Skip to content

new: [ipgeolocation-ip] IPGeolocation.io IP intelligence object template #534

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adulau merged 1 commit into from
Oct 9, 2026
Merged

new: [ipgeolocation-ip] IPGeolocation.io IP intelligence object template #534

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -308,6 +308,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID
- [objects/iot-firmware](https://github.com/MISP/misp-objects/blob/main/objects/iot-firmware/definition.json) - A firmware for an IoT device.
- [objects/ip-api-address](https://github.com/MISP/misp-objects/blob/main/objects/ip-api-address/definition.json) - IP Address information. Useful if you are pulling your ip information from ip-api.com.
- [objects/ip-port](https://github.com/MISP/misp-objects/blob/main/objects/ip-port/definition.json) - An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.
- [objects/ipgeolocation-ip](https://github.com/MISP/misp-objects/blob/main/objects/ipgeolocation-ip/definition.json) - IP address intelligence from IPGeolocation.io: threat score, anonymisation signals (VPN, proxy, Tor, relay), bot, spam and attacker flags, hosting provider, company and abuse contact.
- [objects/irc](https://github.com/MISP/misp-objects/blob/main/objects/irc/definition.json) - An IRC object to describe an IRC server and the associated channels.
- [objects/ja3](https://github.com/MISP/misp-objects/blob/main/objects/ja3/definition.json) - JA3 is a new technique for creating SSL client fingerprints that are easy to produce and can be easily shared for threat intelligence. Fingerprints are composed of Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. https://github.com/salesforce/ja3.
- [objects/ja3s](https://github.com/MISP/misp-objects/blob/main/objects/ja3s/definition.json) - JA3S is JA3 for the Server side of the SSL/TLS communication and fingerprints how servers respond to particular clients. JA3S fingerprints are composed of Server Hello packet; SSL Version, Cipher, SSLExtensions. https://github.com/salesforce/ja3.
Expand Down
243 changes: 243 additions & 0 deletions objects/ipgeolocation-ip/definition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,243 @@
{
"attributes": {
"abuse-address": {
"description": "Postal address of the abuse contact for the network the IP address belongs to",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"abuse-country": {
"description": "Country code of the abuse contact",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"abuse-email": {
"description": "Email address of the abuse contact",
"disable_correlation": true,
"misp-attribute": "email",
"multiple": true,
"ui-priority": 1
},
"abuse-name": {
"description": "Name of the abuse contact",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"abuse-organization": {
"description": "Organisation of the abuse contact, or its registry handle",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"abuse-phone": {
"description": "Phone number of the abuse contact",
"disable_correlation": true,
"misp-attribute": "phone-number",
"multiple": true,
"ui-priority": 0
},
"abuse-route": {
"description": "Network range (CIDR) the abuse contact is responsible for",
"disable_correlation": true,
"misp-attribute": "ip-src",
"ui-priority": 0
},
"bot-confidence-score": {
"description": "Confidence that the IP address is used by bots, from 0 to 100",
"disable_correlation": true,
"misp-attribute": "integer",
"ui-priority": 0
},
"bot-last-seen": {
"description": "Last time the IP address was seen used by bots",
"disable_correlation": true,
"misp-attribute": "datetime",
"ui-priority": 0
},
"bot-operator": {
"description": "Name of the operator of the bot",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"bot-type": {
"description": "Type of bot, such as crawler or monitoring",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"cloud-provider": {
"description": "Name of the cloud or hosting provider the IP address belongs to",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 1
},
"company-domain": {
"description": "Domain of the company or ISP using the IP address",
"disable_correlation": true,
"misp-attribute": "domain",
"ui-priority": 0
},
"company-name": {
