Graylog

Look up live scores from pipeline rules with an HTTP JSONPath data adapter.

Graylog can call an HTTP API from a lookup table. Point it at the check endpoint and pipeline rules can ask for the live score of any address in a message.

Set it up

1. Data adapter. In System › Lookup Tables › Data Adapters, create one of type HTTP JSONPath:
   • Lookup URL: https://isipsafe.com/api/v1/check?ip=${key}&key=sl_your_key_here
   • Single value JSONPath: $.data.abuseConfidenceScore
   • Multi value JSONPath: $.data
2. Cache. Create a Node-local, in-memory cache with entries expiring after 1 hour. This matters: it keeps you well inside the rate limit.
3. Lookup table called isipsafe using that adapter and cache.
4. Use it in a pipeline rule:

   rule "isipsafe score"
   when
     has_field("src_ip")
   then
     let score = lookup_value("isipsafe", to_string($message.src_ip), 0);
     set_field("isipsafe_score", score);
   end

With a key you get 5,000 lookups an hour. For very busy streams, load the CSV blocklist with a CSV File data adapter instead and refresh the file from cron.

Need a hand?

If something here does not work with your version of Graylog, or you have improved it, tell us. We update these pages with what people send.

Graylog and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.