Ipstack

Details

ID	`Ipstack`
Provider	Idera Inc.
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10325753`
Supported Modules	Agentix XSIAM

README

One of the leading IP to geolocation
APIs and global IP database services.

Configure ipstack in Cortex

Parameter	Description	Required
API Key		True
Source Reliability	Reliability of the source providing the intelligence data.	True
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Queries an IP address in ipstack.

Base Command

ip

Input

Argument Name	Description	Required
ip	IP address to query.	Required

Context Output

Path	Type	Description
IP.Address	string	IP address.
IP.Geo.Location	string	Latitude and longitude of the IP address.
IP.Geo.Country	string	Country of origin of the IP address.
Ipstack.IP.address	string	IP address.
Ipstack.IP.type	string	IP type (ipv4 or ipv6).
Ipstack.IP.continent_name	string	Continent of the IP address.
Ipstack.IP.latitude	string	Latitude of the IP address.
Ipstack.IP.longitude	string	Longitude of the IP address.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	How reliable the score is (for example, “C - fairly reliable”).
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.

Configuration parameters

apikey — API Key
credentials —
integrationReliability — Source Reliability
proxy — Use system proxy settings

Commands (1)

ip
Queries an IP address in ipstack.

Source

Ipstack.py Ipstack_test.py Ipstack.yml Ipstack_description.md

Download History Raw

commonfields:
  id: Ipstack
  version: -1
name: Ipstack
display: ipstack
category: Data Enrichment & Threat Intelligence
provider: Idera Inc.
sectionorder:
  - Connect
  - Collect
description: "One of the leading IP to geolocation \nAPIs and global IP database services."
configuration:
- display: API Key
  name: apikey
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
  section: Connect
- name: credentials
  display: ""
  type: 9
  displaypassword: API Key
  hiddenusername: true
  required: false
  section: Connect
- display: Source Reliability
  name: integrationReliability
  type: 15
  section: Connect
  additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
script:
  script: '-'
  type: python
  subtype: python3
  commands:
  - name: ip
    arguments:
    - name: ip
      required: true
      default: true
      description: IP address to query.
      isArray: true
    outputs:
    - contextPath: IP.Address
      description: IP address.
      type: string
    - contextPath: IP.Geo.Location
      description: Latitude and longitude of the IP address.
      type: string
    - contextPath: IP.Geo.Country
      description: Country of origin of the IP address.
      type: string
    - contextPath: Ipstack.IP.address
      description: IP address.
      type: string
    - contextPath: Ipstack.IP.type
      description: IP type (ipv4 or ipv6).
      type: string
    - contextPath: Ipstack.IP.continent_name
      description: Continent of the IP address.
      type: string
    - contextPath: Ipstack.IP.latitude
      description: Latitude of the IP address.
      type: string
    - contextPath: Ipstack.IP.longitude
      description: Longitude of the IP address.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: How reliable the score is (for example, "C - fairly reliable").
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    description: Queries an IP address in ipstack.
  runonce: false
  dockerimage: demisto/python3:3.12.13.10325753
tests:
- Ipstack_Test
fromversion: 5.0.0