How Modules work.

Modules are how Liberty91 connects to the outside world. They fall into three types: Collection modules pull reports and data in, Analysis modules enrich what comes in, and Production modules push your finished intelligence out. Most modules need nothing more than a few clicks, though premium Collection modules ask you to bring your own licence and API key for the source you have subscribed to. This page explains the three types so you can decide which Modules to turn on.

What are the three Module types?

Use this table to find the right Module for what you want to do, then open its page for setup steps.

Type	What it does	Example Modules
Collection	Pulls reports and data from a source, either open source or a premium feed where you bring your own licence and API key	CrowdStrike Intelligence, FalconFeeds, Group-IB, Google Threat Intelligence, Cyber News and Reports, PDF Import, X (Twitter)
Analysis	Enriches incoming data, whether that is your attack surface or the IOCs found in Events	FullHunt and Hexiosec for attack surface; MISP, CrowdStrike, Google Threat Intelligence, and free AlienVault OTX for IOC enrichment
Production	Sends your analysis and finished products out to other systems	Miro, MISP, and Webhooks to your SIEM or SOAR

How the types fit together

Collection modules feed your Recent Threats dashboard with Events. As those Events arrive, Analysis modules enrich them: attack-surface tools like FullHunt keep your Assets current, and IOC enrichment tools check every indicator against MISP, CrowdStrike, Google Threat Intelligence, or the free AlienVault OTX. Once you have produced an alert or a report, Production modules route it onward, whether that is a board in Miro, a finished report into MISP, or a webhook into your SIEM or SOAR.