Elastic

Load the list into Elasticsearch and enrich events at ingest.

Index the blocklist in Elasticsearch, then use an enrich policy so every incoming event that comes from a listed address gets its score and categories attached at ingest.

Set it up

1. Load the list into an index called isipsafe (hourly from cron; the document ID is the address, so reloads update in place):

   curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=json&confidenceMinimum=25" \
     | jq -c '.data[] | {index: {_index: "isipsafe", _id: .ipAddress}}, {ip: .ipAddress, confidence: .abuseConfidenceScore, country: .countryCode, categories: .categories}' \
     | curl -sf -H "Content-Type: application/x-ndjson" -u elastic:$ES_PASSWORD -X POST "$ES_URL/_bulk" --data-binary @-

2. Create and run the enrich policy (in Kibana Dev Tools):

   PUT _enrich/policy/isipsafe
   { "match": { "indices": "isipsafe", "match_field": "ip", "enrich_fields": ["confidence", "country", "categories"] } }
   
   POST _enrich/policy/isipsafe/_execute

3. Add it to an ingest pipeline used by your logs:

   PUT _ingest/pipeline/isipsafe-enrich
   { "processors": [ { "enrich": {
       "policy_name": "isipsafe", "field": "source.ip",
       "target_field": "threat.isipsafe", "ignore_missing": true } } ] }

Re-run _execute after each reload so the enrich index picks up changes. Then search or alert on threat.isipsafe.confidence >= 75.

Need a hand?

If something here does not work with your version of Elastic, or you have improved it, tell us. We update these pages with what people send.

Elastic and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.