Updated outputs to cmds ip and abuseipdb-check-cidr-block

Packs/AbuseDB/Integrations/AbuseDB/AbuseDB.py

@@ -143,17 +143,30 @@ def analysis_to_entry(info, reliability, threshold=THRESHOLD, verbose=VERBOSE):
     for analysis in info:
         ip_ec = {
             "Address": analysis.get("ipAddress"),
-            "Geo": {"Country": analysis.get("countryName") or analysis.get("countryCode")}
+            "Geo": {
+                "Country": analysis.get("countryName"),
+                "CountryCode": analysis.get("countryCode")
+            }
         }
         abuse_ec = {
             "IP": {
                 "Address": analysis.get("ipAddress"),
-                "Geo": {"Country": analysis.get("countryName") or analysis.get("countryCode")},
+                "Geo": {
+                    "Country": analysis.get("countryName"),
+                    "CountryCode": analysis.get("countryCode")
+                },
                 "AbuseConfidenceScore": analysis.get('abuseConfidenceScore'),
-                "TotalReports": analysis.get("totalReports") or analysis.get("numReports") or "0",
+                "TotalReports": analysis.get("totalReports") or analysis.get("numReports") or 0,
                 "ISP": analysis.get("isp"),
                 "UsageType": analysis.get("usageType"),
-                "Domain": analysis.get("domain")
+                "Domain": analysis.get("domain"),
+                "Hostnames": analysis.get("hostnames"),
+                "IpVersion": analysis.get("ipVersion"),
+                "IsPublic": analysis.get("isPublic"),
+                "IsTor": analysis.get("isTor"),
+                "IsWhitelisted": analysis.get("isWhitelisted"),
+                "LastReportedAt": analysis.get("lastReportedAt"),
+                "NumDistinctUsers": analysis.get("numDistinctUsers")
             }
         }
 

Packs/AbuseDB/Integrations/AbuseDB/AbuseDB.yml

@@ -116,6 +116,9 @@ script:
     - contextPath: IP.Geo.Country
       description: The country in which the IP address is located.
       type: String
+    - contextPath: IP.Geo.CountryCode
+      description: The country code in which the IP address is located.
+      type: String
     - contextPath: IP.Malicious.Vendor
       description: The vendor reporting the IP address as malicious.
       type: String
@@ -134,6 +137,30 @@ script:
     - contextPath: AbuseIPDB.IP.Geo.Country
       description: The country associated with the IP Address.
       type: String
+    - contextPath: AbuseIPDB.IP.Geo.CountryCode
+      description: The country code associated with the IP Address.
+      type: String
+    - contextPath: AbuseIPDB.IP.Hostnames
+      description: The hostame(s) of the IP address.
+      type: String
+    - contextPath: AbuseIPDB.IP.IpVersion
+      description: The version of the IP address.
+      type: String
+    - contextPath: AbuseIPDB.IP.IsPublic
+      description: Is the IP address public.
+      type: String
+    - contextPath: AbuseIPDB.IP.IsTor
+      description: Is the IP address a Tor IP.
+      type: String¨
+    - contextPath: AbuseIPDB.IP.IsWhitelisted
+      description: Is the IP address whitelisted.
+      type: String
+    - contextPath: AbuseIPDB.IP.LastReportedAt
+      description: When the IP address was last reported.
+      type: String
+    - contextPath: AbuseIPDB.IP.NumDistinctUsers
+      description: The distinct number of users.
+      type: String
     - contextPath: AbuseIPDB.IP.Reports
       description: The reports summary (for "verbose" reports).
       type: String
@@ -192,6 +219,9 @@ script:
     - contextPath: IP.Geo.Country
       description: The country in which the IP address is located.
       type: String
+    - contextPath: IP.Geo.CountryCode
+      description: The country code in which the IP address is located.
+      type: String
     - contextPath: IP.Malicious.Vendor
       description: The vendor reporting the IP address as malicious.
       type: String
@@ -211,8 +241,32 @@ script:
       description: The number of times this address has been reported.
       type: Unknown
     - contextPath: AbuseIPDB.IP.Geo.Country
-      description: The country associated with this IP Address.
-      type: Unknown
+      description: The country associated with the IP Address.
+      type: String
+    - contextPath: AbuseIPDB.IP.Geo.CountryCode
+      description: The country code associated with the IP Address.
+      type: String
+    - contextPath: AbuseIPDB.IP.Hostnames
+      description: The hostame(s) of the IP address.
+      type: String
+    - contextPath: AbuseIPDB.IP.IpVersion
+      description: The version of the IP address.
+      type: String
+    - contextPath: AbuseIPDB.IP.IsPublic
+      description: Is the IP address public.
+      type: String
+    - contextPath: AbuseIPDB.IP.IsTor
+      description: Is the IP address a Tor IP.
+      type: String¨
+    - contextPath: AbuseIPDB.IP.IsWhitelisted
+      description: Is the IP address whitelisted.
+      type: String
+    - contextPath: AbuseIPDB.IP.LastReportedAt
+      description: When the IP address was last reported.
+      type: String
+    - contextPath: AbuseIPDB.IP.NumDistinctUsers
+      description: The distinct number of users.
+      type: String
     - contextPath: AbuseIPDB.IP.Reports
       description: Reports summary (for "verbose" reports).
       type: Unknown
@@ -285,7 +339,7 @@ script:
   script: ''
   subtype: python3
   type: python
-  dockerimage: demisto/python3:3.10.13.80014
+  dockerimage: demisto/python3:3.10.13.83255
 fromversion: 5.0.0
 tests:
 - AbuseIPDB Test

