메뉴
AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.
Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi.
Write and debug Cy language scripts for automation and workflow composition. Use when working with .cy files, Security Tasks, writing Cy programs, or debugging Cy syntax errors.
Investigate security alerts, analyze IOCs, triage incidents, and perform threat analysis. Covers SIEM alerts, SOC workflows, malware, phishing, brute force, web attacks, network traffic, and log analysis. Use when building cybersecurity Tasks/Workflows or performing incident response.
Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi.
DNS resolution, reverse lookups, and mail/TXT/NS/SOA queries via Analysi's Global DNS for SOC triage. Use when investigating suspicious domains, resolving IPs to hostnames, checking SPF/DKIM/DMARC in phishing analysis, or correlating network indicators with domain infrastructure.
| name | abuseipdb-integration |
| description | AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence. |
| version | 0.1.0 |
AbuseIPDB provides crowd-sourced IP abuse intelligence. The Analysi integration exposes two working actions: lookup_ip for reputation checks and report_ip for submitting abuse reports. Only IP-based lookups are supported — domain, URL, and file hash actions are stubs that return errors.
| Reference | Read when | Consult for |
|---|---|---|
references/actions-reference.md | Calling any AbuseIPDB action | Parameters, return fields, Cy examples, response interpretation, known limitations |
references/investigation-patterns.md | Building triage workflows | Decision trees, multi-source corroboration with VirusTotal/Splunk, Cy task templates, category mappings |
app::abuseipdb::lookup_ip(ip=target_ip) — returns abuse_confidence_score (0–100). See actions-reference.md § Cy Usage Pattern for the full extraction template.investigation-patterns.md § Pattern 2app::abuseipdb::report_ip(ip=ip, categories="18,22") — use only after confirmed TPlookup_domain, lookup_url, lookup_file_hash are stubs that return NotSupportedError. Use VirusTotal for those IOC types.report_ip is a write operation — only use after a confirmed true positive disposition. Never call during automated triage without human approval."Rate limit exceeded" on HTTP 429. Add try/catch around all calls.days=90 for broader history when investigating persistent threats.verbose mode — the integration does not expose the AbuseIPDB verbose flag, so individual report details are not available. Use total_reports and num_distinct_users for crowd-sourced signal strength.