AbuseIPDBPopulateIndicators.yml

commonfields:
  id: AbuseIPDBPopulateIndicators
  version: -1
name: AbuseIPDBPopulateIndicators
script: ''
type: python
subtype: python3
tags: []
comment: Extracts IP addresses on block lists from AbuseIPDB, and Populates Indicators accordingly.
enabled: true
args:
- name: days
  description: Time range to return reports for (in days).
  defaultValue: "30"
- name: limit
  description: 'Maximum number of IPs to retrieve.'
  defaultValue: "200"
- name: confidence
  description: 'The Minimum confidence required of IPs to retrieve.'
  defaultValue: "100"
scripttarget: 0
dependson:
  must:
  - '|||abuseipdb-get-blacklist'
  - Builtin|||createNewIndicator
timeout: 900ns
runas: DBotWeakRole
tests:
- AbuseIPDB PopulateIndicators Test
fromversion: 5.0.0
dockerimage: demisto/python3:3.11.10.115186