MaxMind GeoIP2

Enriches IP addresses.

Data Enrichment & Threat Intelligence · MaxMind GeoIP2

Details

ID	`MaxMind GeoIP2`
Provider	MaxMind Inc
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

This integration was integrated and tested with MaxMind GeoIP2 v2.1.

Configure MaxMind GeoIP2 on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for MaxMind GeoIP2.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- API Key: The API key from MaxMind
- Account ID: Account number used for MaxMind
- Use system proxy
- Trust any certificate (not secure)
- Service Version: Denotes what level of detail for the results. There are three options Country, City, and Insights. Note that each version has a different cost per API call.
- Base URL: The API endpoint.
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Check the reputation of an IP address: ip

1. Check the reputation of an IP address

Checks the reputation of an IP address (when information is available, returns a JSON with details). Uses all configured Threat Intelligence feeds.

Base Command

ip

Input

Argument Name	Description	Required
ip	IP address to query	Required

Context Output

Path	Type	Description
IP.Address	string	The IP address
MaxMind.Address	string	The IP address
MaxMind.Geo.City	string	The IP city
IP.Geo.Country	string	The IP country
MaxMind.Geo.Country	string	The IP country
IP.Geo.Location	string	The IP geographic location in coordinates
MaxMind.Geo.Location	string	The IP geographic location in coordinates
MaxMind.Geo.TimeZone	string	The time zone the IP is located
MaxMind.Geo.Accuracy	number	The accuracy of the location
MaxMind.Geo.Continent	string	The IP continent
MaxMind.Geo.Subdivision	string	The IP subdivision
IP.ASN	string	The IP ASN
MaxMind.ASN	string	The IP ASN
MaxMind.Organization	string	The IP organization
MaxMind.Tor	boolean	Is IP a Tor exit node
MaxMind.Host	string	The IP host
MaxMind.Anonymous	boolean	Is the IP anonymous
MaxMind.UserType	string	The IP user type
MaxMind.ISP	string	The IP ISP
MaxMind.Domain	string	The domain associated to the IP
MaxMind.ISO_Code	string	ISO code for the country the IP is located
MaxMind.RegisteredCountry	string	Country the IP is registered to

Command Example

!ip ip="8.8.8.8"

Context Example

{
    "IP": {
        "Geo": {
            "Country": "United States",
            "Location": "37.751, -97.822"
        },
        "ASN": 15169,
        "Address": "8.8.8.8"
    },
    "MaxMind": {
        "Address": "8.8.8.8",
        "ISP": "Google",
        "Organization": "Google LLC",
        "ISO_Code": "US",
        "Geo": {
            "Location": "37.751, -97.822",
            "Country": "United States",
            "Continent": "North America",
            "Accuracy": 1000
        },
        "ASN": 15169,
        "RegisteredCountry": "United States"
    }
}

Human Readable Output

Configuration parameters

url — Base URL (required)
apikey — API Key
credentials — Account ID
account — Account ID
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
mode — Service Version (required)
integrationReliability — Source Reliability
feedExpirationPolicy —
feedExpirationInterval —

Commands (1)

ip
Check IP reputation (when information is available, returns a JSON with details). Uses all configured Threat Intelligence feeds.

Source

MaxMind_GeoIP2.py MaxMind_GeoIP2.yml MaxMind_GeoIP2_description.md

Download History Raw

commonfields:
  id: MaxMind GeoIP2
  version: -1
name: MaxMind GeoIP2
display: MaxMind GeoIP2
category: Data Enrichment & Threat Intelligence
provider: MaxMind Inc
description: Enriches IP addresses.
configuration:
- defaultvalue: https://geoip.maxmind.com/
  display: Base URL
  name: url
  required: true
  type: 0
- defaultvalue: ''
  display: API Key
  hidden: true
  name: apikey
  type: 4
- display: Account ID
  displaypassword: API Key
  name: credentials
  type: 9
- defaultvalue: ''
  display: Account ID
  hidden: true
  name: account
  type: 0
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
- defaultvalue: city
  display: Service Version
  name: mode
  options:
  - country
  - city
  - insights
  required: true
  type: 15
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: false
  type: 15
- defaultvalue: indicatorType
  display: ''
  name: feedExpirationPolicy
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  required: false
  type: 17
- defaultvalue: '20160'
  display: ''
  name: feedExpirationInterval
  required: false
  type: 1
script:
  script: ''
  type: python
  subtype: python3
  commands:
  - name: ip
    arguments:
    - name: ip
      required: true
      description: IP Addresses to be queried.
      isArray: true
      default: true
    outputs:
    - contextPath: IP.Address
      description: The IP address.
      type: string
    - contextPath: IP.Geo.Country
      description: The IP country.
      type: string
    - contextPath: IP.Geo.Location
      description: The IP geographic location in coordinates.
      type: string
    - contextPath: IP.ASN
      description: The IP ASN.
      type: string
    - contextPath: MaxMind.Geo.TimeZone
      description: The time zone the IP is located.
      type: string
    - contextPath: MaxMind.Geo.Accuracy
      description: The accuracy of the location.
      type: number
    - contextPath: MaxMind.Geo.Continent
      description: The IP Continent.
      type: string
    - contextPath: MaxMind.Geo.Subdivision
      description: The IP subdivision.
      type: string
    - contextPath: MaxMind.Organization
      description: The IP organization.
      type: string
    - contextPath: MaxMind.Tor
      description: Is IP a Tor exit node?
      type: boolean
    - contextPath: MaxMind.Host
      description: The IP host.
      type: string
    - contextPath: MaxMind.Anonymous
      description: Is the IP anonymous?
      type: boolean
    - contextPath: MaxMind.UserType
      description: The IP user type.
      type: string
    - contextPath: MaxMind.ISP
      description: The IP ISP.
      type: string
    - contextPath: MaxMind.Domain
      description: The domain associated to the IP.
      type: string
    - contextPath: MaxMind.ISO_Code
      description: ISO code for the country the IP is located.
      type: string
    - contextPath: MaxMind.RegisteredCountry
      description: Country the IP is registered.
      type: string
    - contextPath: MaxMind.City
      description: City the IP is located in.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    description: Check IP reputation (when information is available, returns a JSON with details). Uses all configured Threat Intelligence feeds.
  runonce: false
  dockerimage: demisto/python3:3.12.13.10116658
tests:
- MaxMind Test
fromversion: 5.0.0