IPinfo
Panther has partnered with IPinfo, a trusted source for IP address data, to provide integrated IP related enrichment to Panther customers. The IPinfo integration is an Enrichment Provider, also known as a Panther-managed Lookup Table.
Use IPinfo enrichment data in your Panther detections to reduce false-positive alerts by:
- Cross-examining the current IP geolocation details of suspicious users to discover irregularities in profile information and blocking them.
- Preemptively identifying and blocking traffic from high-risk locations or networks before they make it to you.
- Accurately and reliably discovering other entities related to the target that may pose a security risk.
The IPinfo data sets are available to all Panther accounts at no additional cost and are disabled by default.
Similar to GreyNoise, alert events are automatically enriched with IPinfo data within the
p_enrichment
field in JSON events.IPinfo datasets are stored as Panther-managed Lookup Tables in bulk, so there is no need to make API calls to leverage this enrichment in your detection logic or alerts.
The data from IPinfo is updated once a day.
There are three data types available from IPinfo that add contextual information about IP addresses:
If you are using a CI/CD workflow, please see the CI/CD Users section below to learn about additional considerations.
To enable Analyst roles to view and manage IPinfo packages in the Panther Console, they will need to be assigned the View Lookups and Manage Lookups permissions.
To enable IPinfo Panther-managed Lookup Tables:
- 1.Log in to your Panther Console.
- 2.From the left sidebar menu, click Build > Packs.
- On this page, you can see built-in packs available for IPinfo.
- 3.On the right side of the IPInfo tile you wish to enable, click the toggle to enable the pack.
- 4.Click Continue in the dialog that appears.
- If you'd like to make additional changes through CI/CD with the Panther Analysis Tool (PAT), please contact your Panther representative for more information.
- 5.To verify if the IPinfo data sets are enabled, from the left sidebar menu, click Configure > Enrichment Providers.
- On this page, you can see Panther-managed enrichment sources (such as IPinfo). You can also see whether the sources are currently enabled or disabled and when a source’s data was last refreshed.
- The six IPinfo source tables are visible, as well as the time they were last refreshed. Disabled data sets will not be refreshed.
- The
ipinfo_asn
,ipinfo_location
andipinfo_privacy
tables are used for real-time lookups in the detection engine. - The
ipinfo_asn_datalake
,ipinfo_location_datalake
andipinfo_privacy_datalake
tables are used for querying and joining to IPinfo data in the datalake.