items` | array | Output field: items | | `items.ThreatActorList` | array | Output field: items.ThreatActorList | | `items.ThreatActorList.id` | string | Unique identifier | | `items.ThreatActorList.isAPT` | boolean | Output field: items.ThreatActorList.isAPT | | `items.ThreatActorList.name` | string | Name of the resource | | `items.dateFirstSeen` | string | Output field: items.dateFirstSeen | | `items.dateLastSeen` | string | Output field: items.dateLastSeen | | `items.domain` | string | Output field: items.domain | | `items.hash` | array | Output field: items.hash | | `items.id` | string | Unique identifier | | `items.ip` | array | Output field: items.ip | | `items.malwareList` | array | Output field: items.malwareList | | `items.malwareList.category` | array | Output field: items.malwareList.category | | `items.malwareList.class` | string | Output field: items.malwareList.class | | `items.malwareList.id` | string | Unique identifier | | `items.malwareList.name` | string | Name of the resource | | `items.malwareList.platform` | array | Output field: items.malwareList.platform | | `items.malwareList.stixGuid` | string | Unique identifier | | `items.malwareList.threatLevel` | string | Output field: items.malwareList.threatLevel | | `items.seqUpdate` | number | Date value | | `items.sources` | object | Output field: items.sources | | `items.sources.additionalProp1` | object | Output field: items.sources.additionalProp1 | ### Output Example `{"status_code":200,"response_headers":{"Allow":"GET","Cache-Control":"no-cache, private","Content-Encoding":"gzip","Content-Security-Policy":"frame-ancestors 'self';","Content-Type":"application/json","Date":"Fri, 29 Sep 2023 06:22:29 GMT","Feature-Policy":"camera 'none';microphone 'none';geolocation 'none';encrypted-media 'none';paymen...","Permissions-Policy":"camera=(),microphone=(),geolocation=(),encrypted-media=(),payment=(),speaker=(),...","Referrer-Policy":"strict-origin-when-cross-origin...` ## Get Masked Card Retrieves details on compromised masked cards from various sources within Group-IB Intelligence. ### Endpoint - **URL:** `/api/v2/compromised/masked_card/updated` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ----------------------------------------- | | `parameters.seqUpdate` | number | Optional | Parameters for the Get Masked Card action | | `parameters.limit` | number | Optional | Parameters for the Get Masked Card action | | `parameters.apply_hunting_rules` | number | Optional | Parameters for the Get Masked Card action | ### Input Example `{"parameters":{"seqUpdate":0,"limit":10,"apply_hunting_rules":1}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | ----------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.baseName` | string | Name of the resource | | `items.cardInfo` | object | Output field: items.cardInfo | | `items.cardInfo.cvv` | string | Output field: items.cardInfo.cvv | | `items.cardInfo.dump` | string | Output field: items.cardInfo.dump | | `items.cardInfo.issuer` | object | Output field: items.cardInfo.issuer | | `items.cardInfo.issuer.countryCode` | string | Output field: items.cardInfo.issuer.countryCode | | `items.cardInfo.issuer.countryName` | string | Name of the resource | | `items.cardInfo.issuer.issuer` | string | Output field: items.cardInfo.issuer.issuer | | `items.cardInfo.number` | string | Output field: items.cardInfo.number | | `items.cardInfo.pin` | string | Output field: items.cardInfo.pin | | `items.cardInfo.system` | string | Output field: items.cardInfo.system | | `items.cardInfo.type` | string | Type of the resource | | `items.cardInfo.validThru` | string | Unique identifier | | `items.client` | object | Output field: items.client | | `items.client.ipv4` | object | Output field: items.client.ipv4 | | `items.client.ipv4.asn` | string | Output field: items.client.ipv4.asn | | `items.client.ipv4.city` | string | Output field: items.client.ipv4.city | | `items.client.ipv4.countryCode` | string | Output field: items.client.ipv4.countryCode | | `items.client.ipv4.countryName` | string | Name of the resource | | `items.client.ipv4.ip` | string | Output field: items.client.ipv4.ip | | `items.client.ipv4.provider` | string | Unique identifier | | `items.client.ipv4.region` | string | Output field: items.client.ipv4.region | ### Output Example `{"items":[{"baseName":"Example Name","cardInfo":{},"client":{},"cnc":{},"dateCompromised":"string","dateDetected":"string","evaluation":{},"externalId":"string","id":"12345678-1234-1234-1234-123456789abc","malware":{},"oldId":"string","owner":{},"price":{},"seqUpdate":123,"serviceCode":"string"}],"count":123}` ## Get