category: Data Enrichment & Threat Intelligence provider: AbuseDB sectionorder: - Connect - Collect commonfields: id: AbuseIPDB version: -1 configuration: - defaultvalue: https://api.abuseipdb.com/api/v2/ display: AbuseIP server URL name: server required: true type: 0 section: Connect - name: credentials type: 9 displaypassword: API Key (v2) hiddenusername: true section: Connect required: false - display: API Key (v2) name: apikey type: 4 hidden: true section: Connect required: false - display: Abuse.ch Hunting API URL name: abusech_hunting_url type: 0 defaultvalue: https://hunting-api.abuse.ch/api/v1/ required: false section: Connect - name: hunting_credentials type: 9 displaypassword: Abuse.ch Hunting API Key hiddenusername: true section: Connect required: false - defaultvalue: 'C - Fairly reliable' display: Source Reliability name: integrationReliability required: false type: 15 additionalinfo: Reliability of the source providing the intelligence data. options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged section: Collect - defaultvalue: '80' display: Minimum score threshold name: threshold type: 0 section: Collect advanced: true required: false - display: Maximum reports age (in days) name: days type: 0 defaultvalue: '30' section: Collect advanced: true required: false - display: Disable reputation lookups for private IP addresses name: disable_private_ip_lookup type: 8 required: false defaultvalue: 'false' additionalinfo: To reduce the number of lookups made to the AbuseIPDB API, this option can be selected to gracefully skip enrichment of any IP addresses allocated for private networks. section: Collect - display: Disregard quota errors name: disregard_quota type: 8 section: Collect advanced: true required: false - display: Trust any certificate (not secure) name: insecure type: 8 section: Connect advanced: true required: false - display: Use system proxy settings name: proxy type: 8 section: Connect advanced: true required: false description: Central repository to report and identify IP addresses that have been associated with malicious activity online. Check the Detailed Information section for more information on how to configure the integration. display: AbuseIPDB name: AbuseIPDB script: commands: - arguments: - default: true description: The IP address to check (CSV supported). isArray: true name: ip - defaultValue: false description: When set to "true", enrichment of private IP addresses will be conducted even if it has been disabled at the integration level. name: override_private_lookup default: false predefined: - 'true' - 'false' - description: The time range to return reports (in days). Default is the time that was configured in the integration configuration "Maximum reports age (in days)". name: days - defaultValue: 'true' description: The length of the report. "true" returns the full report, "false" does not return reported categories. Default is "true". name: verbose auto: PREDEFINED predefined: - 'true' - 'false' - defaultValue: '80' description: The minimum score from AbuseIPDB to consider whether the IP address is malicious (must be greater than 20). Default is 80. name: threshold description: Checks the specified IP address against the AbuseIP database. name: ip outputs: - contextPath: IP.Address description: The address of the IP. type: String - contextPath: IP.Geo.Country description: The country in which the IP address is located. type: String - contextPath: IP.Geo.CountryCode description: The country code in which the IP address is located. type: String - contextPath: IP.Malicious.Vendor description: The vendor reporting the IP address as malicious. type: String - contextPath: IP.Malicious.Detections description: The Detections that led to the verdict. type: String - contextPath: AbuseIPDB.IP.Address description: The IP address fetched from AbuseIPDB. type: String - contextPath: AbuseIPDB.IP.AbuseConfidenceScore description: The confidence score fetched from AbuseIPDB. type: String - contextPath: AbuseIPDB.IP.TotalReports description: The number of times the address has been reported. type: Number - contextPath: AbuseIPDB.IP.Geo.Country description: The country associated with the IP Address. type: String - contextPath: AbuseIPDB.IP.Geo.CountryCode description: The country code associated with the IP Address. type: String - contextPath: AbuseIPDB.IP.Hostnames description: The hostame(s) of the IP address. type: String - contextPath: AbuseIPDB.IP.IpVersion description: The version of the IP address. type: String - contextPath: AbuseIPDB.IP.IsPublic description: Is the IP address public. type: String - contextPath: AbuseIPDB.IP.IsTor description: Is the IP address a Tor IP. type: String¨ - contextPath: AbuseIPDB.IP.IsWhitelisted description: Is the IP address whitelisted. type: String - contextPath: AbuseIPDB.IP.LastReportedAt description: When the IP address was last reported. type: String - contextPath: AbuseIPDB.IP.NumDistinctUsers description: The distinct number of users. type: String - contextPath: AbuseIPDB.IP.Reports description: The reports summary (for "verbose" reports). type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: AbuseIPDB.IP.Malicious.Vendor description: The vendor that determined this IP address to be malicious. type: String - contextPath: AbuseIPDB.IP.Malicious.Detections description: The Detections that led to the verdict. type: String - contextPath: IP.Malicious.Description description: A description explaining why the IP address was reported as malicious. type: String - contextPath: AbuseIPDB.IP.Malicious.Description description: A description explaining why the IP address was reported as malicious. type: String - contextPath: AbuseIPDB.IP.ISP description: The internet service provider of the IP. type: String - contextPath: AbuseIPDB.IP.UsageType description: Usage type of the IP. type: String - contextPath: AbuseIPDB.IP.Domain description: Domain of the IP. type: String - arguments: - description: IPv4 Address Block in CIDR notation. name: