id: abuseipdb
name: AbuseIPDB
version: 1.0.0
description: "AbuseIPDB (API v2) — check the abuse reputation of an IP, report abusive IPs, pull the blacklist and check a CIDR block. API-key authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: IP reputation check, report, blacklist retrieval and CIDR-block check."
category: enrichment

config_schema:
  properties:
    api_key:
      type: string
      description: "AbuseIPDB API key"
      x-soar-sensitive: true
  required:
    - api_key

commands:
  - id: check_ip
    name: abuseipdb-check-ip
    description: "Check the abuse-confidence reputation of an IP address."
    risk: read
    inputs_schema:
      properties:
        ip: { type: string, description: "IP address to check" }
        max_age_days: { type: number, description: "Only consider reports within this many days (default 30, max 365)" }
        verbose: { type: boolean, description: "Include the detailed report list" }
      required: [ip]
    outputs_schema: { properties: {} }
  - id: report_ip
    name: abuseipdb-report-ip
    description: "Report an abusive IP address to AbuseIPDB."
    inputs_schema:
      properties:
        ip: { type: string, description: "IP address to report" }
        categories: { type: string, description: "Comma-separated AbuseIPDB category IDs (e.g. 18,22)" }
        comment: { type: string, description: "Description of the abusive activity (avoid sensitive data)" }
      required: [ip, categories]
    outputs_schema: { properties: {} }
  - id: get_blacklist
    name: abuseipdb-get-blacklist
    description: "Retrieve the AbuseIPDB blacklist of the most-reported IPs."
    risk: read
    inputs_schema:
      properties:
        confidence_minimum: { type: number, description: "Minimum abuse-confidence score (default 100)" }
        limit: { type: number, description: "Maximum entries (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: check_block
    name: abuseipdb-check-block
    description: "Check the reports for every address in a CIDR block (max /24 on the free tier)."
    risk: read
    inputs_schema:
      properties:
        network: { type: string, description: "CIDR network, e.g. 192.0.2.0/24" }
        max_age_days: { type: number, description: "Only consider reports within this many days (default 30)" }
      required: [network]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: abuseipdb-test-connection
    description: "Verify the API key (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }