Package Documentation

Storm Package: synapse-group-ib

The following Commands are available from this package. This documentation is generated for version 2.1.0 of the package.

Storm Commands

This package implements the following Storm Commands.

groupib.ti.compromised.accounts.updated

Search for updated compromised accounts.

This command queries the Group IB TI Compromised Data/Accounts
updated endpoint (/api/v2/compromised/account_group/updated) and creates
nodes from the matching results.

An inet:service:login node is created for each compromise event, linked to the
account and its platform.

This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.

The --since-last option can be used to retrieve new results since the last
run of the command with a specified query string.

The first time --since-last is used the --seqUpdate argument will define
the starting point.

Examples:
  // Search for accounts using a query string
  groupib.ti.compromised.accounts.updated --query 'sourceType: botnet' --seqUpdate 17000645027033

  // Create a cron job to ingest any new results every day
  cron.add --name "GIB Accounts Feed" --hour 3 { groupib.ti.compromised.accounts.updated --since-last }


Endpoints:

  (user-configured base URL)
    /api/v2/compromised/account_group/updated: Retrieve updated compromised accounts.

Usage: groupib.ti.compromised.accounts.updated [options]

Options:

  --help                      : Display the command usage.
  --query <query>             : A search query string.
  --seqUpdate <seqUpdate>     : Search for results after a seqUpdate value.
  --since-last                : Retrieve results since the last run of the command with --since-last specified.
  --debug                     : Show verbose debug output.
  --size <size>               : Limit the number of results ingested to the given size.
  --yield                     : Yield the newly created nodes.
  --config <config>           : Override the default config with the provided name.

The command is accessible to users with one or more of the following permissions:

  • power-ups.groupib.ti.admin

  • power-ups.groupib.ti.user

groupib.ti.compromised.cards.updated

Search for updated compromised bank cards.

This command queries the Group IB TI Compromised Data/Bank Cards
updated endpoint (/api/v2/compromised/bank_card_group/updated) and creates
nodes from the matching results.

This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.

The --since-last option can be used to retrieve new results since the last
run of the command with a specified query string.

The first time --since-last is used the --seqUpdate argument will define
the starting point.

Examples:
  // Search for cards using a query string
  groupib.ti.compromised.cards.updated --query 'sourceType: botnet' --seqUpdate 17000645027033

  // Create a cron job to ingest any new results every day
  cron.add --name "GIB Cards Feed" --hour 3 { groupib.ti.compromised.cards.updated --since-last }


Endpoints:

  (user-configured base URL)
    /api/v2/compromised/bank_card_group/updated: Retrieve updated compromised bank cards.

Usage: groupib.ti.compromised.cards.updated [options]

Options:

  --help                      : Display the command usage.
  --query <query>             : A search query string.
  --seqUpdate <seqUpdate>     : Search for results after a seqUpdate value.
  --since-last                : Retrieve results since the last run of the command with --since-last specified.
  --debug                     : Show verbose debug output.
  --size <size>               : Limit the number of results ingested to the given size.
  --yield                     : Yield the newly created nodes.
  --config <config>           : Override the default config with the provided name.

The command is accessible to users with one or more of the following permissions:

  • power-ups.groupib.ti.admin

  • power-ups.groupib.ti.user

groupib.ti.config.add

Add a Synapse-Group-IB configuration.

The proxy argument can be set to one of the following values:
  true: Use the Cortex configured proxy if set.
  false: Do not use the Cortex configured proxy if set.
  <str>: A proxy URL to use.

Examples:

  // Add a global configuration
  groupib.ti.config.add default mylogin myapikey1234

  // Add a configuration for the current user
  groupib.ti.config.add --scope self myconfig mylogin myapikey5678


Usage: groupib.ti.config.add [options] <name> <username> <apikey>

Options:

  --help                      : Display the command usage.
  --ssl-noverify              : Do not perform SSL/TLS verification.
  --proxy <proxy>             : Configure the proxy usage. (default: True)
  --tag-prefix <tag_prefix>   : The tag prefix to use when recording data from Group-IB. (default: rep.groupib)
  --scope <scope>             : Set the scope on the configuration. (default: global, choices: global, self, unscoped)

Arguments:

  <name>                      : A unique name for the configuration.
  <username>                  : The Group-IB TI login.
  <apikey>                    : The Group-IB TI API key string.

The command is accessible to users with one or more of the following permissions:

  • power-ups.groupib.ti.admin

  • power-ups.groupib.ti.user

groupib.ti.config.del

Delete a Synapse-Group-IB configuration.

Examples:

  // Delete the "myconfig" configuration
  groupib.ti.config.del myconfig


Usage: groupib.ti.config.del [options] <name>

Options:

  --help                      : Display the command usage.

Arguments:

  <name>                      : The name of the configuration.

The command is accessible to users with one or more of the following permissions:

  • power-ups.groupib.ti.admin

  • power-ups.groupib.ti.user

groupib.ti.config.list

Display the list of Synapse-Group-IB configurations you have access to.


Usage: groupib.ti.config.list [options]

Options:

  --help                      : Display the command usage.

The command is accessible to users with one or more of the following permissions:

  • power-ups.groupib.ti.admin

  • power-ups.groupib.ti.user

groupib.ti.config.migrate

Migrate options for all Synapse-Group-IB configurations.

The proxy argument can be set to one of the following values:
  true: Use the Cortex configured proxy if set.
  false: Do not use the Cortex configured proxy if set.
  <str>: A proxy URL to use.

Examples:

  // Migrate the tag prefix for all configurations
  groupib.ti.config.migrate --tag-prefix my.tagpref


Usage: groupib.ti.config.migrate [options]

Options:

  --help                      : Display the command usage.
  --ssl-verify <ssl_verify>   : Set whether to verify the SSL certificate of the server. (default: None)
  --proxy <proxy>             : Configure the proxy usage. (default: None)
  --tag-prefix <tag_prefix>   : The tag prefix to use when recording data from Group-IB. (default: None)

The command is accessible to users with one or more of the following permissions:

  • power-ups.groupib.ti.admin

groupib.ti.config.show

Show the details of a configuration.

Examples:

  // Show the in-use configuration for the current user
  groupib.ti.config.show

  // Show a configuration by name
  groupib.ti.config.show myconfig


Usage: groupib.ti.config.show [options] <name>

Options:

  --help                      : Display the command usage.

Arguments:

  [name]                      : The name of the configuration.

The command is accessible to users with one or more of the following permissions:

  • power-ups.groupib.ti.admin

  • power-ups.groupib.ti.user

groupib.ti.config.update

Update the configuration of a defined Synapse-Group-IB configuration.

The proxy argument can be set to one of the following values:
  true: Use the Cortex configured proxy if set.
  false: Do not use the Cortex configured proxy if set.
  <str>: A proxy URL to use.

Examples:

  // Set the permission level for user "myuser" to "admin" on the "myconfig"
  // configuration
  groupib.ti.config.update myconfig --perm user myuser admin

  // Set the permission level for the "all" role to "deny" on the
  // "myconfig" configuration
  groupib.ti.config.update myconfig --perm role all deny

  // Do not verify the SSL certificate when connecting to "myconfig"
  groupib.ti.config.update myconfig --ssl-verify (false)

  // Change the tag prefix used by the "myconfig" configuration
  groupib.ti.config.update myconfig --tag-prefix my.prefix

  // Change the name of the "myconfig" configuration to "otherconfig"
  groupib.ti.config.update myconfig --name otherconfig


Usage: groupib.ti.config.update [options] <config>

Options:

  --help                      : Display the command usage.
  --username <username>       : The Group-IB TI login. (default: None)
  --apikey <apikey>           : The Group-IB TI API key string. (default: None)
  --perm <perm>               : Set the permission level for a user or role on this configuration.
                                Arguments to this option are ``scope``, ``name``, ``level``:
                                  <scope>: The scope for the permission, either "user" or "role".
                                  <name>: The user/role name depending on scope.
                                  <level>: The $lib.auth.easyperm.level name, or (null) to remove the
                                           permission, which falls back to the config default.
                                 (default: None)
  --ssl-verify <ssl_verify>   : Set whether to verify the SSL certificate of the server. (default: None)
  --proxy <proxy>             : Configure the proxy usage. (default: None)
  --tag-prefix <tag_prefix>   : The tag prefix to use when recording data from Group-IB. (default: None)
  --name <name>               : Rename the configuration. (default: None)

Arguments:

  <config>                    : The name of the configuration to modify.

