Terms of Use Group-IB Threat Intelligence for Microsoft Sentinel

These Terms of Use (the “Terms”) govern the use of the Group-IB Threat Intelligence for Microsoft Sentinel integration (the “Integration”), made available by Group-IB Global Private Limited (“Group-IB”) to its customers. “Website” means www.group-ib.com, where the current version of these Terms is published at https://www.group-ib.com/legal/. These Terms set out the conditions that apply to the Customer’s use of the Integration and its connection to the TI Services. By deploying or using the Integration, or by installing it from the Microsoft Marketplace, you (“Customer”) confirm that you have read and accept these Terms. If you do not agree, do not deploy or use the Integration.

The Integration is a set of Azure Logic Apps playbooks that connects the Group-IB Threat Intelligence platform (the “TI Services”) to Microsoft Sentinel. It retrieves threat intelligence from the TI Services through the Group-IB Threat Intelligence API and writes it into the Customer’s own Microsoft Sentinel and Azure Log Analytics environment, and it lets the Customer enrich incidents with Group-IB context.

The Integration is provided free of charge. Access to the underlying TI Services is subject to the Customer’s applicable TI Agreement (see Section 2).

2.1. To use the Integration, the Customer must hold a valid Group-IB Threat Intelligence licence with API access (a username and API key), and must have Microsoft Sentinel enabled on its Azure subscription. Which playbooks work, and which data collections can be retrieved, depends on the scope of the Customer’s licence.

2.2. The Integration’s functionality requires valid access to the TI Services. This is a technical restriction enforced at API level.

2.3. The Customer’s use of the TI Services, including the data retrieved through the Integration, remains governed by the agreement or licence terms under which the Customer obtained the TI Services (the “TI Agreement”). If these Terms conflict with the TI Agreement regarding the TI Services or their data, the TI Agreement prevails.

2.4. The Integration is designed for Microsoft Azure commercial cloud. Microsoft Azure Government is not supported.

3.1. The Integration’s source code is publicly available in the Microsoft Azure-Sentinel repository on GitHub. The code is licensed under the MIT License that applies to that repository. Nothing in these Terms limits or revokes any right the Customer has under that licence.

3.2. The MIT License applies to the Integration software and does not extend to the TI Services, the threat intelligence data made available through those services, or Group-IB’s names, logos or trademarks. Access to and use of the TI Services and their data remain subject to the TI Agreement.

4.1. The Customer deploys and runs the Integration in its own Azure environment and is responsible for that environment, including access control, role assignments, managed identities, configuration and costs charged by Microsoft.

4.2. The Customer must keep its Group-IB API credentials confidential, store them securely (for example as secure parameters), and promptly tell Group-IB if it suspects they have been compromised.

4.3. The Customer must not use the Integration or the data it provides to: (a) conduct unauthorised security activities or gain unauthorised access to any system; (b) unlawfully monitor, profile or target individuals; (c) collect, submit or otherwise process personal data in violation of applicable data protection laws; (d) redistribute or resell Group-IB threat intelligence except as the TI Agreement permits; (e) circumvent the licence, access or rate-limit controls of the TI Services; or (f) violate applicable law.

4.4. Group-IB may suspend or block API access in connection with a Customer’s breach of this Section or the TI Agreement.

5.1. The Integration runs inside the Customer’s Azure environment. Threat intelligence retrieved by the Integration is stored in the Customer’s Microsoft Sentinel workspace and Log Analytics tables, and the Customer is responsible for its retention and protection there. Removing the Integration does not by itself delete data already stored in the Customer’s Azure environment.

5.2. When the Customer uses the optional enrichment playbooks (IP, domain, hash and URL lookups, WHOIS and scoring), the indicators submitted and associated request data are transmitted to the Group-IB Threat Intelligence API. Group-IB may log and process such requests in accordance with the TI Agreement and applicable data protection terms as stipulated in the Data Processing Agreement entered between Group-IB and the Customer (“DPA”).

5.3. Group-IB processes personal data in connection with the Integration in accordance with the TI Agreement and the DPA.

6.1. Group-IB may provide technical support for the Integration on a reasonable-efforts basis through its existing customer support channels. Unless expressly agreed otherwise, no separate service level agreement (SLA) or guaranteed response, resolution or availability times apply to the Integration. Nothing in this Section modifies any support commitments applicable to the TI Services under the TI Agreement.

6.2. Group-IB may update, change, stop maintaining or stop distributing the Integration or any part of it at any time. This does not affect rights already granted under the MIT License for copies of the source code.

7.1. Microsoft Sentinel, Microsoft Azure and the Microsoft Marketplace are services of Microsoft Corporation and are governed by Microsoft’s own terms. Group-IB is not responsible for them, including for outages, changes, deprecations or charges. Microsoft names and trademarks belong to Microsoft.

8.1. To the extent permitted by law, the Integration is provided “as is” and “as available”, without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, non-infringement, and uninterrupted or error-free operation.

8.2. Threat intelligence is provided for information purposes. Group-IB does not guarantee that the Integration or the data it delivers will detect or prevent all threats or incidents. The Customer remains responsible for its own security decisions and posture.

9.1. To the maximum extent permitted by law, Group-IB is not liable for any indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, data or business, arising out of or in connection with the Integration, even if advised of the possibility of such damages.

9.2. Because the Integration is provided free of charge, Group-IB’s total aggregate liability arising out of or in connection with the Integration is limited to USD 100.

9.3. Nothing in these Terms excludes or limits liability that cannot be excluded or limited by law. For the avoidance of doubt, the limitations in this Section apply only to claims arising from the Integration itself and do not amend the limitations of liability that apply to the TI Services under the TI Agreement.

10.1. The Customer must comply with all applicable export control and sanctions laws in using the Integration and the TI Services and must not use or make them available in violation of those laws

11.1. Group-IB may update these Terms by publishing a new version on the Website. Material changes take effect 30 days after publication. Continued use of the Integration after that date means the Customer accepts the updated Terms.

11.2. The Customer may stop using the Integration at any time by removing it from its environment. Group-IB may suspend or end the Customer’s access to the TI Services in accordance with the TI Agreement. If the TI Agreement expires or ends, the Integration may stop working in whole or in part because the required API access is no longer available. Nothing in this Section affects the rights granted under the MIT License.

12.1. Where the Customer has a TI Agreement, any dispute arising out of or in connection with these Terms is governed by the governing law and dispute resolution provisions of that TI Agreement, which are incorporated here by reference. Sections 12.2 and 12.3 apply only where no TI Agreement applies.

12.2. Where Section 12.1 does not apply, these Terms are governed by the laws of Singapore.

12.3. Where Section 12.1 does not apply, any dispute, controversy or claim arising from or in connection with these Terms, including any question about their existence, validity or termination, will be referred to and finally resolved by arbitration administered by the Singapore International Arbitration Centre (“SIAC”) under the SIAC Arbitration Rules in force at the time, which are incorporated by reference. The seat of arbitration is Singapore, the tribunal consists of one arbitrator, and the language of the proceedings is English.

13.1. These Terms govern the Customer’s use of the Integration, without prejudice to the MIT License governing its source code and the TI Agreement governing access to and use of the TI Services. Nothing in these Terms modifies or supersedes the TI Agreement. If any provision is held unenforceable, the remaining provisions stay in effect. A failure to enforce a provision is not a waiver of it.

13.2. Questions about these Terms can be sent to [email protected]