How can I report an IP address to AbuseIPDB?

Question

Accepted Answer

EventSentry can detect malicious activity in a variety of ways, including:

Failed Logons (RDP, ...)
Log File Activity
Outgoing process activity
Port Scans (NetFlow, Windows )
Syslog

Once a malicious IP is detected, it can be helpful to report the IP address to an online reputation system for IP addresses like abuseipdb.com. Automatically submitting IP addresses to an online service requires 2 initial steps:

Setup a user-embedded script (strictly speaking not required but cleaner)
Create a process action referencing the script

Once the action is setup, it can be referenced by a variety of filter rules - we will use event id 801 from the EventSentry Network Services / NetFlow which is logged when a port scan was detected.

Prerequisites: You will need a valid API key from AbuseIPDB - a free plan is available.

1. Embedded Script

The easiest way to submit the offending IP is via curl.exe, which is available on all modern versions of Windows.

c:\windows\system32\curl.exe --fail "https://api.abuseipdb.com/api/v2/report" -H "Accept: application/json" -H "Key: YOUR-ABUSEIPDB-KEY" --data-urlencode "comment=Portscan detected by EventSentry NetFlow" --data-urlencode "ip=%1" --data-urlencode "categories=14"

Simply replace YOUR-ABUSEIPDB-KEY with your actual key and optionally adjust the comment (e.g. Malicious IP detect by Corp ABC) and category.

Category 14 indicates a port scan, and AbuseIPDB's categories are listed here: https://www.abuseipdb.com/categories. Multiple categories can be separated with a comma, so if invalid login attempts to SSH are detected via Syslog for example, then this command could be used:

c:\windows\system32\curl.exe --fail "https://api.abuseipdb.com/api/v2/report" -H "Accept: application/json" -H "Key: YOUR-ABUSEIPDB-KEY" --data-urlencode "comment=Unauthorized SSH logons detected" --data-urlencode "ip=%1" --data-urlencode "categories=15,22"

User-embedded scripts are added under Scripts -> User (Embedded) and would look like this:

It's important to set the interpreter to cmd.exe /c

2. Process Action

The previously created script can now be referenced in process actions in response to certain activity, such as a detected port scan.

In the management console, create a new Process action under "Actions" and give it a descriptive name, such as Report NetFlow Port Scan:

The previously specified script name can be selected from the drop-down menu, where the leading @ character indicates an embedded script. For example, @abuseipdb_block_netflow.cmd.

The argument $STR1 passes an insertion string from event id 801. Insertion strings can be reviewed on system32.eventsentry.com or the built-in Event Message Browser in the management console (Tools -> Utilities):

Different events use different insertion strings for their IP address, as such multiple actions may have to be setup for different insertion strings. For example, security event id 4625 uses insertion string 20 for the IP address, and as such $STR20 would need to be used.

Now that both the script and the action are setup, they can be referenced by various event log filters in response to various events that report a potentially malicious IP address. A threshold can be applied to the action in the Options dialog, to ensure the action is called more than X times / hour for example.