IP-API

Details

ID	`IP-API`
Provider	Kloudend Inc
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

This integration will enrich IP addresses from IP-API with data about the geolocation, as well as a determination of the IP address being associated with a mobile device, hosting or proxy. Revers DNS is also returned.

This service is available for free (with a throttle) - or paid.

This integration was integrated and tested with IP-API

Configure IP-API in Cortex

Parameter	Description	Required
Use HTTPS to communicate with the API	Use of HTTPS requires an API key	False
API Key	Only required to bypass rate limits and/or use HTTPS	False
Fields to return	See https://members.ip-api.com/docs/json for details	True
Use system proxy settings		False
Trust any certificate (not secure)		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Return IP information

Base Command

ip

Input

Argument Name	Description	Required
ip	List of IPs.	Optional

Context Output

Path	Type	Description
IP-API.continentCode	string	continentCode
IP-API.zip	string	zip
IP-API.mobile	boolean	mobile
IP-API.reverse	string	reverse
IP-API.countryCode	string	countryCode
IP-API.org	string	org
IP-API.isp	string	isp
IP-API.currentTime	string	currentTime
IP-API.query	string	query
IP-API.city	string	city
IP-API.lon	number	lon
IP-API.proxy	boolean	proxy
IP-API.district	string	district
IP-API.countryCode3	string	countryCode3
IP-API.currency	string	currency
IP-API.callingCode	number	callingCode
IP-API.as	string	as
IP-API.status	string	status
IP-API.offset	string	offset
IP-API.continent	string	continent
IP-API.region	string	region
IP-API.country	string	country
IP-API.timezone	string	timezone
IP-API.hosting	boolean	hosting
IP-API.asname	string	asname
IP-API.lat	number	lat
IP-API.regionName	string	regionName
DBotScore.Indicator	The indicator that was tested.	String
DBotScore.Score	The actual score.	Number
DBotScore.Type	The type of indicator.	String
DBotScore.Vendor	The vendor used to calculate the score.	String
DBotScore.Reliability	Reliability of the source providing the intelligence data.	String

Command Example

!ip ip=8.8.8.8

Human Readable Output

Configuration parameters

https — Use HTTPS to communicate with the API
apikey — API Key
fields — Fields to return (required)
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
integrationReliability — Source Reliability
feedExpirationPolicy —
feedExpirationInterval —

Commands (1)

ip
Return IP information

Source

IPAPI.py IPAPI.yml IPAPI_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Kloudend Inc
commonfields:
  id: IP-API
  version: -1
configuration:
- additionalinfo: Use of HTTPS requires an API key
  defaultvalue: 'false'
  display: Use HTTPS to communicate with the API
  name: https
  type: 8
  required: false
- additionalinfo: Only required to bypass rate limits and/or use HTTPS
  display: API Key
  name: apikey
  type: 4
  required: false
- additionalinfo: See https://members.ip-api.com/docs/json for details
  defaultvalue: '536608767'
  display: Fields to return
  name: fields
  required: true
  type: 0
- defaultvalue: 'false'
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
description: 'This integration will enrich IP addresses from IP-API with data about the geolocation, as well as a determination of the IP address being associated with a mobile device, hosting or proxy. Revers DNS is also returned.


  This service is available for free (with a throttle) - or paid.

  '
display: IP-API
name: IP-API
script:
  commands:
  - arguments:
    - default: true
      description: List of IPs.
      isArray: true
      name: ip
      required: true
    description: Return IP information
    name: ip
    outputs:
    - contextPath: IP-API.continentCode
      description: continentCode.
      type: String
    - contextPath: IP-API.zip
      description: zip.
      type: String
    - contextPath: IP-API.mobile
      description: mobile.
      type: Boolean
    - contextPath: IP-API.reverse
      description: reverse.
      type: String
    - contextPath: IP-API.countryCode
      description: countryCode.
      type: String
    - contextPath: IP-API.org
      description: org.
      type: String
    - contextPath: IP-API.isp
      description: isp.
      type: String
    - contextPath: IP-API.currentTime
      description: currentTime.
      type: String
    - contextPath: IP-API.query
      description: query.
      type: String
    - contextPath: IP-API.city
      description: city.
      type: String
    - contextPath: IP-API.lon
      description: lon.
      type: Number
    - contextPath: IP-API.proxy
      description: proxy.
      type: Boolean
    - contextPath: IP-API.district
      description: district.
      type: String
    - contextPath: IP-API.countryCode3
      description: countryCode3.
      type: String
    - contextPath: IP-API.currency
      description: currency.
      type: String
    - contextPath: IP-API.callingCode
      description: callingCode.
      type: Number
    - contextPath: IP-API.as
      description: as.
      type: String
    - contextPath: IP-API.status
      description: status.
      type: String
    - contextPath: IP-API.offset
      description: offset.
      type: String
    - contextPath: IP-API.continent
      description: continent.
      type: String
    - contextPath: IP-API.region
      description: region.
      type: String
    - contextPath: IP-API.country
      description: country.
      type: String
    - contextPath: IP-API.timezone
      description: timezone.
      type: String
    - contextPath: IP-API.hosting
      description: hosting.
      type: Boolean
    - contextPath: IP-API.asname
      description: asname.
      type: String
    - contextPath: IP-API.lat
      description: lat.
      type: Number
    - contextPath: IP-API.regionName
      description: regionName.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
  dockerimage: demisto/python3:3.12.8.3296088
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 6.0.0
tests:
- No tests (auto formatted)