Automatically enabled when you configure AbuseIPDB permissions in your agent workflow.
What It Does
- Check an IP address: its abuse confidence score (0 to 100), how many reports and reporters, the newest report, the ISP, domain, country and usage type (ISP, mobile, data centre), and whether it is a Tor exit node
- Read the reports on an IP, with their attack categories (brute force, phishing, port scan, hacking and others)
- Check a whole network range (CIDR) for reported addresses
- Read the blacklist of the most reported IPs
- Report an attacking IP, alone or in a bulk CSV, and delete your account’s own reports of an IP filed in error
How the agent uses it on an alert
The agent takes the IP from the alert or the ticket, skips a private address, and checks it once. A high score with recent reports from several users counts as threat-intelligence evidence that the IP is malicious; a score of zero means AbuseIPDB gives the IP no current abuse confidence, and the report count says whether anyone reported it; neither is proof that the sign-in is safe. A Tor exit node or a data centre address behind a user’s sign-in counts as suspicious. Your agent’s instructions decide the verdict and the action: AbuseIPDB is one piece of evidence, and the agent names its findings in the note with a link to the IP’s AbuseIPDB page.Permission Groups
Access Profiles
Reporting needs an AbuseIPDB account approved for reporting: request reporting privilege on abuseipdb.com/report. A report is public: every AbuseIPDB user sees it, and it adds to the address’s score, which can put it on the AbuseIPDB blacklist that some firewalls block. So both Helpdesk and IT Admin ask before a report. The agent reports only an address your instructions or a technician confirm as an attacker, never a client’s own office, a user’s home or mobile address, or an approved location, and it keeps user names, email addresses, client names, host names and internal addresses out of the published comment.