Messenger Retrieve messenger-related intelligence, including account details and associated data from Group-IB Intelligence. ### Endpoint - **URL:** `/api/v2/compromised/messenger/updated` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ------------------------------------------------------ | | `parameters.seqUpdate` | number | Optional | Sequence update number. | | `parameters.limit` | number | Optional | Limit the amount of returned data for this collection. | | `parameters.apply_hunting_rules` | number | Optional | Parameters for the Get Messenger action | ### Input Example `{"parameters":{"seqUpdate":0,"limit":10,"apply_hunting_rules":1}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.author` | object | Output field: items.author | | `items.author.id` | string | Unique identifier | | `items.author.userName` | string | Name of the resource | | `items.chatStat` | object | Output field: items.chatStat | | `items.chatStat.avatar` | object | Output field: items.chatStat.avatar | | `items.chatStat.avatar.detected` | string | Output field: items.chatStat.avatar.detected | | `items.chatStat.avatar.hash` | string | Output field: items.chatStat.avatar.hash | | `items.chatStat.avatar.id` | string | Unique identifier | | `items.chatStat.firstMessageTs` | string | Response message | | `items.chatStat.id` | number | Unique identifier | | `items.chatStat.lastMessageTs` | string | Response message | | `items.chatStat.messageNum` | number | Response message | | `items.chatStat.name` | string | Name of the resource | | `items.chatStat.title` | string | Output field: items.chatStat.title | | `items.chatStat.type` | string | Type of the resource | | `items.chatStat.userNum` | number | Output field: items.chatStat.userNum | | `items.edits` | object | Output field: items.edits | | `items.highlight` | array | Output field: items.highlight | | `items.id` | string | Unique identifier | | `items.isReply` | boolean | Output field: items.isReply | | `items.lastEditTs` | string | Output field: items.lastEditTs | | `items.message` | string | Response message | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"count":1}}` ## Get Phishing Retrieve detailed phishing campaign data from Group-IB Intelligence, including threat actor details and attack vectors. ### Endpoint - **URL:** `api/v2/attacks/phishing` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | -------------------------------------- | | `parameters.q` | string | Optional | Parameters for the Get Phishing action | | `parameters.df` | string | Optional | Parameters for the Get Phishing action | | `parameters.dt` | string | Optional | Parameters for the Get Phishing action | | `parameters.resultId` | string | Optional | Parameters for the Get Phishing action | ### Input Example `{"parameters":{"q":"string","df":"string","dt":"string","resultId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `resultId` | string | Unique identifier | | `count` | number | Count value | | `items` | array | Output field: items | | `items.file_name` | string | Name of the resource | | `items.file` | string | Output field: items.file | ### Output Example `{"status_code":200,"response_headers":{"Allow":"GET","Cache-Control":"max-age=0, must-revalidate, private","Content-Encoding":"gzip","Content-Security-Policy":"frame-ancestors 'self';","Content-Type":"application/json","Date":"Fri, 29 Sep 2023 03:57:56 GMT","Expires":"Fri, 29 Sep 2023 03:57:56 GMT","Feature-Policy":"camera 'none';microphone 'none';geolocation 'none';encrypted-media 'none';paymen...","Permissions-Policy":"camera=(),microphone=(),geolocation=(),encrypted-media=(),payment=(),speake...` ## Get Phishing Kit Retrieve detailed information about phishing kits from Group-IB Intelligence for analysis and threat response. ### Endpoint - **URL:** `api/v2/attacks/phishing_kit` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ------------------------------------------ | | `parameters.q` | string | Optional | Parameters for the Get Phishing Kit action | | `parameters.df` | string | Optional | Parameters for the Get Phishing Kit action | | `parameters.dt` | string | Optional | Parameters for the Get Phishing Kit action | | `parameters.resultId` | string | Optional | Parameters for the Get Phishing Kit action | ### Input Example `{"parameters":{"q":"string","df":"string","dt":"string","resultId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `resultId` | string | Unique identifier | | `count` | number | Count value | | `items` | array | Output field: items | | `items.dateDetected` | string | Output