Feedback:
abuseipdb
Use the abuseipdb operator to enrich results related to an IP address or field containing an IP address using the ThreatStream AubseIPDB enrichment.
Syntax
|abuseipdb <field or value>
<field or value>
|
Specify the field name or IP address to look up. |
Usage
You can use the abuseipdb operator to enrich results that inform your security orchestration, automation and response actions. A request to the AbuseIPDB enrichment returns columns of data similar to the following.
| ip | isPublic | isWhitelisted | abuseConfidenceScore | usageType | domain | isTor | totalReports | lastReportedAt |
|---|---|---|---|---|---|---|---|---|
| '7.7.7.7' | True | False | 0 | "Military" | "nic.mil" | False | 0 | 2022-8-12 12-1-5 |
Examples
Example 1: Enrich IP address fields with AbuseIPDB threat data.
Copy
|fields ip |abuseipdb(ip)Example 2: Retrieve AbuseIPDB reports for a specified IP address.
Copy
|fields src_ip |abuseipdb(src_ip)