Export Callback IPs
export-callback-ipsRead-only
Export a plain list of callback and C2 IPs by applying filters like file hash, name, type, date ranges, and scanner IPs for threat intelligence analysis.
Instructions
Export callback/C2 IPs matching the filters as a plain list. Same filters as List Callback IPs. Dates are YYYY-MM-DD.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ips | No | Filter to this specific set of callback IPs | |
| file_hash | No | File SHA256 hash | |
| file_name | No | File name substring match | |
| file_type | No | File MIME type (e.g. "application/x-executable") | |
| has_files | No | true = only IPs with malware files; false = only IPs without files | |
| is_stage_1 | No | true = file was downloaded from this IP (stage 1) | |
| is_stage_2 | No | true = suspected C2 based on VT/sandbox analysis (stage 2) | |
| scanner_ips | No | Filter to IPs associated with these scanner IPs | |
| last_seen_after | No | Only IPs last seen after this date (YYYY-MM-DD) | |
| first_seen_after | No | Only IPs first seen after this date (YYYY-MM-DD) | |
| last_seen_before | No | Only IPs last seen before this date (YYYY-MM-DD) | |
| first_seen_before | No | Only IPs first seen before this date (YYYY-MM-DD) |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ips | Yes | ||
| count | Yes |