IP2LocationIO

IP2Location.io integration to query IP geolocation data.

Utilities · IP2LocationIO

Details

IDIP2LocationIO
ProviderIP2Location
CategoryUtilities
From Version6.0.0
Docker Imagedemisto/python3:3.12.8.3296088
Supported ModulesAgentix XSIAM

README

IP2Location.io integration to query IP geolocation data.

Configure IP2LocationIO in Cortex

Parameter Description Required
Source Reliability Reliability of the source providing the intelligence data. False
IP2Location.io API   True
API Key   True
Trust any certificate (not secure)   False
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip


Return IP information and reputation

Base Command

ip

Input

Argument Name Description Required
ip List of IPs. Optional

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
IP2LocationIO.IP.asn String The autonomous system name for the IP address.
IP2LocationIO.IP.asn_description String The ASN description.
IP2LocationIO.IP.ip String The actual IP address.
IP2LocationIO.IP.query String IP address that was queried.
IP2LocationIO.IP.raw Unknown Additional raw data for the IP address.
IP.Address String IP address.
IP.ASN String The autonomous system name for the IP address.
IP.Relationships.EntityA string The source of the relationship.
IP.Relationships.EntityB string The destination of the relationship.
IP.Relationships.Relationship string The name of the relationship.
IP.Relationships.EntityAType string The type of the source of the relationship.
IP.Relationships.EntityBType string The type of the destination of the relationship.

Configuration parameters

  • integrationReliability — Source Reliability
  • url — IP2Location.io API (required)
  • credentials — (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (1)

  • ip

    Return IP information and reputation

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


import urllib3
from typing import Any

urllib3.disable_warnings()


class Client(BaseClient):
    def get_ip_geolocation(self, ip: str, api_key: str) -> dict[str, Any]:
        return self._http_request(method="GET", url_suffix="/", params={"ip": ip, "key": api_key})


def test_module(client: Client) -> str:
    try:
        client._http_request(method="GET", url_suffix="/", params={"ip": "8.8.8.8"})
    except DemistoException as e:
        if "Forbidden" in str(e):
            return "Authorization Error: make sure API Key is correctly set"
        else:
            raise e

    return "ok"


def ip_geolocation_command(
    client: Client, args: dict[str, Any], reliability: DBotScoreReliability, api_key: str
) -> list[CommandResults]:
    ips = argToList(args.get("ip"))
    if len(ips) == 0:
        raise ValueError("IP(s) not specified")

    command_results: list[CommandResults] = []

    for ip in ips:
        if not is_ip_valid(ip, accept_v6_ips=True):  # check IP's validity
            raise ValueError(f'IP "{ip}" is not valid')
        ip_data = client.get_ip_geolocation(ip, api_key)
        ip_data["ip"] = ip

        dbot_score = Common.DBotScore(
            indicator=ip,
            indicator_type=DBotScoreType.IP,
            integration_name="IP2LocationIO",
            score=Common.DBotScore.NONE,
            reliability=reliability,
        )

        ip_standard_context = Common.IP(
            ip=ip,
            geo_country=ip_data.get("country_name"),
            geo_latitude=ip_data.get("latitude"),
            geo_longitude=ip_data.get("longitude"),
            geo_description=f"{ip_data.get('city_name')}, {ip_data.get('region_name')}, {ip_data.get('country_name')}",
            region=ip_data.get("region"),
            asn=f"AS{ip_data.get('asn')}",
            dbot_score=dbot_score,
        )

        ip_context_excluded_fields = ["objects", "nir"]
        ip_data = {k: ip_data[k] for k in ip_data if k not in ip_context_excluded_fields}

        readable_output = tableToMarkdown("IP", ip_data)

        command_results.append(
            CommandResults(
                readable_output=readable_output,
                outputs_prefix="IP2LocationIO.IP",
                outputs_key_field="ip",
                outputs=ip_data,
                indicator=ip_standard_context,
            )
        )
    return command_results


def main() -> None:
    params = demisto.params()
    args = demisto.args()
    command = demisto.command()

    api_key = params.get("credentials", {}).get("password")

    base_url = urljoin(params.get("url").rstrip("/"), "")

    verify_certificate = not params.get("insecure", False)

    proxy = params.get("proxy", False)

    reliability = params.get("integrationReliability", DBotScoreReliability.C)

    demisto.debug(f"Command being called is {command}")
    try:
        client = Client(base_url=base_url, verify=verify_certificate, proxy=proxy)

        if command == "test-module":
            result = test_module(client)
            return_results(result)

        elif command == "ip":
            return_results(ip_geolocation_command(client, args, reliability, api_key))

        else:
            raise NotImplementedError(f"Command {command} is not implemented")

    except Exception as e:
        return_error(f"Failed to execute {command} command.\nError:\n{str(e)}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()