Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The IPInfo action submits a collection of supported indicators of compromise (IOC) to the IPInfo API in the form of individual HTTP Requests. IPInfo returns a response for each object containing any information it has about the IOC. 

The integration can perform the following action:

• IPInfo - Enriches IP Addresses with Location information such as Region, Coordinates, Country, and City

The action is compatible with IP Address indicator types and returns enriched IP Addresses.

This action is intended for use with ThreatQ TDR Orchestrator (TQO). An active TQO license is required for this feature.

Prerequisites

The action requires the following:

• An IPInfo API Key.
• An active ThreatQ TRD Orchestrator (TDR) license.
• A data collection containing at IP Address indicator types.

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.
 

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Actions option from the Category dropdown (optional).
3. Click on the action entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   The configurations set on this page will be used as the default settings when inserting this action into a new workflow. Updating the configurations on this page will not update any instances of this action that have already been deployed to a workflow. In that scenario, you must update the action’s configurations within the workflow itself.

   Parameter	Description
   IPInfo API Key	Your API Key for authentication with the IPInfo API
   Objects Per Run	The Maximum number of objects to submit per workflow run.  The max value for this parameter is 50,000.
   IPInfo Context Filter	Select the attributes for ingestion.  Options include: Location Coordinates (default) City (default) Country (default) Region (default)

   
   
5. Review any additional settings, make any changes if needed, and click on Save.

Actions

The integration provides the following action:

{
    "ip": "111.121.216.118",
    "city": "Guiyang",
    "region": "Guizhou",
    "country": "CN",
    "loc": "26.5833,106.7167",
    "org": "AS4134 CHINANET-BACKBONE",
    "timezone": "Asia/Shanghai"
}

Enriched Data

Object counts and action runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and action runtime may vary based on system resources and load.

Use Case Example

1. A Threat Analyst identifies a collection of IP Addresses they would like to enrich.
2. The Threat Analyst adds the IPInfo Action to a Workflow
3. The Threat Analyst configures the action with the desired parameters, and enables the Workflow
4. The Workflow executes all Actions in the graph, including IPInfo
5. The action returns the documented Attributes from the provider, and the Workflow ingests this data into the ThreatQ platform.

Known Issues / Limitations

• The IPInfo Free plan is limited to 50k lookups per month. Refer to your IPInfo account details for rate limit information.

Change Log

• Version 1.0.2
  • Initial release to the ThreatQ Marketplace.