Admin Guide

Synapse-Group-IB Admin Guide

Configuration

Synapse-Group-IB requires a Group-IB TI API key. For information on how to generate a Group-IB TI API key and configure the necessary IP access rules, please visit the Group-IB TI API Starting Guide.

Setting API credentials for global use

To set-up global API credentials for Group-IB Threat Intelligence:

> groupib.ti.config.add default mylogin myapikey
Synapse-Group-IB config "default" added

Creating a configuration for role-based use

Add an unscoped configuration:

> groupib.ti.config.add myunscoped mylogin myapikey --scope unscoped
Synapse-Group-IB config "myunscoped" added

Grant another user admin permissions to the new configuration:

> groupib.ti.config.update myunscoped --perm user visi admin
Updated Synapse-Group-IB config "myunscoped"

Grant a role read permissions to the new configuration:

> groupib.ti.config.update myunscoped --perm role ninjas read
Updated Synapse-Group-IB config "myunscoped"

Users may select a configuration other than their default by passing --config <name> to the Synapse-Group-IB commands.

Setting the tag prefix

The tag prefix used when recording data from Group-IB defaults to rep.groupib. It may be set per configuration using the --tag-prefix option to groupib.ti.config.add or groupib.ti.config.update, or for all configurations using groupib.ti.config.migrate:

> groupib.ti.config.migrate --tag-prefix my.tagpref
Updated Synapse-Group-IB config "synapse-group-ib:default"
Updated Synapse-Group-IB config "synapse-group-ib:myunscoped"

Overriding the proxy configuration

In order to override the default proxy configuration in the Cortex the user must have the power-ups.groupib.ti.admin or storm.lib.inet.http.proxy permission.

When the proxy configuration is set to (false) or a URL the permission will be checked when a configuration is created/updated, and when it is used to make an HTTP request.

Dependencies

Synapse-Group-IB does not have any dependencies.

Permissions

Package (synapse-group-ib) defines the following permissions:
power-ups.groupib.ti.user        : Controls user access to Synapse-Group-IB Threat Intelligence. ( default: false )
power-ups.groupib.ti.admin       : Controls access to Synapse-Group-IB admin options. ( default: false )

You may add rules to users/roles directly from storm:

> auth.user.addrule visi power-ups.groupib.ti.user
Added rule power-ups.groupib.ti.user to user visi.

or:

> auth.role.addrule ninjas power-ups.groupib.ti.user
Added rule power-ups.groupib.ti.user to role ninjas.

Exported APIs

Synapse-Group-IB does not currently export any APIs.

Workflows

Synapse-Group-IB provides the following workflows in Optic:

Title: Configuration

The Configuration workflow may be used to manage Synapse-Group-IB configurations from Optic.

Node Actions

Synapse-Group-IB provides the following node actions in Optic:

Name : ti.threat.actors
Desc : Search for threat actors using Synapse-Group-IB
Forms: inet:fqdn, inet:ipv4, hash:sha256, hash:md5, hash:sha1, risk:threat, it:sec:cve, file:bytes

Name : ti.threat.reports
Desc : Search for threat reports using Synapse-Group-IB
Forms: inet:fqdn, inet:ipv4, hash:sha256, hash:md5, hash:sha1, risk:threat, it:sec:cve, file:bytes, pol:country

Name : ti.malware.configs
Desc : Search for malware configs using Synapse-Group-IB
Forms: inet:fqdn, inet:ipv4, hash:sha256, hash:md5, hash:sha1, file:bytes

Name : ti.vulns
Desc : Search for vulnerabilities using Synapse-Group-IB
Forms: it:sec:cve, risk:vuln

Name : ti.iocs
Desc : Search for IOCs using Synapse-Group-IB
Forms: inet:fqdn, inet:ipv4, hash:sha256, hash:md5, hash:sha1, file:bytes