Changelog

Synapse-Group-IB Changelog

NEXTVERS - 2026-XX-YY

Automatic Migrations

  • Migrated existing API credentials and tag prefix settings to the new configuration manager. Per-user API credentials were migrated to user-scoped configurations named synapse-group-ib:<useriden>. Legacy API credentials whose configuration cannot be added, for example because a global configuration already exists, are left in place and reported in the Cortex log; use groupib.ti.config.add to add them. When the global API credentials are left in place, so is the tag prefix. An invalid tag prefix is reported in the Cortex log and not migrated.

Features and Enhancements

  • Added support for proxy and SSL verification configurations on a per-vault basis.

  • Added new configuration manager commands:

    • groupib.ti.config.add

    • groupib.ti.config.del

    • groupib.ti.config.list

    • groupib.ti.config.show

    • groupib.ti.config.update

    • groupib.ti.config.migrate

  • Added a --config argument to all Synapse-Group-IB commands which query the Group-IB TI API to override the default configuration.

  • Added the power-ups.groupib.ti.admin permission, which grants access to all Synapse-Group-IB commands and the groupib.ti.privsep module.

  • Replaced the Optic configuration workflow with one for synapse-group-ib vaults.

  • Removed the groupib.ti.setup.apikey command. Use groupib.ti.config.add / groupib.ti.config.update instead.

  • Moved the Group-IB TI API endpoints into the package modconf and listed them in the command documentation.

  • Added an inet:service:login node for each compromised account event from the groupib.ti.compromised.accounts.search and groupib.ti.compromised.accounts.updated commands, with the login URL, time, and client and server addresses, on the account’s platform.

Bugfixes

  • Fixed the groupib.ti.compromised.accounts.search and groupib.ti.compromised.accounts.updated commands failing on a malware name that yields no tag.

  • Fixed the data migrations failing when a view is deleted while they run. They now warn when they skip a view whose write layer is read-only.

  • Fixed the groupib.ti.privsep module allowing API credentials to be sent to hosts other than the Group-IB TI API, and made its generic request helper, which took caller-chosen endpoint paths, private.

v2.1.0 - 2026-10-23

Features and Enhancements

  • Updated the groupib.ti.compromised.cards.search and groupib.ti.compromised.cards.updated commands to record the card funding type reported by Group-IB in the :funding:type property of econ:pay:card nodes. Unrecognized funding types produce a warning.

  • Updated the groupib.ti.compromised.cards.search and groupib.ti.compromised.cards.updated commands to record the card payment network reported by Group-IB in the :network and :network:name properties of econ:pay:card nodes.

Bugfixes

  • Fixed an issue where the groupib.ti.malware.configs.search and groupib.ti.malware.configs.updated commands would stop with an error when a malware config listed Domain1 servers without a Port.

  • Fixed an issue where the Synapse-Group-IB configuration workflow granted power-ups.groupib.user instead of power-ups.groupib.ti.user, so users added through the workflow could not run any groupib.ti.* command.

  • Fixed an issue where the groupib.ti.threat.actors.updated command skipped inbound risk:threat nodes created by Synapse-Group-IB because it read :name instead of :org:name.

  • Fixed an issue where CVSS v2 vectors were not recorded on risk:vuln nodes.

  • Fixed an issue where the groupib.ti.malware.configs.search and groupib.ti.malware.configs.updated commands never set :md5 on file:bytes nodes, leaving files reported with only an MD5 with no hash.

  • Fixed the groupib.ti.compromised.accounts.updated and groupib.ti.compromised.cards.updated command help examples, which named commands that do not exist.

  • Fixed the missing API key message, which referred to a groupib.setup.apikey command instead of groupib.ti.setup.apikey.

  • Fixed the threat actor search example in the User Guide, which displayed an error instead of results.

v2.0.2 - 2026-05-01

Bugfixes

  • Fixed an issue where groupib.ti.*.search and groupib.ti.*.updated commands could raise a StormRuntimeError when a paginated follow-up request to the Group-IB API returned a non-200 response.

v2.0.1 - 2026-02-06

Bugfixes

  • Fixed an issue where an invalid account would cause the ingest to fail.

v2.0.0 - 2025-12-10

Automatic Migrations

  • Deleted inet:web:acct and inet:web:post nodes created by Synapse-Group-IB.

  • Migrated storage version tracking to use Storm package inits.

Features and Enhancements

  • Updated ingest to use inet:service:account, inet:service:platform, and inet:service:message in place of inet:web:acct and inet:web:post.

v1.1.0 - 2025-06-25

Features and Enhancements

  • Added econ:pay:card.seen for compromised cards.

