Ipstack

One of the leading IP to geolocation APIs and global IP database services.

Data Enrichment & Threat Intelligence · Ipstack

Details

IDIpstack
ProviderIdera Inc.
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10325753
Supported ModulesAgentix XSIAM

README

One of the leading IP to geolocation
APIs and global IP database services.

Configure ipstack in Cortex

Parameter Description Required
API Key   True
Source Reliability Reliability of the source providing the intelligence data. True
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip


Queries an IP address in ipstack.

Base Command

ip

Input

Argument Name Description Required
ip IP address to query. Required

Context Output

Path Type Description
IP.Address string IP address.
IP.Geo.Location string Latitude and longitude of the IP address.
IP.Geo.Country string Country of origin of the IP address.
Ipstack.IP.address string IP address.
Ipstack.IP.type string IP type (ipv4 or ipv6).
Ipstack.IP.continent_name string Continent of the IP address.
Ipstack.IP.latitude string Latitude of the IP address.
Ipstack.IP.longitude string Longitude of the IP address.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Reliability String How reliable the score is (for example, “C - fairly reliable”).
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.

Configuration parameters

  • apikey — API Key
  • credentials
  • integrationReliability — Source Reliability
  • proxy — Use system proxy settings

Commands (1)

  • ip

    Queries an IP address in ipstack.

import os

import demistomock as demisto
import requests
from CommonServerPython import *

from CommonServerUserPython import *

BASE_URL = "http://api.ipstack.com"
API_KEY = demisto.params().get("credentials", {}).get("password") or demisto.params().get("apikey")
RELIABILITY = demisto.params().get("integrationReliability", "C - Fairly reliable")
BRAND_NAME = "Ipstack"

if not demisto.params().get("proxy", False):
    # Remove proxy environment variables if they exist
    for proxy_var in ["HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"]:
        os.environ.pop(proxy_var, None)

""" HELPER FUNCTIONS """


# #returns a result of a api call


def http_request(method, path):
    """
    HTTP request helper function
    """
    url = BASE_URL + path
    res = requests.request(method=method, url=url)

    if not res.ok:
        txt = f"error in URL {url} status code: {res.status_code} reason: {res.text}"
        demisto.error(txt)
        raise Exception(txt)

    try:
        res_json = res.json()
        if res_json.get("code"):
            txt = f"error in URL {url} status code: {res.status_code} reason: {res.text}"
            demisto.error(txt)
            raise Exception(txt)
        else:
            return res_json

    except Exception as ex:
        demisto.debug(str(ex))
        demisto.results({"Type": entryTypes["error"], "ContentsFormat": formats["text"], "Contents": res.text})


""" Commands """


def do_ip(ip):
    path = f"/{ip}?access_key={API_KEY}"
    return http_request("GET", path)


def do_ip_command():
    ips = demisto.args().get("ip")
    list_ips = argToList(ips)

    ips_results = []

    for ip in list_ips:
        raw_response = do_ip(ip)
        human_readable_data = {
            "Address": raw_response.get("ip"),
            "Country": raw_response.get("country_name"),
            "Latitude": raw_response.get("latitude"),
            "Longitude": raw_response.get("longitude"),
        }

        if DBotScoreReliability.is_valid_type(RELIABILITY):
            dbot_reliability = DBotScoreReliability.get_dbot_score_reliability_from_str(RELIABILITY)
        else:
            raise Exception("Please provide a valid value for the Source Reliability parameter.")

        dbot_score = Common.DBotScore(
            indicator=ip,
            indicator_type=DBotScoreType.IP,
            integration_name=BRAND_NAME,
            reliability=dbot_reliability,
            score=Common.DBotScore.NONE,
        )

        outputs = {
            "IP(val.Address == obj.Address)": {
                "Address": raw_response.get("ip"),
                "Geo": {
                    "Location": "{}:{}".format(raw_response.get("latitude"), raw_response.get("longitude")),
                    "Country": raw_response.get("country_name"),
                },
            },
            "Ipstack.ip(val.ID==obj.ID)": {
                "address": raw_response.get("ip"),
                "type": raw_response.get("type"),
                "continent_name": raw_response.get("continent_name"),
                "latitude": raw_response.get("latitude"),
                "longitude": raw_response.get("longitude"),
            },
        }

        outputs.update(dbot_score.to_context())

        headers = ["Address", "Country", "Latitude", "Longitude"]
        human_readable = tableToMarkdown(
            "Ipstack info on {}".format(raw_response.get("ip")), human_readable_data, headers=headers
        )

        result = CommandResults(readable_output=human_readable, outputs=outputs, raw_response=raw_response)

        ips_results.append(result)

    return_results(ips_results)


def test_module():
    path = f"/1.2.3.4?access_key={API_KEY}"
    res = requests.request("GET", BASE_URL + path)
    if res.json().get("ip") == "1.2.3.4":
        demisto.results("ok")
    else:
        demisto.results(f"an error occurred. reason: {res.text}")


def main():  # pragma: no cover
    try:
        if demisto.command() == "test-module":
            test_module()
        elif demisto.command() == "ip":
            do_ip_command()
    except Exception as e:
        return_error(f"Unable to perform command : {demisto.command}, Reason: {e}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()