AbuseIPDB

Central repository to report and identify IP addresses that have been associated with malicious activity online. Check the Detailed Information section for more information on how to configure the integration.

Data Enrichment & Threat Intelligence · AbuseIPDB

Details

ID	`AbuseIPDB`
Provider	AbuseDB
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10404775`
Supported Modules	Agentix Cloud Runtime Security XSIAM EDR Cortex Cloud

README

Use the AbuseIPDB integration to report and identify IP addresses that have been associated with malicious activity online.

Use Cases

Check, Report, and get block list of top malicious IPs.

Configure AbuseIPDB on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for AbuseIPDB.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- API Key (v2).
- Source Reliability: Reliability of the source providing the intelligence data.
- IP Threshold. Minimum score from AbuseIPDB analysis to consider the IP malicious. (>20).
- Max reports age.
- Disable reputation lookups for private IP addresses: To reduce the number of lookups made to the AbuseIPDB API.
- Disregard quota errors.
- Abuse.ch Hunting API URL: The base URL for the hunting API (Default: https://hunting-api.abuse.ch/api/v1/).
- Abuse.ch Hunting API Key: A credential field for the API key.
Click Test to validate the API Key, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Check if an IP address is in the AbuseIP database: ip
Query a block of IP addresses: abuseipdb-check-cidr-block
Report an IP address: abuseipdb-report-ip
Get a list of the most reported IP addresses: abuseipdb-get-blacklist
Get a list of report categories: abuseipdb-get-categories
Get the full list of false positive IP addresses: abuseipdb-get-fplist

1. Check if an IP address is in the AbuseIP database

Checks the specified IP address against the AbuseIP database.

Base Command

ip

Input

Argument Name	Description	Required
ip	IP address to check	Required
days	Time range to return reports for (in days), default is 30	Optional
verbose	Report length, "true" returns the full report, "false" does not return reported categories, default is "true"	Optional
threshold	Minimum score from AbuseIPDB to consider the IP malicious (must be greater than 20), default is 80	Optional
override_private_lookup	Enrichment of private IP addresses will be conducted even if it has been disabled at the integration level, default is "false"	Optional

Context Output

Path	Type	Description
AbuseIPDB.IP.Address	unknown	IP address
AbuseIPDB.IP.AbuseConfidenceScore	unknown	Confidence score fetched from AbuseIPDB
AbuseIPDB.IP.TotalReports	unknown	The number of times this address has been reported
AbuseIPDB.IP.Geo.Country	String	Country associated with this IP Address
AbuseIPDB.IP.Geo.CountryCode	String	Country code associated with this IP Address
AbuseIPDB.IP.Hostnames	String	The hostame(s) of the IP address.
AbuseIPDB.IP.IpVersion	String	The version of the IP address.
AbuseIPDB.IP.IsPublic	String	Is the IP address public.
AbuseIPDB.IP.IsTor	String	Is the IP address a Tor IP.
AbuseIPDB.IP.IsWhitelisted	String	Is the IP address whitelisted.
AbuseIPDB.IP.LastReportedAt	String	When the IP address was last reported.
AbuseIPDB.IP.NumDistinctUsers	String	The distinct number of users.
AbuseIPDB.IP.Address.Reports	unknown	Reports summary (for "verbose" reports)
DBotScore.Score	unknown	Analysis score
DBotScore.Vendor	unknown	Vendor name (AbuseIPDB)
DBotScore.Indicator	unknown	The IP address
DBotScore.Type	unknown	The type (ip)
AbuseIPDB.IP.Malicious.Vendor	unknown	The vendor that determined this IP address to be malicious
AbuseIPDB.IP.Malicious.Detections	unknown	The Detections that led to the verdict
AbuseIPDB.IP.UsageType	String	Usage type of the IP.
AbuseIPDB.IP.Domain	String	Domain of the IP.