Packs/AbuseDB/Integrations/AbuseDB/README.md

@@ -99,10 +99,50 @@
 </tr>
 <tr>
 <td style="width: 268px;">AbuseIPDB.IP.Geo.Country</td>
-<td style="width: 58px;">unknown</td>
+<td style="width: 58px;">String</td>
 <td style="width: 414px;">Country associated with this IP Address</td>
 </tr>
 <tr>
+<td style="width: 268px;">AbuseIPDB.IP.Geo.CountryCode</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">Country code associated with this IP Address</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.Hostnames</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">The hostame(s) of the IP address.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.IpVersion</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">The version of the IP address.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.IsPublic</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">Is the IP address public.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.IsTor</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">Is the IP address a Tor IP.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.IsWhitelisted</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">Is the IP address whitelisted.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.LastReportedAt</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">When the IP address was last reported.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.NumDistinctUsers</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">The distinct number of users.</td>
+</tr>
+<tr>
 <td style="width: 268px;">AbuseIPDB.IP.Address.Reports</td>
 <td style="width: 58px;">unknown</td>
 <td style="width: 414px;">Reports summary (for "verbose" reports)</td>
@@ -214,11 +254,51 @@
 <td style="width: 414px;">Confidence score fetched from AbuseIPDB</td>
 </tr>
 <tr>
-<td style="width: 271px;">AbuseIPDB.IP.Geo.Country</td>
-<td style="width: 55px;">unknown</td>
+<td style="width: 268px;">AbuseIPDB.IP.Geo.Country</td>
+<td style="width: 58px;">String</td>
 <td style="width: 414px;">Country associated with this IP Address</td>
 </tr>
 <tr>
+<td style="width: 268px;">AbuseIPDB.IP.Geo.CountryCode</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">Country code associated with this IP Address</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.Hostnames</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">The hostame(s) of the IP address.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.IpVersion</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">The version of the IP address.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.IsPublic</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">Is the IP address public.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.IsTor</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">Is the IP address a Tor IP.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.IsWhitelisted</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">Is the IP address whitelisted.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.LastReportedAt</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">When the IP address was last reported.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.NumDistinctUsers</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">The distinct number of users.</td>
+</tr>
+<tr>
 <td style="width: 271px;">AbuseIPDB.IP.TotalReports</td>
 <td style="width: 55px;">unknown</td>
 <td style="width: 414px;">The number of times this address has been reported</td>

Packs/AbuseDB/ReleaseNotes/1_0_30.md

@@ -0,0 +1,13 @@
+#### Integrations
+##### AbuseIPDB
+- Added more outputs to the ***ip*** and ***abuseipdb-check-cidr-block*** commands. The following outputs were added:
+    - *IP.Geo.CountryCode*
+    - *AbuseIPDB.IP.Geo.CountryCode*
+    - *AbuseIPDB.IP.Hostnames*
+    - *AbuseIPDB.IP.IpVersion*
+    - *AbuseIPDB.IP.IsPublic*
+    - *AbuseIPDB.IP.IsTor*
+    - *AbuseIPDB.IP.IsWhitelisted*
+    - *AbuseIPDB.IP.LastReportedAt*
+    - *AbuseIPDB.IP.NumDistinctUsers*
+- Updated the Docker image to: *demisto/python3:3.10.13.83255*.

Packs/AbuseDB/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "AbuseIPDB",
     "description": "Central repository to report and identify IP addresses that have been associated with malicious activity online. Check the Detailed Information section for more information on how to configure the integration.",
     "support": "xsoar",
-    "currentVersion": "1.0.29",
+    "currentVersion": "1.0.30",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",