category: Data Enrichment & Threat Intelligence
provider: Kloudend Inc
commonfields:
  id: IP-API
  version: -1
configuration:
- additionalinfo: Use of HTTPS requires an API key
  defaultvalue: 'false'
  display: Use HTTPS to communicate with the API
  name: https
  type: 8
  required: false
- additionalinfo: Only required to bypass rate limits and/or use HTTPS
  display: API Key
  name: apikey
  type: 4
  required: false
- additionalinfo: See https://members.ip-api.com/docs/json for details
  defaultvalue: '536608767'
  display: Fields to return
  name: fields
  required: true
  type: 0
- defaultvalue: 'false'
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
description: 'This integration will enrich IP addresses from IP-API with data about the geolocation, as well as a determination of the IP address being associated with a mobile device, hosting or proxy. Revers DNS is also returned.


  This service is available for free (with a throttle) - or paid.

  '
display: IP-API
name: IP-API
script:
  commands:
  - arguments:
    - default: true
      description: List of IPs.
      isArray: true
      name: ip
      required: true
    description: Return IP information
    name: ip
    outputs:
    - contextPath: IP-API.continentCode
      description: continentCode.
      type: String
    - contextPath: IP-API.zip
      description: zip.
      type: String
    - contextPath: IP-API.mobile
      description: mobile.
      type: Boolean
    - contextPath: IP-API.reverse
      description: reverse.
      type: String
    - contextPath: IP-API.countryCode
      description: countryCode.
      type: String
    - contextPath: IP-API.org
      description: org.
      type: String
    - contextPath: IP-API.isp
      description: isp.
      type: String
    - contextPath: IP-API.currentTime
      description: currentTime.
      type: String
    - contextPath: IP-API.query
      description: query.
      type: String
    - contextPath: IP-API.city
      description: city.
      type: String
    - contextPath: IP-API.lon
      description: lon.
      type: Number
    - contextPath: IP-API.proxy
      description: proxy.
      type: Boolean
    - contextPath: IP-API.district
      description: district.
      type: String
    - contextPath: IP-API.countryCode3
      description: countryCode3.
      type: String
    - contextPath: IP-API.currency
      description: currency.
      type: String
    - contextPath: IP-API.callingCode
      description: callingCode.
      type: Number
    - contextPath: IP-API.as
      description: as.
      type: String
    - contextPath: IP-API.status
      description: status.
      type: String
    - contextPath: IP-API.offset
      description: offset.
      type: String
    - contextPath: IP-API.continent
      description: continent.
      type: String
    - contextPath: IP-API.region
      description: region.
      type: String
    - contextPath: IP-API.country
      description: country.
      type: String
    - contextPath: IP-API.timezone
      description: timezone.
      type: String
    - contextPath: IP-API.hosting
      description: hosting.
      type: Boolean
    - contextPath: IP-API.asname
      description: asname.
      type: String
    - contextPath: IP-API.lat
      description: lat.
      type: Number
    - contextPath: IP-API.regionName
      description: regionName.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
  dockerimage: demisto/python3:3.12.8.3296088
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 6.0.0
tests:
- No tests (auto formatted)