Liberty91

Group-IB module.

Last updated 14 Jun 20262 min read

The Group-IB module automatically ingests the reports and events from your Group-IB portal into Liberty91. To set it up you whitelist Liberty91's IP address in Group-IB, generate a personal token, then enter your username and token in the module. You need an active Group-IB licence, and only the report types your licence covers will import.

Before you start

You need an active Group-IB licence. You can select any report type in the module, but types your licence does not include will not be imported.

How to connect Group-IB

Activation takes three steps: whitelist our IP, generate a personal token, then enter your credentials in Liberty91.

Step 1: Whitelist Liberty91's IP address

  1. Log in to your Group-IB account at sso.group-ib.com.
  2. Open Help Center at the bottom of the sidebar.
  3. Go to Authentication, access and user management, usually the top-left card under Frequently Asked Questions.
  4. On your User Details, click Security and Access.
  5. Click IP white list, add the IP address 34.79.108.60 to the list of trusted addresses, and click submit (or add).
Group-IB portal Security and Access tab showing the IP white list with 34.79.108.60 added as a trusted address

Step 2: Generate a Personal Token

  1. Stay on the same Security and Access tab and click Personal token.
  2. Click Generate New Token.
  3. Copy the token. You need it in the next step.
Group-IB portal Personal token panel with the Generate New Token button

Step 3: Enter your credentials in Liberty91

  1. In Liberty91, go to Modules and open the Group-IB module under Collection modules.
  2. Enter your username (the email address you log in with) and the token you just generated.
  3. Select the report types you want to import. Types outside your licence will not import even if selected.
  4. Set the module to Active and click Update.
Liberty91 Group-IB module configuration screen with username, token, report-type selection, and the Active toggle

New Group-IB Events now appear in the middle column of your Recent Threats dashboard.

Frequently asked questions

Which IP address do I whitelist in Group-IB?

34.79.108.60. Add it to the IP white list under Security and Access in your Group-IB user details.

Can I import report types my Group-IB licence does not cover?

No. You can select any report type in the module, but types outside your licence are not imported.

What credentials does the module need?

The email address you log in to Group-IB with, and a personal token generated from the Security and Access tab.

Was this page helpful?
← PreviousFalconFeeds moduleNext →Google Threat Intelligence module