The command is accessible to users with one or more of the following permissions:

  • power-ups.groupib.ti.admin

  • power-ups.groupib.ti.user

groupib.ti.iocs.updated

Search for updated IOCs.

This command queries the Group IB TI IOC/Common updated endpoint
(/api/v2/ioc/common/updated) and creates nodes from the matching results.

This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.

The --since-last option can be used to retrieve new results since the last
run of the command with a specified query string.

The first time --since-last is used the --seqUpdate argument will define
the starting point.

Examples:
  // Search for IOCs using a query string
  groupib.ti.iocs.updated --query 'ip: 150.158.179.35' --seqUpdate 17000645027033

  // Search for IOCs using an inet:fqdn node
  inet:fqdn=t.ly | groupib.ti.iocs.updated --yield

  // Create a cron job to ingest any new results every day
  cron.add --name "GIB IOC Feed" --hour 3 { groupib.ti.iocs.updated --since-last }


Endpoints:

  (user-configured base URL)
    /api/v2/ioc/common/updated: Retrieve updated IOCs.

Usage: groupib.ti.iocs.updated [options]

Options:

  --help                      : Display the command usage.
  --query <query>             : A search query string.
  --seqUpdate <seqUpdate>     : Search for results after a seqUpdate value.
  --since-last                : Retrieve results since the last run of the command with --since-last specified.
  --debug                     : Show verbose debug output.
  --size <size>               : Limit the number of results ingested to the given size.
  --yield                     : Yield the newly created nodes.
  --config <config>           : Override the default config with the provided name.

Inputs:

  file:bytes                  : file:bytes nodes
  hash:md5                    : hash:md5 nodes
  hash:sha1                   : hash:sha1 nodes
  hash:sha256                 : hash:sha256 nodes
  inet:fqdn                   : inet:fqdn nodes
  inet:ipv4                   : inet:ipv4 nodes

The command is accessible to users with one or more of the following permissions:

  • power-ups.groupib.ti.admin

  • power-ups.groupib.ti.user

groupib.ti.malware.configs.updated

Search for updated malware configs.

This command queries the Group IB TI malware config updated endpoint
(/api/v2/malware/config/updated) and creates it:sec:c2:config nodes from
the matching results.

This command will also create an it:exec:query node to represent the
query syntax and link resulting it:sec:c2:config nodes to it via -(found)>
edges.

The --since-last option can be used to retrieve new results since the last
run of the command with a specified query string.

The first time --since-last is used the --seqUpdate argument will define
the starting point.

Examples:

  // Search for malware configs using a hash:sha256 node
  hash:sha256#myhash | groupib.ti.malware.configs.updated --seqUpdate 17000645027033

  // Search for Cobalt Strike configs
  groupib.ti.malware.configs.updated --query 'malware: "Cobalt Strike"' --size 10

  // Create a cron job to ingest new results for a query every day
  cron.add --name "GIB Cobalt Strike config Feed" --hour 3
  { groupib.ti.malware.configs.updated --query 'malware: "Cobalt Strike"' --since-last }


Endpoints:

  (user-configured base URL)
    /api/v2/malware/config/updated: Retrieve updated malware configs.
    /api/v2/malware/config/{id}: Retrieve a malware config by ID.
    /api/v2/malware/config/{id}/file/config: Download the raw file for a malware config.

Usage: groupib.ti.malware.configs.updated [options]

Options:

  --help                      : Display the command usage.
  --query <query>             : A search query string.
  --seqUpdate <seqUpdate>     : Search for results after a seqUpdate value.
  --since-last                : Retrieve results since the last run of the command with --since-last specified.
  --debug                     : Show verbose debug output.
  --size <size>               : Limit the number of results ingested to the given size.
  --yield                     : Yield the newly created nodes.
  --download-large-configs    : Download large malware configs that Group IB TI does not automatically return.
  --config <config>           : Override the default config with the provided name.