network required: true - defaultValue: '30' description: The time range to return reports (in days). Default is 30. name: days - defaultValue: '40' description: The maximum number of IPs to check. Default is 40. name: limit - defaultValue: '80' description: The minimum score from AbuseIPDB to consider whether the IP address is malicious (must be greater than 20). Default is 80. name: threshold description: Queries a block of IP addresses to check against the database. name: abuseipdb-check-cidr-block outputs: - contextPath: IP.Address description: The IP address. type: String - contextPath: IP.Geo.Country description: The country in which the IP address is located. type: String - contextPath: IP.Geo.CountryCode description: The country code in which the IP address is located. type: String - contextPath: IP.Malicious.Vendor description: The vendor reporting the IP address as malicious. type: String - contextPath: IP.Malicious.Detections description: The Detections that led to the verdict. type: String - contextPath: IP.Malicious.Description description: A description explaining why the IP address was reported as malicious. type: String - contextPath: AbuseIPDB.IP.Address description: The IP address fetched from AbuseIPDB. type: String - contextPath: AbuseIPDB.IP.AbuseConfidenceScore description: The confidence score fetched from AbuseIPDB. type: Unknown - contextPath: AbuseIPDB.IP.TotalReports description: The number of times this address has been reported. type: Unknown - contextPath: AbuseIPDB.IP.Geo.Country description: The country associated with the IP Address. type: String - contextPath: AbuseIPDB.IP.Geo.CountryCode description: The country code associated with the IP Address. type: String - contextPath: AbuseIPDB.IP.Hostnames description: The hostame(s) of the IP address. type: String - contextPath: AbuseIPDB.IP.IpVersion description: The version of the IP address. type: String - contextPath: AbuseIPDB.IP.IsPublic description: Is the IP address public. type: String - contextPath: AbuseIPDB.IP.IsTor description: Is the IP address a Tor IP. type: String¨ - contextPath: AbuseIPDB.IP.IsWhitelisted description: Is the IP address whitelisted. type: String - contextPath: AbuseIPDB.IP.LastReportedAt description: When the IP address was last reported. type: String - contextPath: AbuseIPDB.IP.NumDistinctUsers description: The distinct number of users. type: String - contextPath: AbuseIPDB.IP.Reports description: Reports summary (for "verbose" reports). type: Unknown - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: AbuseIPDB.IP.Malicious.Vendor description: The vendor used to calculate the score. type: String - contextPath: AbuseIPDB.IP.Malicious.Detections description: The Detections that led to the verdict. type: String - contextPath: AbuseIPDB.IP.ISP description: The internet service provider of the IP. type: String - contextPath: AbuseIPDB.IP.UsageType description: Usage type of the IP. type: String - contextPath: AbuseIPDB.IP.Domain description: Domain of the IP. type: String - arguments: - description: The IP address to report. name: ip required: true - description: A CSV list of category IDs. For more information, see https://www.abuseipdb.com/categories. name: categories required: true description: Reports an IP address to AbuseIPDB. name: abuseipdb-report-ip - arguments: - defaultValue: '30' description: The time range to return reports (in days). Default is 30. name: days - defaultValue: '50' description: 'The maximum number of IPs to retrieve. Default is 50. ' name: limit - auto: PREDEFINED defaultValue: 'false' description: Whether to save a list of IPs on a block list in the Context Data in Demisto. Default is false. name: saveToContext predefined: - 'true' - 'false' - defaultValue: '100' description: The Minimum confidence required for the retrieved IPs. name: confidence description: Returns a list of the most reported IP addresses. name: abuseipdb-get-blacklist outputs: - contextPath: AbuseIPDB.Blacklist description: A list of IP addresses on a block list. type: Unknown - arguments: [] description: Returns a list of report categories from AbuseIPDB. name: abuseipdb-get-categories outputs: - contextPath: AbuseIPDB.Categories description: The list of AbuseIPDB categories. type: string - arguments: - defaultValue: json description: The output format (JSON or CSV). Use "csv" to download the response as a file or "json" to insert it into the incident context. name: format auto: PREDEFINED predefined: - json - csv - defaultValue: '50' description: The maximum number of results to return. This is ignored when all_results is set to true or format is set to csv. name: limit - defaultValue: false description: whether to return all results. This is ignored when format is set to csv. name: all_results description: Returns the False Positive List (FPL) from abuse.ch, including IP and domain indicators removed from their blocklists. name: abuseipdb-get-fplist outputs: - contextPath: AbuseIPDB.FPL.id description: The unique identifier for the False Positive List entry. type: String - contextPath: AbuseIPDB.FPL.time_stamp description: The date and time (UTC) the entry was added to the False Positive List. type: String - contextPath: AbuseIPDB.FPL.platform description: The platform or service associated with the entry. type: String - contextPath: AbuseIPDB.FPL.entry_type description: The indicator type (for example, IPv4, domain). type: String - contextPath: AbuseIPDB.FPL.entry_value description: The actual indicator value (IP address or domain) that was marked as a false positive. type: String - contextPath: AbuseIPDB.FPL.removed_by description: The entity or user who requested the removal of the indicator from the blocklist. type: String - contextPath: AbuseIPDB.FPL.removal_notes description: Additional context or justification for why the indicator was removed. type: String script: '' subtype: python3 type: python dockerimage: demisto/python3:3.12.13.10404775 fromversion: 5.0.0 tests: - AbuseIPDB Test