field: items.dateDetected | | `items.dateFirstSeen` | string | Output field: items.dateFirstSeen | | `items.dateLastSeen` | string | Output field: items.dateLastSeen | | `items.downloadedFrom` | array | Output field: items.downloadedFrom | | `items.downloadedFrom.date` | string | Date value | | `items.downloadedFrom.url` | string | URL endpoint for the request | | `items.downloadedFrom.domain` | string | Output field: items.downloadedFrom.domain | | `items.downloadedFrom.filename` | object | Name of the resource | | `items.emails` | array | Output field: items.emails | | `items.evaluation` | object | Output field: items.evaluation | | `items.evaluation.admiraltyCode` | string | Output field: items.evaluation.admiraltyCode | | `items.evaluation.credibility` | number | Output field: items.evaluation.credibility | | `items.evaluation.reliability` | number | Output field: items.evaluation.reliability | | `items.evaluation.severity` | string | Output field: items.evaluation.severity | | `items.evaluation.tlp` | string | Output field: items.evaluation.tlp | | `items.evaluation.ttl` | number | Output field: items.evaluation.ttl | | `items.hash` | string | Output field: items.hash | | `items.id` | string | Unique identifier | | `items.isFavourite` | boolean | Output field: items.isFavourite | | `items.isHidden` | boolean | Unique identifier | ### Output Example `{"resultId":"string","count":123,"items":[{"dateDetected":"string","dateFirstSeen":"string","dateLastSeen":"string","downloadedFrom":[],"emails":[],"evaluation":{},"hash":"string","id":"12345678-1234-1234-1234-123456789abc","isFavourite":true,"isHidden":true,"oldId":"string","path":"string","portalLink":"string","seqUpdate":123,"targetBrand":[]}]}` ## Get Public Leak Retrieve details and metadata of a public data leak from Group-IB Intelligence. ### Endpoint - **URL:** `/api/v2/osi/public_leak/updated` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ------------------------------------------------------ | | `parameters.seqUpdate` | number | Optional | Sequence update number. | | `parameters.limit` | number | Optional | Limit the amount of returned data for this collection. | | `parameters.apply_hunting_rules` | number | Optional | Parameters for the Get Public Leak action | ### Input Example `{"parameters":{"seqUpdate":0,"limit":10,"apply_hunting_rules":1}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.bind` | array | Output field: items.bind | | `items.bind.id` | string | Unique identifier | | `items.bind.key` | string | Output field: items.bind.key | | `items.bind.ruleValue` | string | Value for the parameter | | `items.bind.type` | string | Type of the resource | | `items.created` | string | Output field: items.created | | `items.data` | string | Response data | | `items.displayOptions` | object | Output field: items.displayOptions | | `items.evaluation` | object | Output field: items.evaluation | | `items.evaluation.admiraltyCode` | string | Output field: items.evaluation.admiraltyCode | | `items.evaluation.credibility` | number | Output field: items.evaluation.credibility | | `items.evaluation.reliability` | number | Output field: items.evaluation.reliability | | `items.evaluation.severity` | string | Output field: items.evaluation.severity | | `items.evaluation.tlp` | string | Output field: items.evaluation.tlp | | `items.evaluation.ttl` | number | Output field: items.evaluation.ttl | | `items.hash` | string | Output field: items.hash | | `items.id` | string | Unique identifier | | `items.language` | string | Output field: items.language | | `items.linkList` | array | Output field: items.linkList | | `items.linkList.author` | string | Output field: items.linkList.author | | `items.linkList.dateDetected` | string | Output field: items.linkList.dateDetected | | `items.linkList.datePublished` | string | Output field: items.linkList.datePublished | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"count":1}}` ## Get Reaper Retrieve messages from the Reaper collection in Group-IB Intelligence, encompassing closed forum communications for cybercriminal attack planning. ### Endpoint - **URL:** `/api/v2/compromised/reaper` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ---------------------------------------- | | `parameters.q` | string | Optional | Search query. | | `parameters.df` | string | Optional | Date from. | | `parameters.dt` | string | Optional | Date to. | | `parameters.limit` | number | Optional | Limit the number of results. | | `parameters.resultId` | string | Optional | Result ID is to get the next data chunk. | | `parameters.apply_hunting_rules` | number | Optional | Parameters for the Get Reaper action | ### Input Example `{"parameters":{"q":"test","df":"2019-08-20T14:15:22Z","dt":"2019-08-24T14:15:22Z","limit":10,"resultId":"1234567890","apply_hunting_rules":1}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | --------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `resultId` | string | Unique identifier | | `items` | array | Output field: items | | `items.id` | string | Unique identifier | | `items.topic` | string | Output field: items.topic | | `items.topicHash` | string | Output field: items.topicHash | | `items.message` | string | Response message | | `items.message_hash` | string | Response message | | `items.lang` | object | Output field: items.lang | | `items.lang.detected` | string | Output field: items.lang.detected | | `items.lang.confidence` | number | Unique identifier | | `items.message_lang` | object | Response message | | `items.message_lang.detected` | string | Response message | | `items.message_lang.confidence` | number | Unique identifier | | `items.message_len` | number | Response message | | `items.datetime` | string | Time value | | `items.last_post` | string | Output field: items.last\_post | | `items.first_post` | boolean | Output field: items.first\_post | | `items.forum` | string | Output field: items.forum | | `items.domain` | string | Output field: items.domain | | `items.url` | string | URL endpoint for the request | | `items.nickname` | string | Name of the resource | | `items.nicknameUrl` | string | URL endpoint for the request | | `items.uploadTime` | string | Time value | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"resultId":"res-7fa921bc","items":[{}],"count":1}}` ## Get Updated Items APT Threat Retrieve the latest APT threat intelligence updates from Group-IB Intelligence. ### Endpoint - **URL:** `api/v2/apt/threat/updated` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ------------------------------------------------------ | | `parameters.limit` | number | Optional | Parameters for the Get Updated Items APT Threat action | ### Input Example `{"parameters":{"limit":25}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.contacts` | array | Output field: items.contacts | | `items.contacts.account` | string | Count value | | `items.contacts.flag` | string | Output field: items.contacts.flag | | `items.contacts.service` | string | Output field: items.contacts.service | | `items.contacts.type` | string | Type of the resource | | `items.countries` | string | Output field: items.countries | | `items.createdAt` | string | Output field: items.createdAt | | `items.cveList` | array | Output field: items.cveList | | `items.cveList.name` | string | Name of the resource | | `items.dateFirstSeen` | string | Output field: items.dateFirstSeen | | `items.dateLastSeen` | string | Output field: items.dateLastSeen | | `items.datePublished` | string | Output field: items.datePublished | | `items.description` | string | Output field: items.description | | `items.displayOptions` | object | Output field: items.displayOptions | | `items.evaluation` | object | Output field: items.evaluation | | `items.evaluation.admiraltyCode` | string | Output field: items.evaluation.admiraltyCode | | `items.evaluation.credibility` | number | Output field: items.evaluation.credibility | | `items.evaluation.reliability` | number | Output field: items.evaluation.reliability | | `items.evaluation.severity` | string | Output field: items.evaluation.severity | | `items.evaluation.tlp` | string | Output field: items.evaluation.tlp | | `items.evaluation.ttl` | number | Output field: items.evaluation.ttl | | `items.expertise` | array | Output field: items.expertise | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-cache, private","Content-Encoding":"gzip","Content-Security-Policy":"frame-ancestors 'self';","Content-Type":"application/json","Date":"Tue, 09 Jan 2024 09:06:07 GMT","Feature-Policy":"camera 'none';microphone 'none';geolocation 'none';encrypted-media 'none';paymen...","Permissions-Policy":"camera=(),microphone=(),geolocation=(),encrypted-media=(),payment=(),speaker=(),...","Referrer-Policy":"strict-origin-when-cross-origin","Server":"is...