automation-AbuseIPDBPopulateIndicators.yml

args:
- defaultValue: "30"
  description: Time range to return reports for (in days), default is 30
  name: days
- defaultValue: "200"
  description: 'Maximum number of IPs to retrieve, default is 50 '
  name: limit
comment: Extracts blacklisted IP addresses from AbuseIPDB, and Populates Indicators
  accordingly.
commonfields:
  id: AbuseIPDBPopulateIndicators
  version: -1
dependson:
  must:
  - '|||abuseipdb-get-blacklist'
  - Builtin|||createNewIndicator
enabled: true
name: AbuseIPDBPopulateIndicators
runas: DBotWeakRole
runonce: false
script: |-
  BLACKLISTED = "Bad"
  res = demisto.executeCommand("abuseipdb-get-blacklist", {
      "days" : demisto.args().get("days"),
      "limit" : demisto.args().get("limit")
  })
  ips = res[0]['Contents']

  if not ips or "Too many requests" in ips:
      return_error("No Indicators were created (possibly bad API key)")

  # Extract IPs into new Indicators
  for ip in ips:
      demisto.executeCommand("createNewIndicator", {
          "type" : 'ip',
          "value" : ip,
          "source" : 'AbuseIPDB',
          "reputation" : BLACKLISTED,
          "seenNow" : "true",
      });

  demisto.results("All Indicators were created successfully")
scripttarget: 0
system: true
tags: []
timeout: 900ns
type: python