Details
| ID | IP2LocationIO |
|---|---|
| Provider | IP2Location |
| Category | Utilities |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.8.3296088 |
| Supported Modules | Agentix XSIAM |
README
IP2Location.io integration to query IP geolocation data.
Configure IP2LocationIO in Cortex
| Parameter | Description | Required |
|---|---|---|
| Source Reliability | Reliability of the source providing the intelligence data. | False |
| IP2Location.io API | True | |
| API Key | True | |
| Trust any certificate (not secure) | False | |
| Use system proxy settings | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
ip
Return IP information and reputation
Base Command
ip
Input
| Argument Name | Description | Required |
|---|---|---|
| ip | List of IPs. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Score | Number | The actual score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| IP2LocationIO.IP.asn | String | The autonomous system name for the IP address. |
| IP2LocationIO.IP.asn_description | String | The ASN description. |
| IP2LocationIO.IP.ip | String | The actual IP address. |
| IP2LocationIO.IP.query | String | IP address that was queried. |
| IP2LocationIO.IP.raw | Unknown | Additional raw data for the IP address. |
| IP.Address | String | IP address. |
| IP.ASN | String | The autonomous system name for the IP address. |
| IP.Relationships.EntityA | string | The source of the relationship. |
| IP.Relationships.EntityB | string | The destination of the relationship. |
| IP.Relationships.Relationship | string | The name of the relationship. |
| IP.Relationships.EntityAType | string | The type of the source of the relationship. |
| IP.Relationships.EntityBType | string | The type of the destination of the relationship. |
Configuration parameters
integrationReliability— Source Reliabilityurl— IP2Location.io API (required)credentials— (required)insecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (1)
-
ipReturn IP information and reputation
import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 import urllib3 from typing import Any urllib3.disable_warnings() class Client(BaseClient): def get_ip_geolocation(self, ip: str, api_key: str) -> dict[str, Any]: return self._http_request(method="GET", url_suffix="/", params={"ip": ip, "key": api_key}) def test_module(client: Client) -> str: try: client._http_request(method="GET", url_suffix="/", params={"ip": "8.8.8.8"}) except DemistoException as e: if "Forbidden" in str(e): return "Authorization Error: make sure API Key is correctly set" else: raise e return "ok" def ip_geolocation_command( client: Client, args: dict[str, Any], reliability: DBotScoreReliability, api_key: str ) -> list[CommandResults]: ips = argToList(args.get("ip")) if len(ips) == 0: raise ValueError("IP(s) not specified") command_results: list[CommandResults] = [] for ip in ips: if not is_ip_valid(ip, accept_v6_ips=True): # check IP's validity raise ValueError(f'IP "{ip}" is not valid') ip_data = client.get_ip_geolocation(ip, api_key) ip_data["ip"] = ip dbot_score = Common.DBotScore( indicator=ip, indicator_type=DBotScoreType.IP, integration_name="IP2LocationIO", score=Common.DBotScore.NONE, reliability=reliability, ) ip_standard_context = Common.IP( ip=ip, geo_country=ip_data.get("country_name"), geo_latitude=ip_data.get("latitude"), geo_longitude=ip_data.get("longitude"), geo_description=f"{ip_data.get('city_name')}, {ip_data.get('region_name')}, {ip_data.get('country_name')}", region=ip_data.get("region"), asn=f"AS{ip_data.get('asn')}", dbot_score=dbot_score, ) ip_context_excluded_fields = ["objects", "nir"] ip_data = {k: ip_data[k] for k in ip_data if k not in ip_context_excluded_fields} readable_output = tableToMarkdown("IP", ip_data) command_results.append( CommandResults( readable_output=readable_output, outputs_prefix="IP2LocationIO.IP", outputs_key_field="ip", outputs=ip_data, indicator=ip_standard_context, ) ) return command_results def main() -> None: params = demisto.params() args = demisto.args() command = demisto.command() api_key = params.get("credentials", {}).get("password") base_url = urljoin(params.get("url").rstrip("/"), "") verify_certificate = not params.get("insecure", False) proxy = params.get("proxy", False) reliability = params.get("integrationReliability", DBotScoreReliability.C) demisto.debug(f"Command being called is {command}") try: client = Client(base_url=base_url, verify=verify_certificate, proxy=proxy) if command == "test-module": result = test_module(client) return_results(result) elif command == "ip": return_results(ip_geolocation_command(client, args, reliability, api_key)) else: raise NotImplementedError(f"Command {command} is not implemented") except Exception as e: return_error(f"Failed to execute {command} command.\nError:\n{str(e)}") if __name__ in ("__main__", "__builtin__", "builtins"): main()