> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aegister.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Recupera l'intelligence IP consolidata
> Recupera la Threat Intelligence consolidata per un IPv4: punteggio, segnalazioni, fonti, geolocalizzazione, cronologia, ID MITRE ATT&CK, indicatori STIX e contromisure consigliate.
Fornito da OneFirewall
## OpenAPI
````yaml get /api/v1/perimeter-protection/threat-intelligence/ip/{ip}/intel
openapi: 3.1.0
info:
title: Aegister API
version: 1.0.5
servers: []
security: []
paths:
/api/v1/perimeter-protection/threat-intelligence/ip/{ip}/intel:
get:
tags:
- perimeter-protection
summary: Get IP intelligence
description: >-
Retrieves consolidated Threat Intelligence for an IPv4.
Provided by OneFirewall
operationId: perimeter_protection_threat_intelligence_ip_intel_retrieve
parameters:
- in: path
name: ip
schema:
type: string
required: true
responses:
'200':
content:
application/json:
schema:
type: object
additionalProperties: {}
examples:
ExampleThreatintelligenceIpIntel:
value:
error: 0
messages: []
data:
type: ip
request: XXX.YYY.WWW.ZZZ
timestamp: 1783085207
timestamp_readable: '2026-07-03T13:26:47.322Z'
request_id: UoqBNvjvOYj9
body:
gid: OFA-RULE-GID-XXXXXXXXXXXX
ip: XXX.YYY.WWW.ZZZ
ts: 1783084960
entry_ts: 1716963374
is_network: false
score: 589
start_score: 589
reports: 73777
info:
members: 27
events: 213
sources:
- blocklist.de
- dataplane.org sshpwauth
notes:
- Invalid SSH Login
- SSH Login
events: []
traffic: []
ip_info:
as_domain: sample.com
as_name: Sample LLC
asn: ASXXXXX
continent: Europe
continent_code: EU
country: The Netherlands
country_code: NL
history:
- ip: XXX.YYY.WWW.ZZZ
ts: 1775257202
score: 691
members: 27
events: 160
sectors:
- Financial Service IT
- Cloud Provider IT
countries:
- IT
- GB
- NL
reports:
- Brute Force on SSH Service
- Port Scan Detected
members:
- >-
OneFirewall Alliance LTD - Global Cyber Security
Platform
mitre_ids:
- T1110
- T1046
- T1595
stix:
- id: indicator--566873ba-09af-4bff-97eb-96ee17fc24d8
type: indicator
pattern: '[ipv4-addr:value = ''XXX.YYY.WWW.ZZZ'']'
indicator_types:
- malicious-activity
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: credential-access
spec_version: '2.1'
valid_from: '2026-01-20T01:52:33.000Z'
intel:
- type: course-of-action
name: Brute Force Mitigation
description: >-
Set account lockout policies after a certain number
of failed login attempts...
external_id: T1110
summary: Threatintelligence ip intel
description: Example consolidated threat intelligence for an IPv4
description: ''
'400':
content:
application/json:
schema:
type: object
properties:
error:
type: integer
description: |-
Any value different from 0 indicates an error.
More details can be found in `messages`.
minimum: 0
maximum: 0
examples:
- 1
messages:
type: array
description: >-
If `error` is `1`, contains zero or more details on the
error.
examples:
- - Malformed data structure
description: ''
'401':
content:
application/json:
schema:
type: object
properties:
error:
type: integer
description: |-
Any value different from 0 indicates an error.
More details can be found in `messages`.
minimum: 0
maximum: 0
examples:
- 1
messages:
type: array
description: >-
If `error` is `1`, contains zero or more details on the
error.
examples:
- - 9153
description: ''
security:
- ApiKeyAuth: []
- ApiKeyQueryParam: []
components:
securitySchemes:
ApiKeyAuth:
type: apiKey
in: header
name: X-Aegister-Token
ApiKeyQueryParam:
type: apiKey
in: query
name: X-Aegister-Token
````