AbuseDB.yml

category: Data Enrichment & Threat Intelligence
sectionOrder:
- Connect
- Collect
commonfields:
  id: AbuseIPDB
  version: -1
configuration:
- defaultvalue: https://api.abuseipdb.com/api/v2/
  display: AbuseIP server URL
  name: server
  required: true
  type: 0
  section: Connect
- name: credentials
  type: 9
  displaypassword: API Key (v2)
  hiddenusername: true
  section: Connect
  required: false
- display: API Key (v2)
  name: apikey
  type: 4
  hidden: true
  section: Connect
  required: false
- defaultvalue: 'C - Fairly reliable'
  display: Source Reliability
  name: integrationReliability
  required: true
  type: 15
  additionalinfo: Reliability of the source providing the intelligence data.
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  section: Collect
- defaultvalue: '80'
  display: Minimum score threshold
  name: threshold
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Maximum reports age (in days)
  name: days
  type: 0
  defaultvalue: '30'
  section: Collect
  advanced: true
  required: false
- display: Disable reputation lookups for private IP addresses
  name: disable_private_ip_lookup
  type: 8
  required: false
  defaultvalue: 'false'
  additionalinfo: To reduce the number of lookups made to the AbuseIPDB API, this option can be selected to gracefully skip enrichment of any IP addresses allocated for private networks.
- display: Disregard quota errors
  name: disregard_quota
  type: 8
  section: Collect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: Central repository to report and identify IP addresses that have been associated with malicious activity online. Check the Detailed Information section for more information on how to configure the integration.
display: AbuseIPDB
name: AbuseIPDB
script:
  commands:
  - arguments:
    - default: true
      description: The IP address to check (CSV supported).
      isArray: true
      name: ip
    - defaultValue: false
      description: When set to "true", enrichment of private IP addresses will be conducted even if it has been disabled at the integration level.
      name: override_private_lookup
      default: false
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '30'
      description: The time range to return reports (in days). Default is 30.
      name: days
    - defaultValue: 'true'
      description: The length of the report. "true" returns the full report, "false" does not return reported categories. Default is "true".
      name: verbose
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '80'
      description: The minimum score from AbuseIPDB to consider whether the IP address is malicious (must be greater than 20). Default is 80.
      name: threshold
    description: Checks the specified IP address against the AbuseIP database.
    name: ip
    outputs:
    - contextPath: IP.Address
      description: The address of the IP.
      type: String
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: String
    - contextPath: IP.Geo.CountryCode
      description: The country code in which the IP address is located.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: The vendor reporting the IP address as malicious.
      type: String
    - contextPath: IP.Malicious.Detections
      description: The Detections that led to the verdict.
      type: String
    - contextPath: AbuseIPDB.IP.Address
      description: The IP address fetched from AbuseIPDB.
      type: String
    - contextPath: AbuseIPDB.IP.AbuseConfidenceScore
      description: The confidence score fetched from AbuseIPDB.
      type: String
    - contextPath: AbuseIPDB.IP.TotalReports
      description: The number of times the address has been reported.
      type: Number
    - contextPath: AbuseIPDB.IP.Geo.Country
      description: The country associated with the IP Address.
      type: String
    - contextPath: AbuseIPDB.IP.Geo.CountryCode
      description: The country code associated with the IP Address.
      type: String
    - contextPath: AbuseIPDB.IP.Hostnames
      description: The hostame(s) of the IP address.
      type: String
    - contextPath: AbuseIPDB.IP.IpVersion
      description: The version of the IP address.
      type: String
    - contextPath: AbuseIPDB.IP.IsPublic
      description: Is the IP address public.
      type: String
    - contextPath: AbuseIPDB.IP.IsTor
      description: Is the IP address a Tor IP.
      type: String¨
    - contextPath: AbuseIPDB.IP.IsWhitelisted
      description: Is the IP address whitelisted.
      type: String
    - contextPath: AbuseIPDB.IP.LastReportedAt
      description: When the IP address was last reported.
      type: String
    - contextPath: AbuseIPDB.IP.NumDistinctUsers
      description: The distinct number of users.
      type: String
    - contextPath: AbuseIPDB.IP.Reports
      description: The reports summary (for "verbose" reports).