Bugfixes

  • Fixed an issue where an invalid domain on a compromised account could cause the ingest to fail.

v1.0.0 - 2025-05-16

Automatic Migrations

  • Deleted :nist:nvd:modified and migrated :nist:nvd:published to :timeline:published on risk:vuln nodes created by Synapse-Group-IB.

Features and Enhancements

  • Updated groupib.ti.compromised.accounts.search, groupib.ti.compromised.accounts.updated, groupib.ti.compromised.cards.search, groupib.ti.compromised.cards.updated, groupib.ti.iocs.search, groupib.ti.iocs.updated, groupib.ti.malware.configs.search, groupib.ti.malware.configs.updated, groupib.ti.threat.actors.search, groupib.ti.threat.actors.updated, groupib.ti.threat.reports.byid, groupib.ti.threat.reports.search, groupib.ti.threat.reports.updated, groupib.ti.vulns.search, and groupib.ti.vulns.updated to populate the it:exec:query:synuser property.

  • Updated risk:vuln ingest logic to no longer set :nist:nvd:modified or :nist:nvd:published, and instead set :timeline:published. Please use NIST NVD as the authoritative source for setting these properties on it:sec:cve.

v0.6.2 - 2025-01-17

NOTE: This release is a BETA preview and may be subject to change!

Bugfixes

  • Fixed an issue where invalid properties for event owner contacts would throw an error.

v0.6.1 - 2025-01-06

NOTE: This release is a BETA preview and may be subject to change!

Bugfixes

  • Fixed typos in command help messages.

v0.6.0 - 2024-06-28

NOTE: This release is considered Beta and may be subject to change.

Features and Enhancements

  • Replace deprecated risk:hasvuln usage with risk:vulnerable.

This release contains an automatic data migration that will run when the package is first upgraded. The migration creates risk:vulnerable nodes from the deprecated risk:hasvuln nodes.

Bugfixes

  • Fix an issue with API responses where the count of returned items used to be an integer but is now a dictionary.

v0.5.0 - 2024-06-05

NOTE: This release is considered Beta and may be subject to change.

Bugfixes

  • Safely skip invalid CPE strings.

v0.4.1 - 2024-05-20

NOTE: This release is considered Beta and may be subject to change.

Bugfixes

  • Fix an issue where large C2 configs would generate an error.

  • Fix an issue where newer API versions were generating invalid risk:threat nodes.

  • Fix an issue where groupib.ti.threat.actors.search was using risk:threat:name to enrich nodes instead of risk:threat:org:name

v0.4.0 - 2024-04-22

NOTE: This release is considered Beta and may be subject to change.

Features and Enhancements

  • Add commands for retrieving compromised account and bank card data.

Bugfixes

  • Fix an issue where enriching media:news nodes created during threat actor ingest would create new media:news nodes rather than updating the existing node.

v0.3.1 - 2024-02-20

NOTE: This release is considered Beta and may be subject to change.

Features and Enhancements

  • Update deprecated $lib.dict() usage to JSON style syntax.

v0.3.0 - 2023-11-22

NOTE: This release is considered Beta and may be subject to change.

Features and Enhancements

  • Add groupib.ti.threat.reports.byid command to retrieve a single report by ID.

  • Add a rep.groupib.ioc tag to nodes when ingesting indicators.

  • Convert threat report HTML to text before scraping to avoid incorrectly matching hashes contained in links.

  • Add groupib.ti.iocs.updated, groupib.ti.malware.configs.updated, groupib.ti.threat.actors.updated, groupib.ti.threat.reports.updated, and groupib.ti.vulns.updated commands which use the /updated versions of the endpoints with seqUpdate logic for iteration. These commands also have a --since-last option which can be used to pull new results since the last run of the command with a particular query.

v0.2.0 - 2023-07-05

NOTE: This release is considered Beta and may be subject to change.

Features and Enhancements

  • Parse additional C2 configuration values.

  • Adjust command names to be under the groupib.ti namespace.

  • Update required permission to power-ups.groupib.ti.user.

  • Add groupib.ti.iocs.search command.

  • Add groupib.ti.vulns.search command.

  • Add groupib.ti.threat.reports.search command.

Bugfixes

  • Fix an issue where the risk:tool:software:tag property was not set.

v0.1.0 - 2023-05-23

NOTE: This release is considered Beta and may be subject to change.

Features and Enhancements

  • Initial beta release of the Synapse-Group-IB Power-Up