Command Example

!ip ip=8.8.8.8 days=30 verbose=true

Context Example

Human Readable Output

2. Query a block of IP addresses

Queries a block of IPs to check against the database

Base Command

abuseipdb-check-cidr-block

Input

Argument Name	Description	Required
network	IPv4 Address Block in CIDR notation.	Required
days	Time range to return reports for (in days), default is 30	Optional
limit	Maximum number of IPs to check, default is 40	Optional
threshold	Minimum score from AbuseIPDB to consider the IP malicious (must be greater than 20), default is 80	Optional

Context Output

Path	Type	Description
AbuseIPDB.IP.Address	unknown	IP address
AbuseIPDB.IP.AbuseConfidenceScore	unknown	Confidence score fetched from AbuseIPDB
AbuseIPDB.IP.Geo.Country	String	Country associated with this IP Address
AbuseIPDB.IP.Geo.CountryCode	String	Country code associated with this IP Address
AbuseIPDB.IP.Hostnames	String	The hostame(s) of the IP address.
AbuseIPDB.IP.IpVersion	String	The version of the IP address.
AbuseIPDB.IP.IsPublic	String	Is the IP address public.
AbuseIPDB.IP.IsTor	String	Is the IP address a Tor IP.
AbuseIPDB.IP.IsWhitelisted	String	Is the IP address whitelisted.
AbuseIPDB.IP.LastReportedAt	String	When the IP address was last reported.
AbuseIPDB.IP.NumDistinctUsers	String	The distinct number of users.
AbuseIPDB.IP.TotalReports	unknown	The number of times this address has been reported
DBotScore.Score	unknown	Analysis score
DBotScore.Vendor	unknown	Vendor name (AbuseIPDB)
DBotScore.Indicator	unknown	The IP address
DBotScore.Type	unknown	The type (ip)
AbuseIPDB.IP.Malicious.Vendor	unknown	The vendor that determined this IP address to be malicious
AbuseIPDB.IP.Malicious.Detections	unknown	The Detections that led to the verdict
AbuseIPDB.IP.UsageType	String	Usage type of the IP.
AbuseIPDB.IP.Domain	String	Domain of the IP.

Command Example

!abuseipdb-check-cidr-block network="127.0.0.2/24" days="30" limit="40" threshold="80"

Human Readable Output

3. Report an IP address

Report an IP address to AbuseIPDB

Base Command

abuseipdb-report-ip

Input

Argument Name	Description	Required
ip	The IP address to report	Required
categories	CSV list of category IDs (numerical representation or in their name)	Required

Context Output

There is no context output for this command.

Command Example

!abuseipdb-report-ip ip=8.8.8.8 categories="18,22,23"

Human Readable Output

4. Get a list of the most reported IP addresses

Returns a list of the most reported IP addresses

Base Command

abuseipdb-get-blacklist

Input

Argument Name	Description	Required
days	Time range to return reports for (in days), default is 30	Optional
limit	Maximum number of IPs to retrieve, default is 50	Optional
confidence	The Minimum confidence required for the retrieved IPs. Default is 100	Optional

Context Output

Path	Type	Description
AbuseIPDB.Blacklist	unknown	List of IPs on block list

Command Example

!abuseipdb-get-blacklist days=30 limit=5

Context Example

Human Readable Output

5. Get a list of report categories

Returns a list of report categories from AbuseIPDB

Base Command

abuseipdb-get-categories

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
AbuseIPDB.Categories	string	List of AbuseIPDB categories

Command Example

!abuseipdb-get-categories

Human Readable Output

6. Get the full list of false positive IP addresses

Returns the False Positive List (FPL) from abuse.ch, containing indicators (IPs and domains) that have been removed from their blocklists.

Base Command

abuseipdb-get-fplist

Input

Argument Name	Description	Required
format	The format of the output (json, csv). Set to 'csv' to download the response as a file. The 'json' format inserts the response into the incident context.	Optional
limit	The maximum number of results to return. Ignored when all_results is set to true or when format is set to csv.	Optional
all_results	Whether to return all results. Ignored when format is set to csv.	Optional

Context Output

Path	Type	Description
AbuseIPDB.FPL.id	String	The unique identifier for the False Positive List entry.
AbuseIPDB.FPL.time_stamp	Date	The date and time (UTC) when the entry was added to the False Positive List.
AbuseIPDB.FPL.platform	String	The platform or service associated with the entry.
AbuseIPDB.FPL.entry_type	String	The type of the indicator (e.g., IPv4, domain).
AbuseIPDB.FPL.entry_value	String	The actual indicator value (IP address or domain) that was marked as a false positive.
AbuseIPDB.FPL.removed_by	String	The entity or user who requested the removal of the indicator from the blocklist.
AbuseIPDB.FPL.removal_notes	String	Additional context or justification for why the indicator was removed.

