AbuseIPDB + Steampipe
AbuseIPDB allows users to report and identify IP addresses that have been associated with malicious activity online.
Steampipe is an open-source zero-ETL engine to instantly query cloud APIs using SQL.
Query IP address base data from AbuseIPDB:
select ip_address, abuse_confidence_score, last_reported_atfrom abuseipdb_check_ipwhere ip_address = '76.76.21.21'
+-------------+------------------------+---------------------+| ip_address | abuse_confidence_score | last_reported_at |+-------------+------------------------+---------------------+| 76.76.21.21 | 73 | 2021-07-10 15:01:31 |+-------------+------------------------+---------------------+
Documentation
Get started
Install
Download and install the latest AbuseIPDB plugin:
steampipe plugin install abuseipdb
Configuration
Installing the latest abuseipdb plugin will create a config file (~/.steampipe/config/abuseipdb.spc
) with a single connection named abuseipdb
:
connection "abuseipdb" { plugin = "abuseipdb" api_key = "5a76843869c183a4ea901c79102bfa1f667f39a2ea0ba857c9a35a9885d91fbd9c4ae24d6a10999f"}
api_key
- Free API key for authenticated access.
Postgres FDW
This plugin is available as a native Postgres FDW. Unlike Steampipe CLI, which ships with an embedded Postgres server instance, the Postgres FDW can be installed in any supported Postgres database version.
You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_postgres_installer.sh
script:
/bin/sh -c "$(curl -fsSL https://steampipe.io/install/postgres.sh)" -- abuseipdb
The installer will prompt you for the plugin name and version, download and install the appropriate files for your OS, system architecture, and Postgres version.
To configure the Postgres FDW, you will create an extension, foreign server, and schema and import the foreign schema.
CREATE EXTENSION IF NOT EXISTS steampipe_postgres_abuseipdb;CREATE SERVER steampipe_abuseipdb FOREIGN DATA WRAPPER steampipe_postgres_abuseipdb OPTIONS (config '<your_config>');CREATE SCHEMA abuseipdb;IMPORT FOREIGN SCHEMA abuseipdb FROM SERVER steampipe_abuseipdb INTO abuseipdb;
SQLite Extension
This plugin is available as a SQLite Extension, making the tables available as SQLite virtual tables.
You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_sqlite_installer.sh
script:
/bin/sh -c "$(curl -fsSL https://steampipe.io/install/sqlite.sh)" -- abuseipdb
The installer will prompt you for the plugin name, version, and destination directory. It will then determine the OS and system architecture, and it will download and install the appropriate package.
To configure the SQLite extension, load the extension module and then run the steampipe_configure_abuseipdb
function to configure it with plugin-specific options.
$ sqlite3sqlite> .load ./steampipe_sqlite_extension_abuseipdb.sosqlite> select steampipe_configure_abuseipdb('<your_config>');
Export
This plugin is available as a standalone Export CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.
You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh
script:
/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- abuseipdb
You can pass the configuration to the command with the --config
argument:
steampipe_export_abuseipdb --config '<your_config>' <table_name>