The Group-IB Module

The Group-IB Module allows you to automatically ingest the reports and events from the Group-IB portal into Liberty91. You will need to already have a license with Group-IB.

To activate this Module, you need to go through 3 simple steps:

1. Whitelist the Liberty91 IP-address (35.210.22.235) in the Group-IB portal

2. Generate a personal token in the Group-IB Portal

3. Provide your username and token in the Liberty91 Module

Step 1: Whitelist Liberty91's IP-address

1. Log into your Group-IB account at sso.group-ib.com

2. Go to 'Help Center', at the bottom of the sidebar

In the Group-IB portal, go to Help Center

1. Go to 'Authentication, access and user management' (usually the top left card under 'Frequently Asked Questions')

2. You will see your User Details. Click on 'Security and Access'

Click on 'Security and Access' under your username

add 35.210.22.235 to the list of Trusted IP-addresses

1. Click on 'IP white list'. Then add 35.210.22.235 to the list of trusted IP-addresses. Don't forget to click 'submit' or 'add'! When you're done, it should look like this:

this is what it should look like when you have successfully added Liberty91's IP-address

Step 2: Generate a Personal Token

1. Now that you have whitelisted Liberty91's IP-address, you can generate a Personal Token under the same Security and Access tab. To do that, click on 'Personal token'.

Under 'Personal Token', click on 'Generate New Token'

1. Under 'Personal Token', click on 'Generate New Token'. Copy that token; you will need in for the next step.

Step 3: Provide username and token in Liberty91's Group-IB Module

don't forget to activate your Group-IB Module

1. Provide your username and the token you have just generated in the text fields

2. Select the type of reports you want to import into Liberty91. Note that you can select any type of report, but if your Group-IB license doesn't include the types you select here, they will not be imported.

3. Activate the module by selecting the 'active' button and click on 'update'.

Congratulations! You have successfully activated your Group-IB Module in Liberty91. New events from Group-IB should now start to appear in the second (middle) column in your 'Recent Threats' dashboard.