Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added AbuseIPDB expansion module #625

Merged
merged 1 commit into from
Jul 10, 2023
Merged

Conversation

TinyHouseHippos
Copy link

The AbuseIPDB module enriches IP addresses and domains. To use this expansion module, you need to add the API key (Free to make an account for AbuseIPDB) and set the max_age_in_days value (How far in the past you want to look for that IP or domain). The module will return if the IP was found in AbuseIPDB's whitelists (is-whitelist), if it is related to Tor (is-tor), if it is public (is-public) and the abuse confidence score (abuse-confidence-score) which is a rating (scaled 0-100) of how confident AbuseIPDB is that an IP address is entirely malicious.

The module needs a new MISP object template (MISP/misp-objects#397)

@adulau adulau merged commit ea0c6f9 into MISP:main Jul 10, 2023
5 checks passed
@adulau
Copy link
Member

adulau commented Jul 10, 2023

Thanks a lot for the contribution! Don't hesitate to add a JSON file to describe the module documentation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants