Skip to main content
AbuseIPDB is a shared database of IP addresses that its users reported for abuse: brute force, phishing, port scans, spam and hacking. Connect it, and Neo agents can check the IP behind a security alert while they investigate it.

​
What Neo can do with AbuseIPDB

  • Check the IP behind a sign-in or firewall alert: its abuse confidence score, the number of reports and reporters, the attack categories, the ISP, usage type and country, and whether it is a Tor exit node
  • Add that reputation to the investigation, so the agent can escalate an alert from a known attacker, or weigh one from a clean address on its other evidence, as its instructions say
  • Check a whole network range when several alerts come from one provider
  • Report an IP your team confirmed as an attacker. The report adds to the IP’s shared reputation on AbuseIPDB, and can put it on the blacklist that some firewalls read
It fits beside SaaS Alerts: the SaaS Alerts ticket gives the IP, and AbuseIPDB says whether it is known for abuse. See AbuseIPDB API for the permission groups and profiles. An IP has no client of its own, so there is no company mapping to set up.

​
Which AbuseIPDB plan you need

A free AbuseIPDB account works: it allows 1,000 IP checks a day. Paid plans raise the daily limits, check larger network ranges and older reports, and filter the blacklist.

​
Next steps

Connect AbuseIPDB

Create your AbuseIPDB API key and save it in Neo.