Command Example

!abuseipdb-get-fplist format="json" limit=10

Additional Information

What is the "Confidence of Abuse" rating, and how is it calculated?
AbuseIPDB confidence of abuse is a rating (0-100) of how confident we are, based on user reports, that an IP address is completely malicious. A rating of 100 means we are certain that an IP address is malicious, and a rating of 0 means we have no reason to suspect it is malicious.

Configuration parameters

server — AbuseIP server URL (required)
credentials —
apikey — API Key (v2)
abusech_hunting_url — Abuse.ch Hunting API URL
hunting_credentials —
integrationReliability — Source Reliability
threshold — Minimum score threshold
days — Maximum reports age (in days)
disable_private_ip_lookup — Disable reputation lookups for private IP addresses
disregard_quota — Disregard quota errors
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (6)

abuseipdb-check-cidr-block
Queries a block of IP addresses to check against the database.
abuseipdb-get-blacklist
Returns a list of the most reported IP addresses.
abuseipdb-get-categories
Returns a list of report categories from AbuseIPDB.
abuseipdb-get-fplist
Returns the False Positive List (FPL) from abuse.ch, including IP and domain indicators removed from their blocklists.
abuseipdb-report-ip
Reports an IP address to AbuseIPDB.
ip
Checks the specified IP address against the AbuseIP database.

