Graylog 6 & AbuseIPDB HTTP Notifications

Graylog Central (peer support)
1

Hi all,

I’m currently trying to use the new customer HTTP notifications from Graylog 6 to report IPs through API to AbuseIPdb.com.

I manage to solve the API key issue with some help.

But now I see two additional issues.

This is how the API call should look like.

# POST the submission.
curl https://api.abuseipdb.com/api/v2/report \
  --data-urlencode "ip=127.0.0.1" \
  -d categories=18,22 \
  --data-urlencode "comment=SSH login attempts with user root." \
  --data-urlencode "timestamp=2023-10-18T11:25:11-04:00" \
  -H "Key: YOUR_OWN_API_KEY" \
  -H "Accept: application/json"

My problem is the timestamp to be in ISO 8601 format as well to send the categories as plain text and not URL encoded.

Hope someone has ideas how to solve it.

Regards
Timmi

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.