` ## Get Updated Items IocCommon Retrieve the latest updates for IocCommon items from Group-IB Intelligence, ensuring current threat intelligence. ### Endpoint - **URL:** `api/v2/ioc/common/updated` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ----------------------------------------------------- | | `parameters.seqUpdate` | number | Optional | Parameters for the Get Updated Items IocCommon action | | `parameters.limit` | number | Optional | Parameters for the Get Updated Items IocCommon action | ### Input Example `{"parameters":{"seqUpdate":1,"limit":25}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.ThreatActorList` | array | Output field: items.ThreatActorList | | `items.ThreatActorList.id` | string | Unique identifier | | `items.ThreatActorList.isAPT` | boolean | Output field: items.ThreatActorList.isAPT | | `items.ThreatActorList.name` | string | Name of the resource | | `items.dateFirstSeen` | string | Output field: items.dateFirstSeen | | `items.dateLastSeen` | string | Output field: items.dateLastSeen | | `items.domain` | string | Output field: items.domain | | `items.hash` | array | Output field: items.hash | | `items.id` | string | Unique identifier | | `items.ip` | array | Output field: items.ip | | `items.malwareList` | array | Output field: items.malwareList | | `items.malwareList.category` | array | Output field: items.malwareList.category | | `items.malwareList.class` | string | Output field: items.malwareList.class | | `items.malwareList.id` | string | Unique identifier | | `items.malwareList.name` | string | Name of the resource | | `items.malwareList.platform` | array | Output field: items.malwareList.platform | | `items.malwareList.stixGuid` | string | Unique identifier | | `items.malwareList.threatLevel` | string | Output field: items.malwareList.threatLevel | | `items.seqUpdate` | number | Date value | | `items.sources` | object | Output field: items.sources | | `items.threatList` | array | Output field: items.threatList | | `items.threatList.name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-cache, private","Content-Encoding":"gzip","Content-Security-Policy":"frame-ancestors 'self';","Content-Type":"application/json","Date":"Tue, 09 Jan 2024 09:06:07 GMT","Feature-Policy":"camera 'none';microphone 'none';geolocation 'none';encrypted-media 'none';paymen...","Permissions-Policy":"camera=(),microphone=(),geolocation=(),encrypted-media=(),payment=(),speaker=(),...","Referrer-Policy":"strict-origin-when-cross-origin","Server":"is...` ## Search API Retrieve search results from Group-IB Intelligence using specified query parameters. ### Endpoint - **URL:** `api/v2/search` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------ | | `parameters.q` | string | Optional | Parameters for the Search API action | | `parameters.lang` | string | Optional | Parameters for the Search API action | ### Input Example `{"parameters":{"q":"","lang":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-cache, private","Content-Encoding":"gzip","Content-Security-Policy":"frame-ancestors 'self';","Content-Type":"application/json","Date":"Tue, 09 Jan 2024 09:06:07 GMT","Feature-Policy":"camera 'none';microphone 'none';geolocation 'none';encrypted-media 'none';paymen...","Permissions-Policy":"camera=(),microphone=(),geolocation=(),encrypted-media=(),payment=(),speaker=(),...","Referrer-Policy":"strict-origin-when-cross-origin","Server":"is...` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | | Allow | HTTP response header: Allow | GET | | Cache-Control | Directives for caching mechanisms | max-age=0, must-revalidate, private | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Security-Policy | HTTP response header: Content-Security-Policy | frame-ancestors 'self'; | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Fri, 29 Sep 2023 06:22:29 GMT | | Expires | The date/time after which the response is considered stale | Fri, 29 Sep 2023 03:57:56 GMT | | Feature-Policy | HTTP response header: Feature-Policy | camera 'none';microphone 'none';geolocation 'none';encrypted-media 'none';payment 'none';speaker 'none';usb 'none'; | | Permissions-Policy | HTTP response header: Permissions-Policy | camera=(),microphone=(),geolocation=(),encrypted-media=(),payment=(),speaker=(),usb=(), | | Referrer-Policy | HTTP response header: Referrer-Policy | strict-origin-when-cross-origin | | Server | Information about the software used by the origin server | istio-envoy | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000; includeSubDomains | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | Vary | HTTP response header: Vary | Accept-Encoding | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-Dns-Prefetch-Control | HTTP response header: X-Dns-Prefetch-Control | off | | X-Download-Options | HTTP response header: X-Download-Options | noopen | | X-Frame-Options | HTTP response header: X-Frame-Options | sameorigin | | X-Xss-Protection | HTTP response header: X-Xss-Protection | 1; mode=block |