Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The MaxMind Action integration allows ThreatQ users to enrich IP addresses with geolocation data from MaxMind. This data can be used to better understand the context of an IP address and make more informed decisions.

MaxMind offers both free and paid geolocation services. Their GeoIP service enables users to query the location of an IPv4 or IPv6 address. Context such as an IP's country, continent, city, postal code, and more can be retrieved.

The integration provides the following action:

• MaxMind GeoIP Lookup - fetches geolocation data for IP addresses from MaxMind's GeoIP service.

The action is compatible with the following object types:

• Indicators
  • IP Address
  • IPv6 Address

The action returns the following enriched system objects:

• Indicators
  • IP Address
  • IPv6 Address
  • FQDN

This action is intended for use with ThreatQ TDR Orchestrator (TQO). An active TQO license is required for this feature.

Prerequisites

• An active ThreatQ TDR Orchestrator (TQO) license.
• A MaxMind account (free or paid)
• A data collection containing the following indicator objects:
  • IP Address
  • IPv6 Address

Installation

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the action zip file.
3. Navigate to the integrations management page on your ThreatQ instance.
4. Click on the Add New Integration button.
5. Upload the action zip file using one of the following methods:
   • Drag and drop the zip file into the dialog box
   • Select Click to Browse to locate the zip file on your local machine

   ThreatQ will inform you if the action already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the action contains changes to the user configuration. The new user configurations will overwrite the existing ones for the action and will require user confirmation before proceeding.

You will still need to configure the action.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.
 

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Actions option from the Category dropdown (optional).
3. Click on the action entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   The configurations set on this page will be used as the default settings when inserting this action into a new workflow. Updating the configurations on this page will not update any instances of this action that have already been deployed to a workflow. In that scenario, you must update the action’s configurations within the workflow itself.

   Parameter	Description
   License Tier Selection	Select the license tier to use for the lookups. The paid tier will have more up-to-date information, and may contain additional context.
   Account ID	Enter your MaxMind Account ID to authenticate with the API.
   License Key	Enter your MaxMind License key to authenticate with the API.
   Database Selection	Select the database to use for the lookups. Certain databases will contain more context than others.
   Context Filter	Select which pieces of context to ingest with each enriched IP address. Certain pieces of context will only be available with the paid tier or a specific database selection.
   Context filter	Associated Domain (default) City (default) Continent Continent Code Country (default) Country Code Registered Country Registered Country Code Is In EU Subdivision (State) (default) Subdivision Code Latitude Longitude Postal Code ASN AS Organization ISP Is Anycast Is Anonymous Is Anonymous Proxy Is Hosting Provider Is Public Proxy Is Residential Proxy Is TOR Exit Node Static IP Score User Type
   Confidence Threshold (Insights Only)	Set the minimum confidence threshold for the data to be ingested. This will prevent low-confidence data from being ingested. (default: 50)
   Objects Per Run	The number of objects to process per run of the workflow. (default: 1000)

   

5. Review any additional settings, make any changes if needed, and click on Save.

Action

The following action is available:

{
  "continent": {
    "code": "NA",
    "geoname_id": 123456,
    "names": {
      "de": "Nordamerika",
      "en": "North America",
      "es": "América del Norte",
      "fr": "Amérique du Nord",
      "ja": "北アメリカ",
      "pt-BR": "América do Norte",
      "ru": "Северная Америка",
      "zh-CN": "北美洲"
    }
  },
  "country": {
    "geoname_id": 6252001,
    "is_in_european_union": false,
    "iso_code": "US",
    "names": {
      "de": "USA",
      "en": "United States",
      "es": "Estados Unidos",
      "fr": "États-Unis",
      "ja": "アメリカ合衆国",
      "pt-BR": "Estados Unidos",
      "ru": "США",
      "zh-CN": "美国"
    },
    "confidence": 75
  },
  "maxmind": {
    "queries_remaining": 54321
  },
  "registered_country": {
    "geoname_id": 6252001,
    "is_in_european_union": true,
    "iso_code": "US",
    "names": {
      "de": "USA",
      "en": "United States",
      "es": "Estados Unidos",
      "fr": "États-Unis",
      "ja": "アメリカ合衆国",
      "pt-BR": "Estados Unidos",
      "ru": "США",
      "zh-CN": "美国"
    }
  },
  "represented_country": {
    "geoname_id": 6252001,
    "is_in_european_union": true,
    "iso_code": "US",
    "names": {
      "de": "USA",
      "en": "United States",
      "es": "Estados Unidos",
      "fr": "États-Unis",
      "ja": "アメリカ合衆国",
      "pt-BR": "Estados Unidos",
      "ru": "США",
      "zh-CN": "美国"
    },
    "type": "military"
  },
  "traits": {
    "ip_address": "1.2.3.4",
    "is_anycast": true,
    "network": "1.2.3.0/24",
    "autonomous_system_number": 1239,
    "autonomous_system_organization": "Linkem IR WiMax Network",
    "connection_type": "Cable/DSL",
    "domain": "example.com",
    "isp": "Linkem spa",
    "mobile_country_code": "310",
    "mobile_network_code": "004",
    "organization": "Linkem IR WiMax Network",
    "is_anonymous": true,
    "is_anonymous_vpn": true,
    "is_hosting_provider": true,
    "is_public_proxy": true,
    "is_residential_proxy": true,
    "is_tor_exit_node": true,
    "static_ip_score": 1.5,
    "user_count": 1,
    "user_type": "traveler"
  },
  "city": {
    "confidence": 25,
    "geoname_id": 54321,
    "names": {
      "de": "Los Angeles",
      "en": "Los Angeles",
      "es": "Los Ángeles",
      "fr": "Los Angeles",
      "ja": "ロサンゼルス市",
      "pt-BR": "Los Angeles",
      "ru": "Лос-Анджелес",
      "zh-CN": "洛杉矶"
    }
  },
  "location": {
    "accuracy_radius": 20,
    "latitude": 37.6293,
    "longitude": -122.1163,
    "metro_code": 807,
    "time_zone": "America/Los_Angeles",
    "average_income": 128321
  },
  "postal": {
    "code": "90001",
    "confidence": 10
  },
  "subdivisions": [
    {
      "geoname_id": 5332921,
      "iso_code": "CA",
      "names": {
        "de": "Kalifornien",
        "en": "California",
        "es": "California",
        "fr": "Californie",
        "ja": "カリフォルニア",
        "ru": "Калифорния",
        "zh-CN": "加州"
      },
      "confidence": 50
    }
  ]
}

Enriched Data

Object counts and action runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and action runtime may vary based on system resources and load.

Use Case Example

As an analyst, I have a list of IP addresses that have accessed compromised account emails. I want to figure out which country these IP addresses are coming from to determine if they are likely to be malicious.

Change Log

• Version 1.0.0
  • Initial release