Check IP Reputation‎

POST /Command/CheckIPReputation

Get the reputation of external IPs from the system reputation integrations

Request

Authentication: API keys or JSON web tokens (JWT)

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`string`	Required	The username of your D3 SOAR account.
Site	`string`	Required	The D3 SOAR site to run the remote command.
externalIPs	`array<string>`	Required	The external Ips
Return Reputation Raw Data	`string`	Optional	Whether to return raw data of artifact's reputation
Return Reputation's HTML	`string`	Optional	Whether to return beautified HTML based on artifact's reputation

Body Sample Data

application/json

CODE

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "externalIPs": [
      "8.8.x.x"
    ],
    "Return Reputation Raw Data": "Yes",
    "Return Reputation's HTML": "Yes"
  }
}

Response

200 OK

application/json

Response Fields

Field Name	Type	Description
result	`string`	The result from the API request.
error	`string`	The error message if the API request has failed.
keyFields	`array<JSON Object>`	The key field from the API request.
returnData	`string`	The return data from the API request.
rawData	`array<JSON Object>`	The raw data from the API request.
contextData	`array<JSON Object>`	The context data from the API request.

Sample Data

CODE

{
    "result": "<table class='cc-table horizontal-table'><tr><th>IP</th><th>RiskLevel</th><th>RiskLevelID</th></tr><tr><td>8.8.8.8</td><td>N/A</td><td>4</td></tr></table>",
    "error": "",
    "keyFields": {
        "IP":["8.8.8.x"],
        "RiskLevel":["High"]
    },
    "returnData": "Succeed",
    "rawData": [
          {
              "IP": "8.8.8.x",
              "RiskLevel": "Low",
              "RiskLevelID": 3,
              "Reputation": [
                  {
                      "Resource": "webrootbcti",
                      "RiskLevelID": "3",
                      "RiskLevel": "Low"
                  }
              ],
              "RawData": {
                  "ip": "8.8.8.x",
                  "queries": {
                      "getinfo": {
                          "ipint": 1347440xx,
                          "ip_status": 0,
                          "reputation": 80,
                          "riskLevel": 3
                      }
                  }
              },
              "BeautifiedHtml": "<table class='cc-table horizontal-table'><tr><th>Type</th><th>Indicator</th><th>Reputation Score</th><th>Category Group</th><th>D3 Risk Level</th></tr><tr><td>IPv4</td><td>8.8.8.8</td><td>80</td><td>None</td><td>3</td></tr></table>"
          }
      ]",
          "contextData": "[
          {
              "IP": "8.8.8.x",
              "RiskLevel": "Low",
              "RiskLevelID": 3,
              "RawData": {
                  "ip": "8.8.8.8",
                  "queries": {
                      "getinfo": {
                          "ipint": 1347440xx,
                          "ip_status": 0,
                          "reputation": 80,
                          "riskLevel": 3
                      }
                  }
              },
              "BeautifiedHtml": "<table class='cc-table horizontal-table'><tr><th>Type</th><th>Indicator</th><th>Reputation Score</th><th>Category Group</th><th>D3 Risk Level</th></tr><tr><td>IPv4</td><td>8.8.8.8</td><td>80</td><td>None</td><td>3</td></tr></table>"
          }
      ]
}

400 BadRequest

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "The body of the request must be a valid JSON object"}

401 Unauthorized

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "Invalid authentication key."}

429 TooManyRequests

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "The request exceeds rate limits or is otherwise blocked by rate limiting policies."}

500 InternalServerError

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "Unexpected Error."}