NagentArtefacts
Dev & Technology
Enterprise and White Glove
Company
AbuseIPDB connects to a Nagent workspace with an API key. Once it is connected, agents can call 6 AbuseIPDB actions, such as "Get Abuse Reports", "Retrieve IP Blacklist" and "Bulk Report". Nothing is enabled on connect: each action is allowed one at a time, and an action with side effects runs or waits for a person according to the agent's level.
Every operation an agent can call against AbuseIPDB, with input parameters and output schema.
ABUSELPDB_BLACKLISTRetrieves a list of the most reported malicious IP addresses from AbuseIPDB's database. Use this tool to build dynamic blocklists, threat intelligence feeds, or firewall rules. The blacklist is updated hourly and contains IPs with high abuse confidence scores. Free accounts receive up to 10,000 IPs. Paid subscriptions unlock filtering options (confidenceMinimum, country filters) and higher limits (up to 500,000 IPs).
Input parameters
Maximum number of IP addresses to return. Free accounts are limited to 10,000 IPs. Paid plans allow up to 100,000 or 500,000 depending on tier.
Filter by IP version: 4 for IPv4 addresses only, 6 for IPv6 addresses only. Omit to include both.
Comma-separated ISO 3166-1 alpha-2 country codes to include (e.g., 'US,CA,MX'). Only IPs from these countries are returned. Requires a paid subscription.
Comma-separated ISO 3166-1 alpha-2 country codes to exclude (e.g., 'CN,RU'). IPs from these countries are filtered out. Requires a paid subscription.
Minimum abuse confidence score (25-100) to filter reported IPs. Only IPs with scores at or above this threshold are returned. Requires a paid subscription.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
ABUSELPDB_BULK_REPORTSubmit multiple IP abuse reports to AbuseIPDB in bulk via CSV upload. Use this when you need to report many malicious IPs at once instead of one-by-one. Returns the count of successfully saved reports and details about any invalid entries.
Input parameters
CSV content containing IP abuse reports. Must include headers: IP, Categories, ReportDate, Comment. IP: Valid IPv4 or IPv6 address. Categories: Comma-separated category IDs (e.g., '18,22' for SSH abuse). Common categories: 3=Fraud Orders, 4=DDoS Attack, 5=FTP Brute-Force, 6=Ping of Death, 7=Phishing, 10=Email Spam, 11=Blog Spam, 14=Port Scan, 18=Brute-Force, 19=Bad Web Bot, 21=Web Spam, 22=SSH, 23=IoT Targeted. ReportDate: ISO 8601 format recommended (e.g., '2024-01-15T10:00:00-05:00'). Comment: Description of the attack (max 1024 characters). Limit: 10,000 rows max, 8MB max file size.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
ABUSELPDB_CHECK_BLOCKTool to check the reputation of all IP addresses in a CIDR range. Use when you need aggregated abuse data for a network block.
Input parameters
IPv4 network in CIDR notation (e.g., '192.168.1.0/24'). Free plans only support /24 networks; paid plans may use wider ranges up to /16.
Number of days back to include abuse reports (1-365). Free plans are limited to 30 days max. Defaults to 30.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
ABUSELPDB_CHECK_IPTool to check the reputation of an IP address. Use when you need to determine if an IP address has been reported for abusive activity within a specified look-back period. Example: CheckIp(ipAddress='8.8.8.8', maxAgeInDays=90).
Input parameters
When true, includes detailed abuse reports with comments, categories, and reporter information.
IP address (IPv4 or IPv6) to check for abuse reports.
Look-back period for reports in days (default=30, max=365).
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
ABUSELPDB_CLEAR_ADDRESSTool to remove all reports associated with a specific IP address. Use when you need to purge your own abuse records after verifying control of the IP.
Input parameters
A valid IPv4 or IPv6 address whose reports will be removed.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
ABUSELPDB_GET_REPORTSRetrieve abuse reports for a specific IP address from AbuseIPDB. Use this tool to view the history of abuse complaints filed against an IP address, including the reported abuse categories, reporter details, and timestamps. Supports pagination for IPs with many reports.
Input parameters
Page number for pagination (1-indexed). Default is 1.
Number of reports to return per page (1-100). Default is 25.
IPv4 or IPv6 address to retrieve reports for
Only return reports from the last N days (1-365). Default is 30 days.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
Agents can call 6 AbuseIPDB actions on Nagent, including "Get Abuse Reports", "Retrieve IP Blacklist" and "Bulk Report". Get Abuse Reports: Retrieve abuse reports for a specific IP address from AbuseIPDB. Each action is listed on this page with its input parameters and its output.
AbuseIPDB connects with an API key, under your workspace's own connection. Nothing is enabled on connect: each action is allowed one at a time and can be scoped to the agents that need it.
Get Abuse Reports takes 1 required input: ipAddress. It also takes 3 optional inputs: page, perPage and maxAgeInDays. It returns data, error and successful.