IPinfo Google SecOps Integration

Google Security Operations (SecOps), formerly known as Chronicle, is Google Cloud's SIEM/SOAR platform. The IPinfo integration for SecOps SOAR adds enrichment actions you can drop into your playbooks to enrich ADDRESS and HOSTNAME entities straight from your case data.

The integration is maintained in Google's open source chronicle/content-hub repository and distributed through the SecOps Marketplace. Google also has its own reference page for it at docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/ipinfo. This guide covers the same integration from the IPinfo side: what each action does, how to configure it against your IPinfo plan, and how to pick the right dataset bundle.

Features

• Enriches ADDRESS entities with geolocation, ASN, privacy, hosting, mobile, and abuse data.
• Enriches HOSTNAME entities with hosted-domain data.
• Supports IPinfo's Lite, Core, Plus, and Max bundles, in addition to the original Legacy per-IP response shape, through a single configurable action parameter.
• Uses the /batch endpoint for the Lite/Core/Plus/Max bundles, so a playbook step enriching many entities makes far fewer outbound calls than one request per IP.

Prerequisites

• A Google SecOps SOAR license with permission to install Marketplace integrations.
• An IPinfo account and API token.
• Your IPinfo plan needs to include whichever bundle(s) you plan to select in the Get IP Information action (see Choosing a bundle). A free-tier token only has access to Lite.

Installing the Integration

1. In the Google SecOps SOAR console, go to Marketplace.
2. Search for IPInfo and open the integration details pane.
3. Click Install, then configure an instance (see Configuration below).

Since integration version 7.0, the source is public, so you can also review or fork it directly from GitHub before installing.

Configuration

When you add an IPInfo integration instance, you'll be asked for:

API Root only affects Legacy-shaped calls. The Lite/Core/Plus/Max bundles in Get IP Information call fixed IPinfo /batch URLs (https://api.ipinfo.io/batch and https://api.ipinfo.io/batch/lite) no matter what you set for API Root. That field only matters if you keep the action on Legacy.

Every action authenticates with an Authorization: Bearer <Token> header, the same Bearer token auth supported across all IPinfo API hosts.

Actions

Ping

Validates that the configured Token and API Root can reach IPinfo. Run this after installing the integration or rotating your token, so you can confirm it's configured correctly before using it in a live playbook.

Get IP Information

Enriches every ADDRESS entity in scope with IP data. Takes one parameter:

• Legacy: queries the per-IP endpoint (GET {API Root}/{ip}) once per entity. This is the original behavior of the action, kept as the default so existing playbooks don't change behavior on upgrade.
• Lite / Core / Plus / Max: queries IPinfo's /batch endpoint instead, chunking entities into groups of up to 1,000 IPs per request. If a chunk fails outright (network error, non-2xx response), only the entities in that chunk are marked failed and the other chunks still succeed. IPs that IPinfo couldn't resolve inside an otherwise-successful chunk get reported individually, without failing the rest of that chunk.

Successfully enriched entities have their properties updated (prefixed IPInfo_) and get attached to the result as a per-entity table. The full raw payload for every enriched entity is also available as the action's JSON result.

Below are real, live responses for the same IP (104.28.214.16, a Cloudflare WARP exit node) across every bundle, so you can see exactly how the shape changes. Each one shows the request the integration makes and the JSON result you'd get back for that entity.

{
  "EntityResult": {
    "ip": "104.28.214.16",
    "asn": {
      "asn": "AS13335",
      "name": "Cloudflare, Inc.",
      "domain": "cloudflare.com"
    },
    "as_name": "Cloudflare, Inc.",
    "as_domain": "cloudflare.com",
    "country_code": "GB",
    "country": "United Kingdom",
    "continent_code": "EU",
    "continent": "Europe"
  },
  "Entity": "104.28.214.16"
}

Get Domain Information

Enriches every HOSTNAME entity in scope by querying IPinfo's Hosted Domains API for the entity's domain. This is an Enterprise/Custom API feature, so it will fail with a plan/permission error on tokens that don't have Hosted Domains access.

Sample JSON result:

{
  "EntityResult": {
    "domain": "domain-example.net",
    "ip": "1.1.1.1",
    "range": "1.1.1.1/12",
    "total": 939,
    "domains": ["domain-example.net", "domain-example.com", "..."],
    "asn": "AS7922"
  },
  "Entity": "domain-example.net"
}

Choosing a bundle

The IPinfo Bundle parameter on Get IP Information picks which of IPinfo's dataset tiers to query. Each bundle is gated by your token's plan, so selecting one your token doesn't have access to will fail the enrichment for every entity in that batch.

See the full IPinfo API schema for the exact field-by-field availability across bundles.

Using the actions in a playbook

Both enrichment actions read from siemplify.target_entities, so you just add them to a playbook step scoped to the entity type you want to enrich (ADDRESS for Get IP Information, HOSTNAME for Get Domain Information). No additional wiring is needed to select which entities get enriched.

Troubleshooting

Where to get help

Release history for the integration (bundle support, Python version upgrades, and so on) is tracked in the content-hub repo and on Google's integration page.