Liberty91LTD ip-investigation
Investigate an IP address end-to-end. Chain multiple lookup-* skills, consolidate results, prioritize follow-up IOCs, and return a rated investigation summary. You invoke skills — you don't call APIs directly.
This skill invokes: /lookup-liberty91 (first-party — run first), /lookup-virustotal, /lookup-shodan, /lookup-abuseipdb, /lookup-greynoise, /lookup-otx, optionally /lookup-censys, optionally /lookup-reversinglabs (network threat-intel + sample fan-out), optionally /lookup-crowdstrike (IOC reputation + actor/malware links), optionally /lookup-misp and/or /lookup-opencti (internal correlation), optionally /lookup-sentinel (exposure check in your own telemetry), then /source-assessment, /tlp-guide, /confidence-levels.
When to invoke
- User asks to investigate, check, or enrich an IP
- User pastes an IP and asks "what is this?" / "is this malicious?"
- Another skill hands off an IP indicator for follow-up
- IOC triage pipeline
Inputs
indicator: <IPv4 or IPv6 address>
context: <optional — why is the user asking? where did this come from?>
tlp_ceiling: <optional — CLEAR/GREEN/AMBER/AMBER+STRICT/RED, default AMBER>
Procedure
1. Validate + triage (before spending API quota)
- Reject RFC 1918 / loopback / link-local / documentation-range (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24) unless the user specifically asks — these are not public infrastructure and enrichment is wasted
- Check if the IP is already in
data/iocs/— if yes, load existing enrichment and note age - Decide whether to include Censys (skip by default due to 250/month quota)
2. Parallel lookups
Invoke in parallel (agents should batch these calls):
/lookup-liberty91 ioc-lookup <value> # FIRST-PARTY, if $LIBERTY91_API_KEY is set — run first: is this already in your own platform, with what verdict, confidence and TLP?
/lookup-greynoise ip <value> # FAST — filter out noise early
/lookup-virustotal ip <value> # reputation aggregate
/lookup-abuseipdb ip <value> # abuse reports
/lookup-shodan ip <value> # infrastructure fingerprint
/lookup-otx ip <value> # community pulses
Add to the same parallel batch if credentials are configured:
/lookup-reversinglabs ip <value> # if $REVERSINGLABS_USER is set. Network reputation from RL's malware-analysis corpus — files seen contacting this IP, RL classification. One API call, no pivot fan-out.
/lookup-crowdstrike indicator <value> # if $CROWDSTRIKE_CLIENT_ID is set. Falcon Intel view — malicious confidence, linked actors + malware families, report refs. One API call.
/lookup-misp search-attributes --value <value> # if $MISP_URL + $MISP_KEY are set. Internal correlation against your own catalogued events.
/lookup-opencti lookup <value> # if $OPENCTI_URL + $OPENCTI_TOKEN are set. Internal correlation against your OpenCTI knowledge base (observables + indicators in one call).
Optionally add (escalation — separate API budget):
/lookup-censys ip <value> # ONLY if Shodan insufficient + quota available
/lookup-reversinglabs ip <value> --pivot files,domains,urls --max-results 25
# only when you want sample fan-out from the IP — each --pivot entry is a separate API call
3. Short-circuit on noise
If GreyNoise returns noise: true and classification: benign, AND AbuseIPDB confidence <10, this is likely mass-scanning background noise. Summarize briefly and stop — no need to burn full analysis on it. Note: noise: true with classification: malicious is still interesting (opportunistic attacker infrastructure).
4. Consolidate
Build a unified view:
indicator: <ip>
type: ipv4 | ipv6
consolidated_verdict: malicious | suspicious | clean | benign-noise | unknown
detection_signals:
- source: virustotal
detection_ratio: <X/Y>
verdict: <...>
- source: abuseipdb
abuse_confidence: <0-100>
recent_reports: <count>
- source: greynoise
noise: <bool>
riot: <bool>
classification: <...>
infrastructure:
asn: <...>
org: <...>
country: <...>
open_ports: <[...] from shodan>
services: <top 5 from shodan>
vulnerabilities: <CVE list>
certificates: <present/absent>
community_context:
pulse_count: <from otx>
key_actors_attributed: <any pulse authors or malware families?>
pivot_candidates:
- type: domain
value: <hostname from shodan/vt>
reason: <"resolves to this IP", "shares cert", etc.>
- type: hash
value: <communicating_files from vt>
reason: <...>
5. Prioritize follow-up IOCs
Rank pivot candidates by investigative value:
- Certificate matches (highest — strong infrastructure link)
- Communicating files (medium-high — active C2 signal)
- Passive DNS resolutions (medium — historical association)
- Recent WHOIS/registration overlaps (medium)
- Generic ASN/org neighbors (low)
Return the top 3-5 candidates to the invoking skill or orchestrator for optional deep-dive via /domain-investigation, /hash-investigation, or /indicator-pivoting.
5b. Exposure check — was it seen in OUR environment? (if Sentinel is configured)
If $SENTINEL_WORKSPACE_ID + app credentials are set and the verdict is malicious or suspicious, chain /lookup-sentinel to sweep the IP across the workspace's available tables (DeviceNetworkEvents, CommonSecurityLog, SigninLogs, … — that skill discovers what exists before querying). Report hits with first/last seen and affected devices/accounts; report a miss as "not observed in collected telemetry over ", never "not compromised". Skip for benign-noise verdicts.
6. Apply rigor
Before returning, chain:
/source-assessment— rate each lookup result (defaults in each lookup skill's frontmatter)/tlp-guide— mark the investigation output (default AMBER)/confidence-levels— score the consolidated verdict (MISP 0-100)
7. Return
title: "IP Investigation: <ip>"
tlp: AMBER
confidence: <0-100>
summary: <2-3 sentences>
verdict: <...>
detection_signals: <...>
infrastructure: <...>
community_context: <...>
pivot_candidates: <top 3-5>
source_ratings:
virustotal: B2
shodan: B2
...
investigation_date: <ISO8601>
recommended_next_steps:
- <e.g., "pivot on domain X via /domain-investigation">
When to stop
- GreyNoise benign-noise short-circuit (step 3)
- All lookups returned "not found" → report no signal; don't escalate
- Clear malicious verdict with high confidence → return; leave deeper pivots to the user
Rate-limit awareness
Respect the lookup skills' own rate limits. Parallelizing 5 lookups on one IP = 5 API calls total, well within all free tiers. Don't loop over a list without throttling — use /ioc-enrichment-workflow for bulk.
Related skills
/domain-investigation,/hash-investigation,/url-investigation— sibling investigation skills/indicator-pivoting— deeper graph traversal from a starting IOC/ioc-enrichment-workflow— bulk IOC list enrichment/threat-actor-profiling— if the IP is attributed to a known actor, consider profiling/cti-orchestrator— typically the caller