IPVoid

Integration version: 9.0

Configure IPVoid to work with Google Security Operations SOAR

API

For configuring IPVoid to work with Google Security Operations SOAR, the process is the same as for APIVoid.

  1. To obtain your personal API Key, please sign in to your APIVoid account.

  2. Click on the one of the two My API Keys buttons to get to the page where is your API Key stored.

  3. Once you get to the page with relevant key, click the copy button to copy your key to the clipboard, which will be later used in this integration configuration with Google Security Operations SOAR.

Network

Function Default Port Direction Protocol
API Multivalues Outbound apikey

Configure IPVoid integration in Google Security Operations SOAR

For detailed instructions on how to configure an integration in Google Security Operations SOAR, see Configure integrations.

Actions

Get IP Reputation

Description

Search for an IP address through different DNS-based blacklists (DNSBL) and the reputation services to promote the IP address identification for malware incidents and spamming.

Parameters

Parameters Type Default Value Description
Threshold String N/A IP risk threshold.

Use cases

N/A

Run On

This action runs on the IP Address entity.

Action Results

Entity Enrichment
Enrichment Field Name Logic-When to apply
information Returns if it exists in JSON result
blacklists Returns if it exists in JSON result
anonymity Returns if it exists in JSON result
IP Returns if it exists in JSON result
Insights

N/A

Script Result
Script Result Name Value Options Example
successThreshold True/False successThreshold:False
JSON Result
[{
   "EntityResult":
    {
      "information":
         {
           "is_proxy": false,
           "is_vpn": false,
           "region_name": "Zhejiang",
           "is_webproxy": false,
           "latitude": 28.680280685424805,
           "isp": "ChinaNet Zhejiang Province Network",
           "continent_code": "AS",
           "is_tor": false,
           "reverse_dns": "",
           "detections": 18,
           "engines_count": 76,
           "longitude": 121.44277954101562,
           "city_name": "Jiaojiang",
           "country_name": "China",
           "continent_name": "Asia",
           "detection_rate": "24%",
           "country_code": "CN",
           "is_hosting": false
        },
      "blacklists":
        {
           "scantime": "0.57",
          "detection_rate": "24%",
          "detections": 18,
          "engines_count": 76,
          "engines":
             [{
                "engine": "PlonkatronixBL",
                "detected": false,
                "reference": "http://bl.plonkatronix.com/"
              },
              {
                "engine": "Peter-s NUUG IP BL",
                "detected": true,
                "reference": "https://home.nuug.no/~peter/"
               },
              {
                "engine": "Malc0de",
                "detected": false,
                "reference": "http://malc0de.com/database/index.php"
               }]
         },
       "anonymity":
         {
           "is_tor": false,
           "is_proxy": false,
           "is_vpn": false,
           "is_webproxy": false,
           "is_hosting": false
          },
       "ip": "1.1.1.1"
     },
 "Entity": "1.1.1.1"
}]

Ping

Description

Test Connectivity.

Parameters

N/A

Use cases

N/A

Run On

This action runs on all entities.

Action Results

Entity Enrichment

N/A

Insights

N/A

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False
JSON Result
N/A

WhoIs

Description

Query the Whois database to find information on a given domain name or an IP address.

Parameters

N/A

Use cases

N/A

Run On

This action runs on the following entities:

  • IP Address
  • Hostname

Action Results

Entity Enrichment

N/A

Insights

N/A

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False
JSON Result
N/A