Run any Skill in Manus with one click

abuseipdb-integration

Stars1

Forks0

UpdatedApril 26, 2026 at 19:43

AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

open-analysi

open-analysi/analysi-app

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

File Explorer

4 files

SKILL.md

readonly

name	abuseipdb-integration
description	AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.
version	0.1.0

AbuseIPDB Integration for Analysi Investigations

AbuseIPDB provides crowd-sourced IP abuse intelligence. The Analysi integration exposes two working actions: lookup_ip for reputation checks and report_ip for submitting abuse reports. Only IP-based lookups are supported — domain, URL, and file hash actions are stubs that return errors.

Reference Loading Guide

Reference	Read when	Consult for
`references/actions-reference.md`	Calling any AbuseIPDB action	Parameters, return fields, Cy examples, response interpretation, known limitations
`references/investigation-patterns.md`	Building triage workflows	Decision trees, multi-source corroboration with VirusTotal/Splunk, Cy task templates, category mappings

Quick Decision Path

Need IP abuse score? → app::abuseipdb::lookup_ip(ip=target_ip) — returns abuse_confidence_score (0–100). See actions-reference.md § Cy Usage Pattern for the full extraction template.
Corroborating with VirusTotal? → Call both in parallel, compare scores — see investigation-patterns.md § Pattern 2
Reporting confirmed abuse? → app::abuseipdb::report_ip(ip=ip, categories="18,22") — use only after confirmed TP
Need domain/URL/hash lookup? → Not available via AbuseIPDB — use VirusTotal instead

Guardrails

No domain/URL/file hash lookups — lookup_domain, lookup_url, lookup_file_hash are stubs that return NotSupportedError. Use VirusTotal for those IOC types.
report_ip is a write operation — only use after a confirmed true positive disposition. Never call during automated triage without human approval.
Rate limits apply — AbuseIPDB enforces per-key rate limits. The integration raises "Rate limit exceeded" on HTTP 429. Add try/catch around all calls.
Default lookback is 10 days — the Analysi integration defaults to 10 days (the upstream AbuseIPDB API defaults to 30). Pass days=90 for broader history when investigating persistent threats.
No verbose mode — the integration does not expose the AbuseIPDB verbose flag, so individual report details are not available. Use total_reports and num_distinct_users for crowd-sourced signal strength.

More from this repository

same repository

ad-ldap-integration

open-analysi/analysi-app

Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi.

2026-04-261

cy-language-programming

open-analysi/analysi-app

Write and debug Cy language scripts for automation and workflow composition. Use when working with .cy files, Security Tasks, writing Cy programs, or debugging Cy syntax errors.

2026-04-261

cybersecurity-analyst

open-analysi/analysi-app

Investigate security alerts, analyze IOCs, triage incidents, and perform threat analysis. Covers SIEM alerts, SOC workflows, malware, phishing, brute force, web attacks, network traffic, and log analysis. Use when building cybersecurity Tasks/Workflows or performing incident response.

2026-04-261

echo-edr-integration

open-analysi/analysi-app

Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi.

2026-04-261

global-dns-integration

open-analysi/analysi-app

DNS resolution, reverse lookups, and mail/TXT/NS/SOA queries via Analysi's Global DNS for SOC triage. Use when investigating suspicious domains, resolving IPs to hostnames, checking SPF/DKIM/DMARC in phishing analysis, or correlating network indicators with domain infrastructure.

2026-04-261

hypothesis-building-task

open-analysi/analysi-app

Build hypothesis generation tasks for security investigation workflows. Use when creating tasks that form investigation hypotheses from runbooks. These tasks combine static hypotheses (baked in at Kea-time) with dynamic LLM augmentation (at runtime).

2026-04-261

name	abuseipdb-integration
description	AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.
version	0.1.0

AbuseIPDB Integration for Analysi Investigations

Reference Loading Guide

Reference	Read when	Consult for
`references/actions-reference.md`	Calling any AbuseIPDB action	Parameters, return fields, Cy examples, response interpretation, known limitations
`references/investigation-patterns.md`	Building triage workflows	Decision trees, multi-source corroboration with VirusTotal/Splunk, Cy task templates, category mappings

Quick Decision Path

Need IP abuse score? → app::abuseipdb::lookup_ip(ip=target_ip) — returns abuse_confidence_score (0–100). See actions-reference.md § Cy Usage Pattern for the full extraction template.
Corroborating with VirusTotal? → Call both in parallel, compare scores — see investigation-patterns.md § Pattern 2
Reporting confirmed abuse? → app::abuseipdb::report_ip(ip=ip, categories="18,22") — use only after confirmed TP
Need domain/URL/hash lookup? → Not available via AbuseIPDB — use VirusTotal instead

Guardrails

No domain/URL/file hash lookups — lookup_domain, lookup_url, lookup_file_hash are stubs that return NotSupportedError. Use VirusTotal for those IOC types.
report_ip is a write operation — only use after a confirmed true positive disposition. Never call during automated triage without human approval.
Rate limits apply — AbuseIPDB enforces per-key rate limits. The integration raises "Rate limit exceeded" on HTTP 429. Add try/catch around all calls.
Default lookback is 10 days — the Analysi integration defaults to 10 days (the upstream AbuseIPDB API defaults to 30). Pass days=90 for broader history when investigating persistent threats.
No verbose mode — the integration does not expose the AbuseIPDB verbose flag, so individual report details are not available. Use total_reports and num_distinct_users for crowd-sourced signal strength.