get_entities_related_to_an_ip_address
Query relationships of an IP address to find associated campaigns, files, malware families, and other threat intelligence data.
Instructions
Retrieve entities related to the the given IP Address.
The following table shows a summary of available relationships for IP Address objects.
Relationship | Description | Return type |
associations | IP's associated objects (reports, campaigns, IoC collections, malware families, software toolkits, vulnerabilities, threat-actors), without filtering by the associated object type. | collection |
campaigns | Campaigns associated to the IP address. | collection |
collections | IoC Collections associated to the IP address. | collection |
comments | Comments for the IP address. | comment |
communicating_files | Files that communicate with the IP address. | file |
downloaded_files | Files downloaded from the IP address. | file |
graphs | Graphs including the IP address. | graph |
historical_ssl_certificates | SSL certificates associated with the IP. | ssl-cert |
historical_whois | WHOIS information for the IP address. | whois |
malware_families | Malware families associated to the IP address. | collection |
memory_pattern_parents | Files having an IP as string on memory during sandbox execution. | file |
referrer_files | Files containing the IP address. | file |
related_comments | Community posted comments in the IP's related objects. | comment |
related_reports | Reports that are directly and indirectly related to the IP. | collection |
related_threat_actors | Threat actors related to the IP address. | collection |
reports | Reports directly associated to the IP. | collection |
resolutions | IP address' resolutions | resolution |
software_toolkits | Software and Toolkits associated to the IP address. | collection |
urls | URLs related to the IP address. | url |
user_votes | IP's votes made by current signed-in user. | vote |
votes | IP's votes. | vote |
vulnerabilities | Vulnerabilities associated to the IP address. | collection |
Args: ip_address (required): IP Addres to analyse. relationship_name (required): Relationship name. descriptors_only (required): Bool. Must be True when the target object type is one of file, domain, url, ip_address or collection. limit: Limit the number of entities to retrieve. 10 by default. Returns: List of entities related to the IP Address.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| ip_address | Yes | ||
| descriptors_only | Yes | ||
| relationship_name | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |