Map Group-IB reports to indicator title and type

EclecticIQ Platform Indicator entities produced by ingesting Group-IB Human Intelligence and APT threat reports. have their titles determined by the following:

1. The title field of the Group-IB indicator object.

2. If the title field is missing or empty (null), then the Indicator title is derived from the contents of the params and type field in the Group-IB feed data, in order of priority:

   network type Group-IB indicators	file type Group-IB indicators
   Priority param field name 1 url 2 domain 3 ipv4 4 ipv6 (not used) ssl	Priority param field name 1 hashes.sha512 2 hashes.sha256 3 hashes.sha1 4 hashes.md5 (not used) md4 md6 sha1

For Group-IB indicators of network type, the platform also adds a Watchlist type to the relevant Indicator entity produced from that data.

This table shows how values of the type and params field are mapped to the Indicator type, in order of priority:

Map Admiralty Code values

Group-IB uses the Admiralty System to assign reliability and credibility values to a piece of information in the admiraltyCode field. For example:

• Object A is assigned an admiraltyCode value of A1 means that it comes from an information source that is “Completely reliable”, and the piece of information can be “Confirmed by other sources”.

• Object B that is assigned an admiraltyCode value of D6 means that it comes from an information source that is “Not usually reliable”, and the piece of information is evaluated as “Truth cannot be judged”.

When these objects are ingested by EclecticIQ Platform, these values are added as tags to the entities to which the Admiralty System classification applies. For example:

• Object A with an admiraltyCode value of “A1” produces entities with these two tags attached:

  • Admiralty Code - Completely reliable

  • Admiralty Code - Confirmed by other sources

• Object A with an admiraltyCode value of “D6” produces entities with these two tags attached

  • Admiralty Code - Not usually reliable

  • Admiralty Code - Truth cannot be judged

The table below describes how admiraltyCode values are translated to tags on EclecticIQ Platform:

Map credibility values to entity tags

Group-IB assigns a credibility value to intelligence objects.

When Group-IB intelligence objects are ingested by EclecticIQ Platform, credibility values are added as tags to the resulting entities.

The table below shows how credibility values are translated into tags:

Map reliability values to entity Confidence

Group-IB assigns a reliability value to intelligence objects.

When Group-IB intelligence objects are ingested by EclecticIQ Platform, reliability values are used to set the Confidence of an entity:

Map MITRE matrix to tags

A Group-IB intelligence object may hold MITRE ATT&CK information in the mitreMatrix field. If present, this MITRE ATT&CK information is processed and added as a single tag to the resulting entities.

The tag generated from MITRE ATT&CK information looks like this: <attackType>-<attackTactic>-<id>

For example, the following mitreMatrix values:

{
  "attackPatternId": "attack-pattern-​d3999268-740f-467e-a075-c82e2d04be62",
  "attackTactic": "priority-definition-planning",
  "attackType": "pre_attack_tactics",
  "id": "PRE-T1001",
  // ...
}

Produce a tag named: PRE-ATT&CK-Priority Definition Planning-T1001

The table below shows how values from the mitreMatrix object is mapped to values that appear in the resulting tag:

Table of mapped values

Table of attack types

Map contact details in Group-IB reports to observables

If a Group-IB Human Intelligence or APT threat report contains a contacts field, the contents of that field is ingested as observables.

The contacts field contains a list of contacts. One observable is created per contact found in that list; that observable:

• Derives its title from the value of the account field.

• Derives its type from the value of the type field.

  This table describes how the values in the type field are mapped to EclecticIQ Platform observable types:

  Group-IB contact type	EclecticIQ Platform observable type
  email	Email
  phone	Telephone
  im	Handle
  wallet	Bank account
  social_network	Handle

Map sector to entity tags and observable titles

If an ingested Group-IB report contains a sectors field, the contents of the field are processed to

• produce observables of industry type, and

• adds tags to corresponding entities.

For example, a Group-IB report that has these two sectors:

• agriculture

• financial-services

is processed to produce:

• Industry Sector - Agriculture and Industry Sector - Financial Services tags that are added to the corresponding entities.

• Creates two observables of industry type:

  • industry: Agriculture

  • industry: Financial Services

This table describes how a field value maps to EclecticIQ Platform entity tags, and the observables produced:

Map severity to observable maliciousness and as entity tag

Group-IB assigns a severity value to intelligence objects. When that intelligence object is ingested, its severity value is inherited by the entities and observables it produces.

• severity in observables

• severity added to entities as tags