Everything the sensors hold on one IP address, a CIDR range, several ranges at
once, or a domain, with our verdict and the reasons for it. Start here for any
question about a specific indicator.
Use for "is this IP malicious", "is this a known scanner", "have you seen this
address", "when was it last seen", "have any of this vendor's ranges touched
you". Do not use it to rank many sources (use top_attackers_tool), to profile a
whole ASN (use asn_enrich_tool), or to list raw events (use
search_events_tool). For what an address did inside sessions with the
interactive sensors, follow up with interactive_sessions_tool.
Returns total_events (0 means never observed in the window), first_seen,
last_seen, country, ASN, the 50 most-hit ports with ports_targeted_count, top
user agents and URL paths, TLS/HTTP/SSH fingerprints, cve_probes (the CVE
signatures it was seen probing), verdict (a sentence), verdict_key (a stable
value to alert on: scanner, tor, malicious, scanning, probing or none),
verdict_why (the signals behind it) and scanner (the identity of a recognised
research scanner, else null). Report the verdict with its reasons. A high
count from a recognised scanner is research traffic, not an attack. A single
address may also carry udp_unverified: UDP traffic that claimed it as source,
which can be forged and never counts against it.
days limits the lookback. Leave it unset for a single address to read every
retained event. A CIDR or domain defaults to 90 days because neither can use
an index; pass days to change that. The response names the window it used in
`window`; quote it with any count.
Pass ranges as one string separated by commas, spaces or newlines
('103.66.28.0/22, 8.34.210.32/27'). Never expand a range into addresses and
loop: one call answers it, and looping burns the daily credits. A range answer
has query_type 'cidr' or 'cidr_set', per_range counts and top_source_ips.
ConnectorNo auth
