How does EventSentry integrate with AbuseIPDB?

EventSentry integrates with AbuseIPDB in the following ways if an AbuseIPDB API token is configured in the management console under Global Options -> Security -> AbuseIPDB Token and Get Threat Intel is checked.

• Scheduled download of the current AbuseIPDB black list (utilized by the Collector and Network Services/NetFlow component)
• Obtains additional threat intel from the AbuseIPDB API for IP addresses (utilized by the Collector and Network Services/NetFlow component)
• Report malicious IP addresses automatically to AbuseIPDB

Blacklist

Blacklist are checked for every new IP address processed by the NetFlow component and for the "is malicious" check in event log content filters.

Obtaining Threat Intel

Similar to black lists, IP addresses are also check against the AbuseIPDB API to get additional threat information about an IP address.