Source

AbuseDB.py AbuseDB_test.py AbuseDB.yml AbuseDB_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: AbuseDB
sectionorder:
- Connect
- Collect
commonfields:
  id: AbuseIPDB
  version: -1
configuration:
- defaultvalue: https://api.abuseipdb.com/api/v2/
  display: AbuseIP server URL
  name: server
  required: true
  type: 0
  section: Connect
- name: credentials
  type: 9
  displaypassword: API Key (v2)
  hiddenusername: true
  section: Connect
  required: false
- display: API Key (v2)
  name: apikey
  type: 4
  hidden: true
  section: Connect
  required: false
- display: Abuse.ch Hunting API URL
  name: abusech_hunting_url
  type: 0
  defaultvalue: https://hunting-api.abuse.ch/api/v1/
  required: false
  section: Connect
- name: hunting_credentials
  type: 9
  displaypassword: Abuse.ch Hunting API Key
  hiddenusername: true
  section: Connect
  required: false
- defaultvalue: 'C - Fairly reliable'
  display: Source Reliability
  name: integrationReliability
  required: false
  type: 15
  additionalinfo: Reliability of the source providing the intelligence data.
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  section: Collect
- defaultvalue: '80'
  display: Minimum score threshold
  name: threshold
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Maximum reports age (in days)
  name: days
  type: 0
  defaultvalue: '30'
  section: Collect
  advanced: true
  required: false
- display: Disable reputation lookups for private IP addresses
  name: disable_private_ip_lookup
  type: 8
  required: false
  defaultvalue: 'false'
  additionalinfo: To reduce the number of lookups made to the AbuseIPDB API, this option can be selected to gracefully skip enrichment of any IP addresses allocated for private networks.
  section: Collect
- display: Disregard quota errors
  name: disregard_quota
  type: 8
  section: Collect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: Central repository to report and identify IP addresses that have been associated with malicious activity online. Check the Detailed Information section for more information on how to configure the integration.
display: AbuseIPDB
name: AbuseIPDB
script:
  commands:
  - arguments:
    - default: true
      description: The IP address to check (CSV supported).
      isArray: true
      name: ip
    - defaultValue: false
      description: When set to "true", enrichment of private IP addresses will be conducted even if it has been disabled at the integration level.
      name: override_private_lookup
      default: false
      predefined:
      - 'true'
      - 'false'
    - description: The time range to return reports (in days). Default is the time that was configured in the integration configuration "Maximum reports age (in days)".
      name: days
    - defaultValue: 'true'
      description: The length of the report. "true" returns the full report, "false" does not return reported categories. Default is "true".
      name: verbose
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '80'
      description: The minimum score from AbuseIPDB to consider whether the IP address is malicious (must be greater than 20). Default is 80.
      name: threshold
    description: Checks the specified IP address against the AbuseIP database.
    name: ip
    outputs:
    - contextPath: IP.Address
      description: The address of the IP.
      type: String
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: String
    - contextPath: IP.Geo.CountryCode
      description: The country code in which the IP address is located.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: The vendor reporting the IP address as malicious.
      type: String
    - contextPath: IP.Malicious.Detections
      description: The Detections that led to the verdict.
      type: String
    - contextPath: AbuseIPDB.IP.Address
      description: The IP address fetched from AbuseIPDB.
      type: String
    - contextPath: AbuseIPDB.IP.AbuseConfidenceScore
      description: The confidence score fetched from AbuseIPDB.
      type: String
    - contextPath: AbuseIPDB.IP.TotalReports
      description: The number of times the address has been reported.
      type: Number
    - contextPath: AbuseIPDB.IP.Geo.Country
      description: The country associated with the IP Address.
      type: String
    - contextPath: AbuseIPDB.IP.Geo.CountryCode
      description: The country code associated with the IP Address.
      type: String
    - contextPath: AbuseIPDB.IP.Hostnames
      description: The hostame(s) of the IP address.
      type: String
    - contextPath: AbuseIPDB.IP.IpVersion
      description: The version of the IP address.
      type: String
    - contextPath: AbuseIPDB.IP.IsPublic
      description: Is the IP address public.
      type: String
    - contextPath: AbuseIPDB.IP.IsTor
      description: Is the IP address a Tor IP.
      type: String¨
    - contextPath: AbuseIPDB.IP.IsWhitelisted
      description: Is the IP address whitelisted.
      type: String
    - contextPath: AbuseIPDB.IP.LastReportedAt
      description: When the IP address was last reported.
      type: String
    - contextPath: AbuseIPDB.IP.NumDistinctUsers
      description: The distinct number of users.
      type: String
    - contextPath: AbuseIPDB.IP.Reports
      description: The reports summary (for "verbose" reports).
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: AbuseIPDB.IP.Malicious.Vendor
      description: The vendor that determined this IP address to be malicious.
      type: String
    - contextPath: AbuseIPDB.IP.Malicious.Detections
      description: The Detections that led to the verdict.
      type: String
    - contextPath: IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: String
    - contextPath: AbuseIPDB.IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: String
    - contextPath: AbuseIPDB.IP.ISP
      description: The internet service provider of the IP.
      type: String
    - contextPath: AbuseIPDB.IP.UsageType
      description: Usage type of the IP.
      type: String
    - contextPath: AbuseIPDB.IP.Domain
      description: Domain of the IP.
      type: String
  - arguments:
    - description: IPv4 Address Block in CIDR notation.
      name: network
      required: true
    - defaultValue: '30'
      description: The time range to return reports (in days). Default is 30.
      name: days