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: AbuseIPDB.IP.Malicious.Vendor
      description: The vendor that determined this IP address to be malicious.
      type: String
    - contextPath: AbuseIPDB.IP.Malicious.Detections
      description: The Detections that led to the verdict.
      type: String
    - contextPath: IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: String
    - contextPath: AbuseIPDB.IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: String
    - contextPath: AbuseIPDB.IP.ISP
      description: The internet service provider of the IP.
      type: String
    - contextPath: AbuseIPDB.IP.UsageType
      description: Usage type of the IP.
      type: String
    - contextPath: AbuseIPDB.IP.Domain
      description: Domain of the IP.
      type: String
  - arguments:
    - description: IPv4 Address Block in CIDR notation.
      name: network
      required: true
    - defaultValue: '30'
      description: The time range to return reports (in days). Default is 30.
      name: days
    - defaultValue: '40'
      description: The maximum number of IPs to check. Default is 40.
      name: limit
    - defaultValue: '80'
      description: The minimum score from AbuseIPDB to consider whether the IP address is malicious (must be greater than 20). Default is 80.
      name: threshold
    description: Queries a block of IP addresses to check against the database.
    name: abuseipdb-check-cidr-block
    outputs:
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: String
    - contextPath: IP.Geo.CountryCode
      description: The country code in which the IP address is located.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: The vendor reporting the IP address as malicious.
      type: String
    - contextPath: IP.Malicious.Detections
      description: The Detections that led to the verdict.
      type: String
    - contextPath: IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: String
    - contextPath: AbuseIPDB.IP.Address
      description: The IP address fetched from AbuseIPDB.
      type: String
    - contextPath: AbuseIPDB.IP.AbuseConfidenceScore
      description: The confidence score fetched from AbuseIPDB.
      type: Unknown
    - contextPath: AbuseIPDB.IP.TotalReports
      description: The number of times this address has been reported.
      type: Unknown
    - contextPath: AbuseIPDB.IP.Geo.Country
      description: The country associated with the IP Address.
      type: String
    - contextPath: AbuseIPDB.IP.Geo.CountryCode
      description: The country code associated with the IP Address.
      type: String
    - contextPath: AbuseIPDB.IP.Hostnames
      description: The hostame(s) of the IP address.
      type: String
    - contextPath: AbuseIPDB.IP.IpVersion
      description: The version of the IP address.
      type: String
    - contextPath: AbuseIPDB.IP.IsPublic
      description: Is the IP address public.
      type: String
    - contextPath: AbuseIPDB.IP.IsTor
      description: Is the IP address a Tor IP.
      type: String¨
    - contextPath: AbuseIPDB.IP.IsWhitelisted
      description: Is the IP address whitelisted.
      type: String
    - contextPath: AbuseIPDB.IP.LastReportedAt
      description: When the IP address was last reported.
      type: String
    - contextPath: AbuseIPDB.IP.NumDistinctUsers
      description: The distinct number of users.
      type: String
    - contextPath: AbuseIPDB.IP.Reports
      description: Reports summary (for "verbose" reports).
      type: Unknown
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: AbuseIPDB.IP.Malicious.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: AbuseIPDB.IP.Malicious.Detections
      description: The Detections that led to the verdict.
      type: String
    - contextPath: AbuseIPDB.IP.ISP
      description: The internet service provider of the IP.
      type: String
    - contextPath: AbuseIPDB.IP.UsageType
      description: Usage type of the IP.
      type: String
    - contextPath: AbuseIPDB.IP.Domain
      description: Domain of the IP.
      type: String
  - arguments:
    - description: The IP address to report.
      name: ip
      required: true
    - description: A CSV list of category IDs. For more information, see https://www.abuseipdb.com/categories.
      name: categories
      required: true
    description: Reports an IP address to AbuseIPDB.
    name: abuseipdb-report-ip
  - arguments:
    - defaultValue: '30'
      description: The time range to return reports (in days). Default is 30.
      name: days
    - defaultValue: '50'
      description: 'The maximum number of IPs to retrieve. Default is 50. '
      name: limit
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to save a list of IPs on a block list in the Context Data in Demisto. Default is false.
      name: saveToContext
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '100'
      description: The Minimum confidence required for the retrieved IPs.
      name: confidence
    description: Returns a list of the most reported IP addresses.
    name: abuseipdb-get-blacklist
    outputs:
    - contextPath: AbuseIPDB.Blacklist
      description: A list of IP addresses on a block list.
      type: Unknown
  - arguments: []
    description: Returns a list of report categories from AbuseIPDB.
    name: abuseipdb-get-categories
    outputs:
    - contextPath: AbuseIPDB.Categories
      description: The list of AbuseIPDB categories.
      type: string
  script: ''
  subtype: python3
  type: python
  dockerimage: demisto/python3:3.10.13.83255
fromversion: 5.0.0
tests:
- AbuseIPDB Test