Graylog AbuseIPDB Lookup by Thomas

For SOC analysts investigating in Graylog. The extension interface is in French.

On the Graylog sites you authorize, it finds the IP columns (every column holding only IPs, or only the ones you choose) and adds a colour-coded badge next to each IP address with its AbuseIPDB abuse confidence score, city and country. IPs inside free text are left alone.

Features

• Per-IP badge in aggregation widgets, message tables and the message detail view: score, city, country, TOR flag.
• Hover tooltip: number of reports, ISP, ASN, domain, usage type, whitelist status, last reported date, link to AbuseIPDB.
• Alerts: rows above a score threshold are highlighted, and the number of risky IPs is shown on the toolbar icon.
• Toolbar popup: page IPs sorted by risk, manual lookup, copy IPs and CSV export.
• Context menu: select an IP on any page, right-click, “Vérifier sur AbuseIPDB”.
• Automatic detection of IP columns (default), with excluded fields; or only the fields you choose; or every IP, including inside text (option).
• Quota-friendly: local cache (24 h by default), request de-duplication and throttling, quota reserve kept for manual lookups, usage and remaining-quota tracking.
• IPv4 and IPv6. Private and reserved addresses (RFC 1918, CGNAT, loopback, link-local, ULA, multicast, documentation) are never sent.

Requirements

An AbuseIPDB API key (free tier: 1,000 requests per day), entered in the extension's Settings tab, then access to your Graylog site (“Activer sur ce site” button in the popup).

Privacy

The extension only reads the Graylog sites you authorize. Only public IPs from the analyzed fields are sent, and only to AbuseIPDB (reputation) and ipwho.is (geolocation). No telemetry, no analytics. The API key and cache stay in the browser.

Source code (MIT license): https://github.com/eldriic/graylog-abuseipdb

Independent project, not affiliated with Graylog, Inc. or AbuseIPDB.