Hi, I am trying to set up reporting to AbuseIPDB, which is proving to be much harder than expected. I have the data in Graylog to create a stream and send the data. I need to create a HTTP post: curl https://api.abuseipdb.com/api/v2/report \ --data-urlencode "ip=127.0.0.1" \ -d categories=18,2…

Hey @jonathanb thanks for asking.I think you can set up reporting to AbuseIPDB in Graylog 5.x using a Graylog pipeline rule. Generally, here’s how: Create a new pipeline rule in Graylog and specify the stream you want to use for reporting. In the pipeline rule, add a rule that matches the specifi…

dscryber, Thank you for the response. I presume the pipeline is to create the variables? And then those are passed to the HTTP output and placed into the URL? I have been trying to read the documentation to understand. Thank you

Yes. Create variables from input data, process them, and then pass them to an HTTP output module where they are formatted and placed into a URL as query parameters or part of the endpoint. The URL is then used to send an HTTP request to a remote server to retrieve or update data. Here in the commun…

hello @jonathanb Just chimmming in, I’m @tmacgbay apprentice in pipelines ( AKA Robin). [image] jonathanb: I presume the pipeline is to create the variables? And then those are passed to the HTTP output and placed into the URL? Found this in the forum. [image] Manage emai…

@gsmith thank you for that info. I am trying to read through the example to see what fits. Trying to write it out then as a start: rule "AbuseIPDB" when has_field("Snort_source_IP") && is_null(lookup_value("AbuseIPDB_reported", to_string($message.Snort_source_IP))) then let ip = is_ip($messag…

It looks like you are interested in querying api.abuseIPDB.com with data from a message field and having the Graylog message contain the results in a separate new field? The way other queries are done like this is via System/Lookup Tables. There you can start with a Data Adapter… they have sever…

@tmacgbay I will be setting this up as a content package or providing instructions once working. The lookup is not to spam reporting every time the IP comes up. So I am writing to a lookup to see if previously reported by my system. So the removing the lookup the code I need to get 100%: rule "A…

Maybe my coffee hasn’t kicked in… You are trying to send (you said POST) data external to Graylog with a URL that describes the path to send it. If you create a lookup table with the “HTTP JSONPath” Adapter, you can do just that. It will likely return something you are interested in for confirmati…

@tmacgbay Right I now have this: rule "AbuseIPDB" when has_field("Snort_source_IP") && is_null(lookup_value("AbuseIPDB_reported", to_string($message.Snort_source_IP))) then //Get the Offending IP let ip = to_string($message.Snort_source_IP); //Get the Snort Description let discription = to_str…

[image] jonathanb: let concatip = concat(“ip=”,to_string($message.Snort_source_IP)); For quotes, you can escape them … I think this would work to put quotes around the IP… let concatip = concat("ip=\"",to_string($message.Snort_source_IP)); let concat_fin = concat(concatip,"\""); // do so…

HTTP notification AbuseIPDB

Graylog Central (peer support)

gsmith (GSmith) February 1, 2023, 11:38pm 5

hello @jonathanb

Just chimmming in, I’m @tmacgbay apprentice in pipelines ( AKA Robin).

Found this in the forum.

Topic		Replies	Views
Graylog 6 & AbuseIPDB HTTP Notifications Graylog Central (peer support)	1	111	June 12, 2024
Graylog 6 custom http notification - AbuseIPDB Graylog Central (peer support)	4	266	May 28, 2024
Graylog and AbuseIPDB Data Adaptor Graylog Add-ons	2	564	June 21, 2023
HOW TO: AbuseIPDB lookup setup Graylog Central (peer support) pipeline-rules , documentation , automation	1	347	June 6, 2024
Search and action to an API Graylog Central (peer support)	5	404	September 1, 2021

HTTP notification AbuseIPDB

Related topics