Ipstack

Details

ID	`Ipstack`
Provider	Idera Inc.
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10325753`
Supported Modules	Agentix XSIAM

README

One of the leading IP to geolocation
APIs and global IP database services.

Configure ipstack in Cortex

Parameter	Description	Required
API Key		True
Source Reliability	Reliability of the source providing the intelligence data.	True
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Queries an IP address in ipstack.

Base Command

ip

Input

Argument Name	Description	Required
ip	IP address to query.	Required

Context Output

Path	Type	Description
IP.Address	string	IP address.
IP.Geo.Location	string	Latitude and longitude of the IP address.
IP.Geo.Country	string	Country of origin of the IP address.
Ipstack.IP.address	string	IP address.
Ipstack.IP.type	string	IP type (ipv4 or ipv6).
Ipstack.IP.continent_name	string	Continent of the IP address.
Ipstack.IP.latitude	string	Latitude of the IP address.
Ipstack.IP.longitude	string	Longitude of the IP address.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	How reliable the score is (for example, “C - fairly reliable”).
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.

Configuration parameters

apikey — API Key
credentials —
integrationReliability — Source Reliability
proxy — Use system proxy settings

Commands (1)

ip
Queries an IP address in ipstack.

Source

Ipstack.py Ipstack_test.py Ipstack.yml Ipstack_description.md

Download History Raw

import demistomock as demisto

RAW_RESPONSE_MOCK_1 = {
    "ip": "1.1.1.1",
    "country_name": "country_name",
    "latitude": "1234",
    "longitude": "5678",
    "continent_name": "continent_name",
    "type": "type",
}
RAW_RESPONSE_MOCK_2 = {
    "ip": "8.8.8.8",
    "country_name": "country_name",
    "latitude": "8888",
    "longitude": "9999",
    "continent_name": "continent_name",
    "type": "type",
}
CONTEXT_PATH = "DBotScore(val.Indicator && val.Indicator == obj.Indicator && val.Vendor == obj.Vendor && val.Type == obj.Type)"
CONTEXT_PATH_PRIOR_V5_5 = "DBotScore"


def test_right_location_format(mocker, requests_mock):
    """
    When:
      - Calling ip_command
    Then:
      - Ensure that the Response was constructed correctly.
      - Case 1: The response should contain Location key with a value in the format of lon:lat
        and contain DBotScore calculations.
    """
    mocker.patch.object(
        demisto,
        "params",
        return_value={"proxy": "proxy", "credentials": {"password": "password"}, "integrationReliability": "C - Fairly reliable"},
    )
    mocker.patch.object(demisto, "args", return_value={"ip": "1.2.3.4,8.8.8.8"})
    mocker_results = mocker.patch.object(demisto, "results")
    requests_mock.get("http://api.ipstack.com/1.2.3.4?access_key=password", json=RAW_RESPONSE_MOCK_1)
    requests_mock.get("http://api.ipstack.com/8.8.8.8?access_key=password", json=RAW_RESPONSE_MOCK_2)
    from Ipstack import do_ip_command

    do_ip_command()

    results_1234 = mocker_results.call_args_list[0][0][0]
    output = results_1234.get("EntryContext").get("IP(val.Address == obj.Address)")
    assert output.get("Geo").get("Location") == "1234:5678"
    assert CONTEXT_PATH in results_1234.get("EntryContext") or CONTEXT_PATH_PRIOR_V5_5 in results_1234.get("EntryContext")

    results_8888 = mocker_results.call_args_list[1][0][0]
    output = results_8888.get("EntryContext").get("IP(val.Address == obj.Address)")
    assert output.get("Geo").get("Location") == "8888:9999"
    assert CONTEXT_PATH in results_8888.get("EntryContext") or CONTEXT_PATH_PRIOR_V5_5 in results_8888.get("EntryContext")


def test_test_module(mocker, requests_mock):
    """
    When:
      - Calling test_module
    Then:
      - No errors occurred
    """
    mocker.patch.object(
        demisto,
        "params",
        return_value={"proxy": "proxy", "credentials": {"password": "password"}, "integrationReliability": "C - Fairly reliable"},
    )
    results_mock = mocker.patch.object(demisto, "results")
    requests_mock.get("http://api.ipstack.com/1.2.3.4?access_key=password", json={"ip": "1.2.3.4"})
    from Ipstack import test_module

    test_module()
    assert "ok" in results_mock.call_args[0][0]