commonfields:
  id: MaxMind GeoIP2
  version: -1
name: MaxMind GeoIP2
display: MaxMind GeoIP2
category: Data Enrichment & Threat Intelligence
provider: MaxMind Inc
description: Enriches IP addresses.
configuration:
- defaultvalue: https://geoip.maxmind.com/
  display: Base URL
  name: url
  required: true
  type: 0
- defaultvalue: ''
  display: API Key
  hidden: true
  name: apikey
  type: 4
- display: Account ID
  displaypassword: API Key
  name: credentials
  type: 9
- defaultvalue: ''
  display: Account ID
  hidden: true
  name: account
  type: 0
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
- defaultvalue: city
  display: Service Version
  name: mode
  options:
  - country
  - city
  - insights
  required: true
  type: 15
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: false
  type: 15
- defaultvalue: indicatorType
  display: ''
  name: feedExpirationPolicy
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  required: false
  type: 17
- defaultvalue: '20160'
  display: ''
  name: feedExpirationInterval
  required: false
  type: 1
script:
  script: ''
  type: python
  subtype: python3
  commands:
  - name: ip
    arguments:
    - name: ip
      required: true
      description: IP Addresses to be queried.
      isArray: true
      default: true
    outputs:
    - contextPath: IP.Address
      description: The IP address.
      type: string
    - contextPath: IP.Geo.Country
      description: The IP country.
      type: string
    - contextPath: IP.Geo.Location
      description: The IP geographic location in coordinates.
      type: string
    - contextPath: IP.ASN
      description: The IP ASN.
      type: string
    - contextPath: MaxMind.Geo.TimeZone
      description: The time zone the IP is located.
      type: string
    - contextPath: MaxMind.Geo.Accuracy
      description: The accuracy of the location.
      type: number
    - contextPath: MaxMind.Geo.Continent
      description: The IP Continent.
      type: string
    - contextPath: MaxMind.Geo.Subdivision
      description: The IP subdivision.
      type: string
    - contextPath: MaxMind.Organization
      description: The IP organization.
      type: string
    - contextPath: MaxMind.Tor
      description: Is IP a Tor exit node?
      type: boolean
    - contextPath: MaxMind.Host
      description: The IP host.
      type: string
    - contextPath: MaxMind.Anonymous
      description: Is the IP anonymous?
      type: boolean
    - contextPath: MaxMind.UserType
      description: The IP user type.
      type: string
    - contextPath: MaxMind.ISP
      description: The IP ISP.
      type: string
    - contextPath: MaxMind.Domain
      description: The domain associated to the IP.
      type: string
    - contextPath: MaxMind.ISO_Code
      description: ISO code for the country the IP is located.
      type: string
    - contextPath: MaxMind.RegisteredCountry
      description: Country the IP is registered.
      type: string
    - contextPath: MaxMind.City
      description: City the IP is located in.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    description: Check IP reputation (when information is available, returns a JSON with details). Uses all configured Threat Intelligence feeds.
  runonce: false
  dockerimage: demisto/python3:3.12.13.10116658
tests:
- MaxMind Test
fromversion: 5.0.0