The Group-IB Module

The Group-IB Module allows you to automatically ingest the reports and events from the Group-IB portal into Liberty91. You will need to already have a license with Group-IB.

To activate this Module, you need to go through 3 simple steps:

1. Whitelist the Liberty91 IP-address (34.79.108.60) in the Group-IB portal

2. Generate a personal token in the Group-IB Portal

3. Provide your username and token in the Liberty91 Module

Step 1: Whitelist Liberty91's IP-address

1. Log into your Group-IB account at sso.group-ib.com

2. Go to 'Help Center', at the bottom of the sidebar

1. Go to 'Authentication, access and user management' (usually the top left card under 'Frequently Asked Questions')

2. You will see your User Details. Click on 'Security and Access'

1. Click on 'IP white list'. Then add 34.79.108.60 to the list of trusted IP-addresses. Don't forget to click 'submit' or 'add'! When you're done, it should look like this:

Step 2: Generate a Personal Token

1. Now that you have whitelisted Liberty91's IP-address, you can generate a Personal Token under the same Security and Access tab. To do that, click on 'Personal token'.

1. Under 'Personal Token', click on 'Generate New Token'. Copy that token; you will need in for the next step.

Step 3: Provide username and token in Liberty91's Group-IB Module

1. Provide your username (your email address you use to login with) and the token you have just generated in the text fields

2. Select the type of reports you want to import into Liberty91. Note that you can select any type of report, but if your Group-IB license doesn't include the types you select here, they will not be imported.

3. Activate the module by selecting the 'active' button and click on 'update'.

Congratulations! You have successfully activated your Group-IB Module in Liberty91. New events from Group-IB should now start to appear in the second (middle) column in your 'Recent Threats' dashboard.