Skill guides · 2 min read
IP threat signals
Review public threat and reputation indicators for an IP address.
When to use it
Use this to inspect available public threat and reputation indicators for an IP address. Keep the request focused on the exact address and use your case context to decide which dated signals are relevant to the event under investigation.
Before you start
Available on Agency. Fill every required field. Example values below illustrate the form; replace them with your intended subject.
| Field | Required | What to enter |
|---|---|---|
| IP address | Required | The exact IP address to investigate. |
Run the Skill
- In Skill library, find IP threat signals and select Use template.
- Fill in the template fields using your subject’s details, then check the Preview.
- Select Insert into chat to load the prepared request into the investigation composer.
- Check the intended case and send the unchanged request to run this Skill. To change its inputs, return to the template and insert it again.
IP address: 192.0.2.1
Read the results
Compare signal dates, confidence, contradictions, and source limitations. A reputation label can reflect an older incident or activity on infrastructure shared by unrelated users. Treat a signal as evidence to investigate, not an attribution of the address to a person. An absence of returned signals is limited to the covered sources and does not guarantee that the address is safe.