Privacy Notice Threat Intelligence for Microsoft Sentinel
1.Scope of this Notice
This Privacy Notice explains how Group-IB Global Private Limited (“Group-IB”, “we”) handles personal data in connection with the Group-IB Threat Intelligence for Microsoft Sentinel integration (the “Integration”), available through the Microsoft Marketplace and the Azure-Sentinel repository on
GitHub.
It applies to:
- people at a Customer who deploy, configure or operate the Integration (administrators, SOC analysts, engineers);
- individuals whose personal data appears in threat intelligence delivered through the Integration, or in indicators a Customer submits for enrichment.
This Notice supplements, and does not replace, the Group-IB Privacy Policy (website, marketing, support), the Integration Terms of Use, and the Threat Intelligence agreement and Data Processing Agreement (“TI Agreement” and “DPA”) between Group-IB and the Customer. If this Notice conflicts with the TI Agreement or the DPA on how threat intelligence data is handled, the TI Agreement and the DPA shall prevail.
Microsoft Azure, Microsoft Sentinel, Azure Log Analytics and the Microsoft Marketplace are Microsoft services. Microsoft’s processing of data in those services is governed by the Customer’s agreement with Microsoft and the Microsoft Privacy Statement, not by this Notice.
2. What the Integration does and where it runs
The Integration is a set of Azure Logic Apps playbooks that a Customer deploys and runs inside its own Azure subscription. Group-IB does not host, operate, monitor or have access to the Customer’s deployment. The only connection to Group-IB is the Customer’s calls to the Group-IB Threat Intelligence API, authenticated with the Customer’s own TI username and API key.
3. Who is responsible for what
The Customer controls everything stored in its own Azure environment; Group-IB controls only what reaches the Group-IB TI API and the threat intelligence it compiles.
| Data | Controller | Group-IB’s role |
|---|---|---|
| TI account credentials, support correspondence, API request logs |
Group-IB | Controller: we decide how our API is secured, licensed and operated |
| Threat intelligence Group-IB compiles and publishes, including personal data in leak, |
Group-IB | Independent controller for collecting and distributing threat intelligence |
| compromised-account and payment-fraud datasets |
||
| Indicators a Customer submits for enrichment |
Customer | Processor on the Customer’s instructions under the DPA; controller only for security logging of our own API |
| Threat intelligence once written to the Customer’s Sentinel workspace and Log Analytics tables; incidents, entities and incident comments; playbook run history |
Customer | None: Group-IB has no access. Microsoft acts as the Customer’s processor under the Customer’s Microsoft agreement |
4. Personal data the Integration processes
Group-IB receives only the Customer’s API credentials, request metadata and the indicators the Customer chooses to enrich; everything else stays in the Customer’s Azure environment.
| Category | Examples | Where it comes from | Where it goes |
|---|---|---|---|
| TI account credentials | TI username, API key | Entered by the Customer at deployment | Stored in the Customer’s Logic Apps as a secure parameter; sent to the Group-IB API with each request for authentication |
| API request metadata | Date and time, endpoint and collection requested, licence identifier, the Azure outbound IP address and user agent of the playbook, response status | Generated by each playbook call | Group-IB API logs |
| Threat intelligence content (delivered to the Customer) | Indicators (IP, domain, URL, file hash); threat reports; threat actor profiles; malware and vulnerability reports; public and Git leaks; compromised accounts; breached databases; bank cards and suspicious payment details. These may include personal data such as names, email addresses, usernames, passwords or hashes, phone numbers and IP addresses | Group-IB TI platform, within the Customer’s licence scope | Customer’s Microsoft Sentinel Threat Intelligence blade and Log Analytics tables |
| Enrichment inputs | IP addresses, domains, URLs and file hashes taken from a Customer incident or entity | Customer’s Sentinel incident, when an analyst or automation runs an enrichment playbook | Sent to the Group-IB TI API; the returned context is posted back as an incident comment |
| Operational data | Playbook run history, errors, managed-identity tokens | Azure Logic Apps | Stays in the Customer’s Azure tenant; Group-IB has no access |
Group-IB does not receive the Customer’s security events, logs, incident contents, Log Analytics tables or any other data from the Customer’s Sentinel workspace. An IP address, domain, URL or file hash submitted for enrichment can be personal data (for example, the IP address of an individual’s device); the Customer decides which indicators to submit and is responsible for doing so lawfully.
