Need For Speed' Bulk IP Reputation Workflow

I have a workflow that is simple - send a list of IPs to ICON and collect data for them such as country and abuse reports but it is incredibly slow because it has to loop through each ip.

any speed suggestions?

I think the whois and abuseip plugins are blacklisting me now after hammering them. There is an error on every response.

1 Like

@hayden_redd do you happen to have the error handy from both of those plugins when you think you are getting blacklisted? (making sure there is no environment/confidential info included)

rapid7/WHOIS:3.0.3. Step name: address
Warning: No WHOIS registry detected from stdout, defaulting to ARIN…
Info: Using registry: arin
An error occurred during plugin execution!

Error: Request did not return any data. Please check provided address and try again.
Traceback (most recent call last):
File “/usr/local/lib/python3.8/site-packages/insightconnect_plugin_runtime-4.2.0-py3.8.egg/insightconnect_plugin_runtime/plugin.py”, line 326, in handle_step
output = self.start_step(
File “/usr/local/lib/python3.8/site-packages/insightconnect_plugin_runtime-4.2.0-py3.8.egg/insightconnect_plugin_runtime/plugin.py”, line 476, in start_step
output = func(params)
File “/usr/local/lib/python3.8/site-packages/whois_rapid7_plugin-3.0.3-py3.8.egg/komand_whois/actions/address/action.py”, line 91, in run
raise PluginException(
insightconnect_plugin_runtime.exceptions.PluginException: An error occurred during plugin execution!

Error: Request did not return any data. Please check provided address and try again.

AND

Connect: Connecting to https://api.abuseipdb.com/api/v2
rapid7/AbuseIPDB:5.0.6. Step name: check_ip
An error occurred during plugin execution!

Received an error response from AbuseIPDB.
Traceback (most recent call last):
File “/usr/local/lib/python3.8/site-packages/insightconnect_plugin_runtime-4.2.0-py3.8.egg/insightconnect_plugin_runtime/plugin.py”, line 326, in handle_step
output = self.start_step(
File “/usr/local/lib/python3.8/site-packages/insightconnect_plugin_runtime-4.2.0-py3.8.egg/insightconnect_plugin_runtime/plugin.py”, line 476, in start_step
output = func(params)
File “/usr/local/lib/python3.8/site-packages/abuseipdb_rapid7_plugin-5.0.6-py3.8.egg/komand_abuseipdb/actions/check_ip/action.py”, line 43, in run
json_ = helper.get_json(r)
File “/usr/local/lib/python3.8/site-packages/abuseipdb_rapid7_plugin-5.0.6-py3.8.egg/komand_abuseipdb/util/helper.py”, line 11, in get_json
raise PluginException(cause=‘Received an error response from AbuseIPDB.’,
insightconnect_plugin_runtime.exceptions.PluginException: An error occurred during plugin execution!

Received an error response from AbuseIPDB.