Inputs:

  file:bytes                  : file:bytes nodes
  hash:md5                    : hash:md5 nodes
  hash:sha1                   : hash:sha1 nodes
  hash:sha256                 : hash:sha256 nodes
  inet:fqdn                   : inet:fqdn nodes
  inet:ipv4                   : inet:ipv4 nodes

The command is accessible to users with one or more of the following permissions:

  • power-ups.groupib.ti.admin

  • power-ups.groupib.ti.user

groupib.ti.threat.actors.updated

Search for updated threat actors.

This command queries the Group IB TI threat actor updated endpoint
(/api/v2/common/threat_actor/updated) and creates risk:threat nodes
from the matching results.

This command will also create an it:exec:query node to represent the
query syntax and link resulting risk:threat nodes to it via -(found)>
edges.

The --since-last option can be used to retrieve new results since the last
run of the command with a specified query string.

The first time --since-last is used the --seqUpdate argument will define
the starting point.

Examples:
  // Search for threat actors named Conti
  groupib.ti.threat.actors.updated --query 'name: "Conti"' --seqUpdate 17000645027033

  // Search for threat actors using an inet:fqdn
  inet:fqdn=anydeskupdate.com | groupib.ti.threat.actors.updated

  // Create a cron job to ingest any new results every day
  cron.add --name "GIB Threat Actor Feed" --hour 3
  { groupib.ti.threat.actors.updated --since-last }


Endpoints:

  (user-configured base URL)
    /api/v2/common/threat_actor/updated: Retrieve updated threat actors.

Usage: groupib.ti.threat.actors.updated [options]

Options:

  --help                      : Display the command usage.
  --query <query>             : A search query string.
  --seqUpdate <seqUpdate>     : Search for results after a seqUpdate value.
  --since-last                : Retrieve results since the last run of the command with --since-last specified.
  --include-targeted-orgs     : Add "targets" light edges to "ou:name" nodes for targeted companies when ingesting
                                results (target names are highly denormalized and may be unreliable).
  --debug                     : Show verbose debug output.
  --size <size>               : Limit the number of results ingested to the given size.
  --yield                     : Yield the newly created nodes.
  --config <config>           : Override the default config with the provided name.

Inputs:

  file:bytes                  : file:bytes nodes
  hash:md5                    : hash:md5 nodes
  hash:sha1                   : hash:sha1 nodes
  hash:sha256                 : hash:sha256 nodes
  inet:fqdn                   : inet:fqdn nodes
  inet:ipv4                   : inet:ipv4 nodes
  it:sec:cve                  : it:sec:cve nodes
  risk:threat                 : risk:threat nodes

The command is accessible to users with one or more of the following permissions:

  • power-ups.groupib.ti.admin

  • power-ups.groupib.ti.user

groupib.ti.threat.reports.byid

Ingest a threat report by ID.

This command queries the Group IB TI threat report endpoint
(/api/v2/common/threat/{id}) to retrieve a threat report by ID an
creates media:news nodes from the results. The ID of the report to
retrieve can be specified as a command argument, or with inbound
media:news nodes with :type=groupib.threat.report that have an :ext:id
property value.

Examples:
  // Ingest a report by ID
  groupib.ti.threat.reports.byid 7f730132f83fb0feadcaa351cbf1656dc6adeb52

  // Use a media:news node with an :ext:id prop to retrieve a report.
  media:news#groupib.report | groupib.ti.threat.reports.byid


Endpoints:

  (user-configured base URL)
    /api/v2/common/threat/{id}: Retrieve a threat report by ID.

Usage: groupib.ti.threat.reports.byid [options] <id>

Options:

  --help                      : Display the command usage.
  --debug                     : Show verbose debug output.
  --yield                     : Yield the newly created nodes.
  --config <config>           : Override the default config with the provided name.

Arguments:

  [id]                        : ID of the report to ingest.