5. How data flows
data flow · Group-IB API, playbooks, Customer tenant
The playbooks pull threat intelligence from Group-IB on a schedule and write it into the Customer’s own Sentinel workspace. The only data that travels back to Group-IB is the API key used to authenticate, the request metadata and the indicators the Customer chooses to enrich.
6. Why we process this data and on what basis
| Purpose | Data used | Legal basis (where the GDPR, UK GDPR or similar law applies) |
|---|---|---|
| Authenticate API requests and deliver the threat intelligence the Customer is licensed for | Credentials, request metadata | Performance of the TI Agreement (Art. 6(1)(b) GDPR) |
| Enforce licence scope and rate limits, detect misuse, secure and troubleshoot the API | Request metadata | Legitimate interest in protecting our services and enforcing our agreements (Art. 6(1)(f) GDPR) |
| Answer enrichment look-ups | Indicators submitted by the Customer | Performance of the TI Agreement; processing on the Customer’s instructions under the DPA |
| Compile and distribute threat intelligence, including leak and compromised-account data | Threat intelligence content | Legitimate interest of Group-IB and its Customers in preventing and responding to cybercrime (Art. 6(1)(f); Recital 49 GDPR) |
| Provide technical support | Support correspondence, details the Customer shares | Performance of the TI Agreement; legitimate interest |
| Produce aggregate usage statistics for the Integration | Request metadata, aggregated | Legitimate interest in improving our products |
| Comply with legal obligations and respond to lawful requests | Any of the above | Legal obligation (Art. 6(1)(c)) |
Where Singapore’s Personal Data Protection Act applies, we rely on consent given in the TI Agreement, deemed consent by contractual necessity, and the legitimate interests and business improvement exceptions. We do not use data processed through the Integration for advertising, and we do not sell it.
7. Who we share data with
- Microsoft. The Integration writes threat intelligence into the Customer’s own Azure subscription. Microsoft processes that data as the Customer’s processor under the Customer’s Microsoft agreement; Group-IB does not share Customer data with Microsoft.
- Group-IB affiliates and sub-processors that host and support the Group-IB TI platform, as listed in the DPA or the sub-processor list referenced there.
- Authorities and other parties where required by law, a court order or to protect our rights, our Customers or the public.
- GitHub hosts the Integration’s source code only; no personal data is published there.
We do not sell personal data, and we do not share it with advertisers.
8. International transfers
Group-IB Global Private Limited is established in Singapore, and the Group-IB TI platform is operated from Singapore. Data that reaches Group-IB through the Integration may therefore be processed outside the Customer’s country.
Where data protection law requires a transfer mechanism, we rely on the safeguards agreed in the DPA.
Threat intelligence written to the Customer’s Sentinel workspace stays in the Azure region the Customer selected for that workspace, subject to Microsoft’s data residency commitments.
9. How long we keep data
| Data | Retention |
|---|---|
| TI account credentials | For the term of the TI Agreement; the Customer can rotate or revoke its API key at any time |
| API request logs, including enrichment look-ups | According to Group-IB’s threat intelligence retention practices, as described in the DPA |
| Threat intelligence on the Group-IB TI platform | According to Group-IB’s threat intelligence privacy notice. |
| Compile and distribute threat intelligence, including leak and compromised-account data | Threat intelligence content |
| Threat intelligence in the Customer’s Sentinel workspace and Log Analytics tables | Controlled entirely by the Customer. Removing the Integration does not delete data already stored in the Customer’s Azure environment |
10. Minors data and changes to this Notice
The Integration is a business tool for security professionals and is not intended for children. We do not knowingly collect personal data from children through it.
We may update this Notice by publishing a new version. Material changes take effect 30 days after publication, in line with the Integration Terms of Use.
11. How to contact us
Group-IB Global Private Limited, 108 Robinson Road, #07-01, Singapore 068900
- Privacy questions and data subject requests: [email protected]
- Technical support for the Integration: through your existing Group-IB customer support channel