GIBIndicatorProcessor

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

Author: Hesham Saad

Attribute	Value
Type	Playbook
Solution	Group-IB
Source	View on GitHub

⚠️ Not listed in Solution JSON: This content item was discovered by scanning the solution folder but is not included in the official Solution JSON file. It may be a legacy item, under development, or excluded from the official solution package.

Logic App Connectors

This playbook uses 1 Logic App connector / built-in action:

Connector / Action	Type	Connections	Actions
`microsoftgraphsecurity`	Managed	1	1

Action parameters (URLs, paths, function IDs)

`microsoftgraphsecurity` (Managed)

Action	Method	Endpoint	Other
Submit_multiple_tiIndicators	post	`/beta/security/tiIndicators/submitTiIndicators`	—

Additional Documentation

📄 Source: readme.md

Ingest Group-IB Threat Intelligence & Attribution Feeds and Indicators Collections

Author: Hesham Saad

Group-IB Azure Sentinel playbooks designed by Group-IB team and supported by Microsoft team to ingest Threat Intelligence & Attribution feeds and indicators from multiple Group-IB data collections and writes them to Microsoft Security Graph API to be listed under Azure Sentinel ThreatIntelligenceIndicators table and custom log tables as well for adversaries, threat actors,...etc

There are a number of pre-configuration steps required before deploying the playbooks.

Group-IB Sentinel Playbooks Collections Detailed Description

"GIBIndicatorProcessor" Playbook
This playbook is used to send indicators to Microsoft Security Graph API from all other GIB playbooks.

"GIBTIA_APT_Threats" Playbook
a. Collection: apt/threat
b. Has Indicators: Yes
c. Indicators Content:
GIB APT Threat Indicator(IPv4)
GIB APT Threat Indicator(domain)
GIB APT Threat Indicator(url)
GIB APT Threat Indicator(md5)
GIB APT Threat Indicator(sha256)
GIB APT Threat Indicator(sha1)
d. Description:
Group-IB continuously monitors activities undertaken by hacker groups, investigate, collect, and analyze information about all emerging and ongoing attacks. Based on this information, we provide IOC's related to APT Groups Attacks.

"GIBTIA_APT_ThreatActor" Playbook
a. Collection: apt/threat_actor
b. Has Indicators: No
c. Indicators Content: N/A
d. Description:
This collection contains APT groups’ info, with detailed descriptions.

"GIBTIA_Attacks_ddos" Playbook
a. Collection: attacks/ddos
b. Has Indicators: Yes
c. Indicators Content:
GIB DDoS Attack(IPv4)
d. Description:
The "DDoS attacks" collection contains a DDoS Attacks targets and C2 indicators.

"GIBTIA_Attacks_deface" Playbook
a. Collection: attacks/deface
b. Has Indicators: Yes
c. Indicators Content:
GIB Attack Deface(url)
d. Description:
The “Deface” collection contains information about online resources that have become subject to defacement attacks (the visual content of a website being substituted or modified).

[Content truncated...]