Inputs:

  media:news                  : media:news nodes

The command is accessible to users with one or more of the following permissions:

  • power-ups.groupib.ti.admin

  • power-ups.groupib.ti.user

groupib.ti.threat.reports.updated

Search for updated threat reports.

This command queries the Group IB TI threat report updated endpoint
(/api/v2/common/threat/updated) and creates media:news nodes from the
matching results.

This command will also create an it:exec:query node to represent the
query syntax and link resulting risk:threat nodes to it via -(found)>
edges.

The --since-last option can be used to retrieve new results since the last
run of the command with a specified query string.

The first time --since-last is used the --seqUpdate argument will define
the starting point.

Examples:
  // Search for threat reports about the actor Conti
  groupib.ti.threat.reports.updated --query 'threat_actor: "Conti"' --seqUpdate 17000645027033

  // Search for threat actors using a pol:country node
  pol:country:iso2=AU | groupib.ti.threat.reports.updated --yield

  // Create a cron job to ingest new results for a query every day
  cron.add --name "GIB Threat Report (AU) Feed" --hour 3
  { pol:country:iso2=AU | groupib.ti.threat.reports.updated --since-last }


Endpoints:

  (user-configured base URL)
    /api/v2/common/threat/updated: Retrieve updated threat reports.

Usage: groupib.ti.threat.reports.updated [options]

Options:

  --help                      : Display the command usage.
  --query <query>             : A search query string.
  --seqUpdate <seqUpdate>     : Search for results after a seqUpdate value.
  --since-last                : Retrieve results since the last run of the command with --since-last specified.
  --debug                     : Show verbose debug output.
  --size <size>               : Limit the number of results ingested to the given size.
  --yield                     : Yield the newly created nodes.
  --config <config>           : Override the default config with the provided name.

Inputs:

  file:bytes                  : file:bytes nodes
  hash:md5                    : hash:md5 nodes
  hash:sha1                   : hash:sha1 nodes
  hash:sha256                 : hash:sha256 nodes
  inet:fqdn                   : inet:fqdn nodes
  inet:ipv4                   : inet:ipv4 nodes
  it:sec:cve                  : it:sec:cve nodes
  pol:country                 : pol:country nodes
  risk:threat                 : risk:threat nodes

The command is accessible to users with one or more of the following permissions:

  • power-ups.groupib.ti.admin

  • power-ups.groupib.ti.user

groupib.ti.vulns.updated

Search for updated vulnerabilities.

This command queries the Group IB TI Vulnerabilities updated endpoint
(/api/v2/osi/vulnerability/updated) and creates nodes from the matching
results.

This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.

The --since-last option can be used to retrieve new results since the last
run of the command with a specified query string.

The first time --since-last is used the --seqUpdate argument will define
the starting point.

Examples:
  // Search for vulnerabilities using a query string
  groupib.ti.vulns.updated --query 'id: CVE-2023-34362' --seqUpdate 17000645027033

  // Search for vulnerabilities using an it:sec:cve node
  it:sec:cve=CVE-2023-34362 | groupib.ti.vulns.updated --yield

  // Create a cron job to ingest any new results every day
  cron.add --name "GIB Vuln Feed" --hour 3 { groupib.ti.vulns.updated --since-last }


Endpoints:

  (user-configured base URL)
    /api/v2/osi/vulnerability/updated: Retrieve updated vulnerabilities.

Usage: groupib.ti.vulns.updated [options]

Options:

  --help                      : Display the command usage.
  --query <query>             : A search query string.
  --seqUpdate <seqUpdate>     : Search for results after a seqUpdate value.
  --since-last                : Retrieve results since the last run of the command with --since-last specified.
  --debug                     : Show verbose debug output.
  --size <size>               : Limit the number of results ingested to the given size.
  --yield                     : Yield the newly created nodes.
  --config <config>           : Override the default config with the provided name.

Inputs:

  it:sec:cve                  : it:sec:cve nodes
  risk:vuln                   : risk:vuln nodes

The command is accessible to users with one or more of the following permissions:

  • power-ups.groupib.ti.admin

  • power-ups.groupib.ti.user

Storm Modules

This package does not export any Storm APIs.