IP Enrichment - Generic

Deprecated

Enriches IP addresses using one or more integrations.

IP enrichment includes:

  • Resolve IP to Hostname (DNS)
  • Threat information
  • Separate internal and external addresses
  • IP reputation
  • For internal addresses, get host information

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Endpoint Enrichment - Generic

Integrations

  • VirusTotal - Private API

Scripts

  • IsIPInRanges
  • IPToHost
  • IPReputation

Commands

  • vt-private-get-ip-report

Playbook Inputs


NameDescriptionDefault ValueSourceRequired
IPThe IP address to enrich.AddressIPOptional
InternalRangeThe internal range to check against the IP address. The default range is taken from the IPv4 protocol.--Optional
ResolveIPConvert the IP address to a hostname using a DNS query (True/False).True-Required

Playbook Outputs


PathDescriptionType
IPThe IP address objects.unknown
DBotScoreThe Indicator, Score, Type, and Vendor.unknown
EndpointThe Endpoint's object.unknown
Endpoint.HostnameThe hostname to enrich.string
Endpoint.OSThe Endpoint OS.string
Endpoint.IPThe list of Endpoint IP addresses.unknown
Endpoint.MACThe list of Endpoint MAC addresses.unknown
Endpoint.DomainThe Endpoint domain name.string

Playbook Image


IP_Enrichment_Generic