    - defaultValue: '40'
      description: The maximum number of IPs to check. Default is 40.
      name: limit
    - defaultValue: '80'
      description: The minimum score from AbuseIPDB to consider whether the IP address is malicious (must be greater than 20). Default is 80.
      name: threshold
    description: Queries a block of IP addresses to check against the database.
    name: abuseipdb-check-cidr-block
    outputs:
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: String
    - contextPath: IP.Geo.CountryCode
      description: The country code in which the IP address is located.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: The vendor reporting the IP address as malicious.
      type: String
    - contextPath: IP.Malicious.Detections
      description: The Detections that led to the verdict.
      type: String
    - contextPath: IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: String
    - contextPath: AbuseIPDB.IP.Address
      description: The IP address fetched from AbuseIPDB.
      type: String
    - contextPath: AbuseIPDB.IP.AbuseConfidenceScore
      description: The confidence score fetched from AbuseIPDB.
      type: Unknown
    - contextPath: AbuseIPDB.IP.TotalReports
      description: The number of times this address has been reported.
      type: Unknown
    - contextPath: AbuseIPDB.IP.Geo.Country
      description: The country associated with the IP Address.
      type: String
    - contextPath: AbuseIPDB.IP.Geo.CountryCode
      description: The country code associated with the IP Address.
      type: String
    - contextPath: AbuseIPDB.IP.Hostnames
      description: The hostame(s) of the IP address.
      type: String
    - contextPath: AbuseIPDB.IP.IpVersion
      description: The version of the IP address.
      type: String
    - contextPath: AbuseIPDB.IP.IsPublic
      description: Is the IP address public.
      type: String
    - contextPath: AbuseIPDB.IP.IsTor
      description: Is the IP address a Tor IP.
      type: String¨
    - contextPath: AbuseIPDB.IP.IsWhitelisted
      description: Is the IP address whitelisted.
      type: String
    - contextPath: AbuseIPDB.IP.LastReportedAt
      description: When the IP address was last reported.
      type: String
    - contextPath: AbuseIPDB.IP.NumDistinctUsers
      description: The distinct number of users.
      type: String
    - contextPath: AbuseIPDB.IP.Reports
      description: Reports summary (for "verbose" reports).
      type: Unknown
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: AbuseIPDB.IP.Malicious.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: AbuseIPDB.IP.Malicious.Detections
      description: The Detections that led to the verdict.
      type: String
    - contextPath: AbuseIPDB.IP.ISP
      description: The internet service provider of the IP.
      type: String
    - contextPath: AbuseIPDB.IP.UsageType
      description: Usage type of the IP.
      type: String
    - contextPath: AbuseIPDB.IP.Domain
      description: Domain of the IP.
      type: String
  - arguments:
    - description: The IP address to report.
      name: ip
      required: true
    - description: A CSV list of category IDs. For more information, see https://www.abuseipdb.com/categories.
      name: categories
      required: true
    description: Reports an IP address to AbuseIPDB.
    name: abuseipdb-report-ip
  - arguments:
    - defaultValue: '30'
      description: The time range to return reports (in days). Default is 30.
      name: days
    - defaultValue: '50'
      description: 'The maximum number of IPs to retrieve. Default is 50. '
      name: limit
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to save a list of IPs on a block list in the Context Data in Demisto. Default is false.
      name: saveToContext
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '100'
      description: The Minimum confidence required for the retrieved IPs.
      name: confidence
    description: Returns a list of the most reported IP addresses.
    name: abuseipdb-get-blacklist
    outputs:
    - contextPath: AbuseIPDB.Blacklist
      description: A list of IP addresses on a block list.
      type: Unknown
  - arguments: []
    description: Returns a list of report categories from AbuseIPDB.
    name: abuseipdb-get-categories
    outputs:
    - contextPath: AbuseIPDB.Categories
      description: The list of AbuseIPDB categories.
      type: string
  - arguments:
    - defaultValue: json
      description: The output format (JSON or CSV). Use "csv" to download the response as a file or "json" to insert it into the incident context.
      name: format
      auto: PREDEFINED
      predefined:
      - json
      - csv
    - defaultValue: '50'
      description: The maximum number of results to return. This is ignored when all_results is set to true or format is set to csv.
      name: limit
    - defaultValue: false
      description: whether to return all results. This is ignored when format is set to csv.
      name: all_results
    description: Returns the False Positive List (FPL) from abuse.ch, including IP and domain indicators removed from their blocklists.
    name: abuseipdb-get-fplist
    outputs:
    - contextPath: AbuseIPDB.FPL.id
      description: The unique identifier for the False Positive List entry.
      type: String
    - contextPath: AbuseIPDB.FPL.time_stamp
      description: The date and time (UTC) the entry was added to the False Positive List.
      type: String
    - contextPath: AbuseIPDB.FPL.platform
      description: The platform or service associated with the entry.
      type: String
    - contextPath: AbuseIPDB.FPL.entry_type
      description: The indicator type (for example, IPv4, domain).
      type: String
    - contextPath: AbuseIPDB.FPL.entry_value
      description: The actual indicator value (IP address or domain) that was marked as a false positive.
      type: String
    - contextPath: AbuseIPDB.FPL.removed_by
      description: The entity or user who requested the removal of the indicator from the blocklist.
      type: String
    - contextPath: AbuseIPDB.FPL.removal_notes
      description: Additional context or justification for why the indicator was removed.
      type: String
  script: ''
  subtype: python3
  type: python
  dockerimage: demisto/python3:3.12.13.10404775
fromversion: 5.0.0
tests:
- AbuseIPDB Test