---
title: AbuseIPDB connector
description: The AbuseIPDB connector communicates with the AbuseIPDB API to check IP reputation and report abusive IPs. You can create connectors in Stack Management...
url: https://docs-v3-preview.elastic.dev/elastic/kibana/pull/288525/reference/connectors-kibana/abuseipdb-action-type
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview since 9.3
---

# AbuseIPDB connector
The AbuseIPDB connector communicates with the AbuseIPDB API to check IP reputation and report abusive IPs.

## Create connectors in Kibana

You can create connectors in **Stack Management > Connectors**. For example:

### Connector configuration

AbuseIPDB connectors have the following configuration properties:
<definitions>
  <definition term="API Key">
    The AbuseIPDB API key for authentication.
  </definition>
</definitions>


## Test connectors

You can test connectors as you're creating or editing the connector in Kibana.
The AbuseIPDB connector has the following actions:
<definitions>
  <definition term="Check IP">
    Get details about an IP address including abuse confidence score and total reports. Unknown or clean addresses return score `0` as data (the step does not fail).
    - **IP Address** (required): IPv4 address to check.
    - <applies-to>Elastic Cloud Serverless: Generally available</applies-to> <applies-to>Elastic Stack: Planned</applies-to> IPv6 addresses are also accepted.
    - **Max Age in Days** (optional): Maximum age of reports in days (1-365, default 90).
    - <applies-to>Elastic Cloud Serverless: Generally available</applies-to> <applies-to>Elastic Stack: Planned</applies-to> Output includes the last reported date when available.
  </definition>
  <definition term="Report IP">
    Report an IP address to AbuseIPDB.
    - **IP** (required): IPv4 address to report.
    - <applies-to>Elastic Cloud Serverless: Generally available</applies-to> <applies-to>Elastic Stack: Planned</applies-to> IPv6 addresses are also accepted.
    - **Categories** (required): Array of abuse category IDs (1-30 entries).
    - **Comment** (optional): Additional details about the observed activity (max 1024 characters).
  </definition>
  <definition term="Get IP Info">
    Get detailed (verbose) information about an IP address including geolocation, allowlist status (`isWhitelisted`), and domain.
    - **IP Address** (required): IPv4 address to look up.
    - <applies-to>Elastic Cloud Serverless: Generally available</applies-to> <applies-to>Elastic Stack: Planned</applies-to> IPv6 addresses are also accepted.
    - <applies-to>Elastic Cloud Serverless: Generally available</applies-to> <applies-to>Elastic Stack: Planned</applies-to> **Max Age in Days** (optional): Maximum age of reports in days (1-365, default 90). Same default as Check IP so report counts stay comparable.
    - <applies-to>Elastic Cloud Serverless: Generally available</applies-to> <applies-to>Elastic Stack: Planned</applies-to> Output includes the last reported date when available.
  </definition>
  <definition term="Bulk Check">
    Check multiple IPs in a network range using CIDR notation.
    - **Network** (required): Network in CIDR notation.
    - **Max Age in Days** (optional): Maximum age of reports in days (1-365, default 30).
  </definition>
  <definition term="Get Blacklist Elastic Cloud Serverless: Generally available Elastic Stack: Planned">
    Fetch the most-reported IPs from the AbuseIPDB `/blacklist` endpoint for blocklist generation or enrichment. Prefer a high confidence minimum (75-100) for deny-list use.
    - **Confidence Minimum** (optional): Minimum abuse confidence score (25-100, default 100).
    - **Limit** (optional): Maximum number of IPs to return (1-10000, default 10). Defaults low so workflow execution outputs stay small; raise explicitly for larger feeds. AbuseIPDB may truncate further based on subscription tier.
  </definition>
</definitions>


## Connector networking configuration

Use the [Action configuration settings](/elastic/kibana/pull/288525/reference/configuration-reference/alerting-settings#action-settings) to customize connector networking configurations, such as proxies, certificates, or TLS settings. You can set configurations that apply to all your connectors or use `xpack.actions.customHostSettings` to set per-host configurations.

## Get API credentials

To use the AbuseIPDB connector, you need an API key:
1. Go to [AbuseIPDB](https://www.abuseipdb.com/).
2. Sign up for an account or log in.
3. Navigate to your [API page](https://www.abuseipdb.com/api) in your account settings.
4. Generate an API key with appropriate permissions.
5. Copy the API key to configure the connector.