IP Enrichment - Generic v2

Enriches IP addresses using one or more integrations.

  • Resolve IP addresses to hostnames (DNS)
  • Provide threat information
  • Separate internal and external IP addresses
  • For internal IP addresses, get host information

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • IP Enrichment - Internal - Generic v2
  • IP Enrichment - External - Generic v2

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs


NameDescriptionDefault ValueSourceRequired
IPThe IP address to enrich.AddressIPOptional
InternalRangeA list of internal IP address ranges to check IP addresses against. The list should be provided in CIDR notation, separated by commas. An example of a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotation marks). If a list is not provided, the default list provided in the IsIPInRanges script (the known IPv4 private address ranges).Noneinputs.InternalRangeOptional
ResolveIPDetermines whether to convert the IP address to a hostname using a DNS query (True/False).Noneinputs.ResolveIPRequired

Playbook Outputs


PathDescriptionType
IPThe IP objects.unknown
DBotScoreThe Indicator, Score, Type, and Vendor.unknown
EndpointThe Endpoint's object.unknown
Endpoint.HostnameThe hostname to enrich.string
Endpoint.OSThe Endpoint OS.string
Endpoint.IPThe list of Endpoint IP addresses.unknown
Endpoint.MACThe list of Endpoint MAC addresses.unknown
Endpoint.DomainThe Endpoint domain name.string

Playbook Image


IP_Enrichment_Generic_v2