"description": "Name of the company or ISP using the IP address",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 1
},
"company-type": {
"description": "Type of the company using the IP address, such as ISP, hosting or business",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"corporate-gateway-provider": {
"description": "Name of the corporate gateway provider",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"corporate-gateway-type": {
"description": "Type of corporate gateway",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"ip": {
"description": "IP address the information refers to",
"misp-attribute": "ip-src",
"ui-priority": 1
},
"is-anonymous": {
"description": "The IP address hides the identity of its user (VPN, proxy, Tor or relay)",
"disable_correlation": true,
"misp-attribute": "boolean",
"ui-priority": 1
},
"is-bot": {
"description": "The IP address is used by bots",
"disable_correlation": true,
"misp-attribute": "boolean",
"ui-priority": 1
},
"is-cloud-provider": {
"description": "The IP address belongs to a cloud or hosting provider",
"disable_correlation": true,
"misp-attribute": "boolean",
"ui-priority": 1
},
"is-corporate-gateway": {
"description": "The IP address is a corporate gateway, such as a secure web gateway or zero-trust egress",
"disable_correlation": true,
"misp-attribute": "boolean",
"ui-priority": 1
},
"is-known-attacker": {
"description": "The IP address has been seen attacking other systems",
"disable_correlation": true,
"misp-attribute": "boolean",
"ui-priority": 1
},
"is-known-good-bot": {
"description": "The IP address belongs to a known legitimate crawler or bot, such as a search engine",
"disable_correlation": true,
"misp-attribute": "boolean",
"ui-priority": 1
},
"is-proxy": {
"description": "The IP address is a proxy",
"disable_correlation": true,
"misp-attribute": "boolean",
"ui-priority": 1
},
"is-relay": {
"description": "The IP address is part of a relay network, such as iCloud Private Relay",
"disable_correlation": true,
"misp-attribute": "boolean",
"ui-priority": 1
},
"is-residential-proxy": {
"description": "The IP address is a residential proxy",
"disable_correlation": true,
"misp-attribute": "boolean",
"ui-priority": 1
},
"is-spam": {
"description": "The IP address has been seen sending spam",
"disable_correlation": true,
"misp-attribute": "boolean",
"ui-priority": 1
},
"is-tor": {
"description": "The IP address is a Tor exit node",
"disable_correlation": true,
"misp-attribute": "boolean",
"ui-priority": 1
},
"is-vpn": {
"description": "The IP address is a VPN exit point",
"disable_correlation": true,
"misp-attribute": "boolean",
"ui-priority": 1
},
"proxy-confidence-score": {
"description": "Confidence that the IP address is a proxy, from 0 to 100",
"disable_correlation": true,
"misp-attribute": "integer",
"ui-priority": 0
},
"proxy-last-seen": {
"description": "Last time the IP address was seen as a proxy",
"disable_correlation": true,
"misp-attribute": "datetime",
"ui-priority": 0
},
"proxy-provider": {
"description": "Name of the proxy provider",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"ui-priority": 1
},
"relay-provider": {
"description": "Name of the relay provider",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"threat-score": {
"description": "IPGeolocation.io threat score, from 0 to 100; higher is riskier",
"disable_correlation": true,
"misp-attribute": "integer",
"ui-priority": 1
},
"vpn-confidence-score": {
"description": "Confidence that the IP address is a VPN exit point, from 0 to 100",
"disable_correlation": true,
"misp-attribute": "integer",
"ui-priority": 0
},
"vpn-last-seen": {
"description": "Last time the IP address was seen as a VPN exit point",
"disable_correlation": true,
"misp-attribute": "datetime",
"ui-priority": 0
},
"vpn-provider": {
"description": "Name of the VPN provider",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"ui-priority": 1
}
},
"description": "IP address intelligence from IPGeolocation.io: threat score, anonymisation signals (VPN, proxy, Tor, relay), bot, spam and attacker flags, hosting provider, company and abuse contact.",
"meta-category": "network",
"name": "ipgeolocation-ip",
"required": [
"ip"
],
"uuid": "e1bde989-c8dd-49b1-a45b-b63698dbfcaa",
"version": 1
}
Loading