get_ip_info
Extract IP addresses and detection indicators from completed Joe Sandbox analyses to identify malicious activity and gather threat intelligence.
Instructions
Retrieve IP addresses in a completed analysis, along with their associated detection indicators.
This tool extracts IP addresses gathered by the sandbox engine and returns relevant context such as geolocation, status, and detection metadata.
Optional filtering parameters allow control over the inclusion of IP addresses and indicators based on their assessed severity.
Args:
webid (required): The submission ID of the analysis.
run (default: 0): Index of the sandbox run to inspect (from the `runs` array in analysis info).
only_malicious_elements (default: True): If True, returns only IP addresses explicitly classified as malicious by the sandbox engine.
only_malicious_indicators (default: True): If True, limits the returned indicators to those considered clearly malicious by the detection logic.
This excludes low-impact behavioral signals and focuses on indicators with a high likelihood of malicious intent or confirmed threat classification.
If False, all observed indicators are included regardless of their severity.
Returns:
A dictionary containing a list of malicious IP addresses. Each entry includes:
- ip: The IP address in question.
- country: Country code associated with the IP.
- pingable: Whether the IP responded during analysis.
- domain: Resolved domain name (if available).
- malicious: 'true' for IP addresses classified as malicious
- indicators: List of triggered detection rules, if any. Each entry includes:
- desc: Description of the matched detection rule.
- data: Matched content or signature.
- source: The detection subsystem responsible (e.g. Suricata, Sigma, global traffic etc.).
- impact: Either "high" or "low", indicating the severity or confidence of the detection.
High-impact indicators are strongly associated with malicious behavior or confirmed threats.
Low-impact indicators reflect general behavior or environmental traits that may not be malicious on their own.
Notes:
- Empty Array returned if no ip was gathered during the analysisInput Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| webid | Yes | ||
| run | No | ||
| only_malicious_elements | No | ||
| only_malicious_indicators | No |