--- title: "Lookup a IP Address entity by id" method: GET path: "/ip/{id}" tags: ["IP"] --- # Lookup a IP Address entity by id `GET /ip/{id}` Get full IP enrichment including risk scoring, geolocation, DNS, open ports, and threat actor relationships. ## Path parameters - `id` string, required ## Query parameters - `fields` string - `metadata` unknown - `taggedText` boolean - `comment` string ## Response `200` Result of operation - IpLookupResponse — IP address enrichment response. The response includes only the fields specified in the `fields` query parameter. All properties under `data` are optional because they appear only when requested. - `data` object, required — IP address entity data with requested enrichment fields. - `entity` Entity - `id` string, required — Entity id - `provided_id` string, required — Entity id provided in request - `type` string, required — Entity type - `name` string, required — Entity name - `risk` RiskData — Risk assessment data with score, triggered rules, and supporting evidence. Included when the fields parameter contains 'risk'. Not available for Malware entities. - `score` integer — Numeric risk score from 0 (no risk) to 99 (critical risk). - `criticality` integer — Numeric criticality level (0=None, 1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious). - `criticalityLabel` 'None' | 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High' — Risk criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High. - `riskString` string — Triggered vs total risk rules (e.g., '16/81'). - `rules` integer — Number of currently triggered risk rules. - `riskSummary` string — Human-readable risk summary (e.g., '16 of 81 Risk Rules currently observed.'). - `evidenceDetails` EvidenceDetail[] — Evidence for each triggered risk rule. - `rule` string — Risk rule name that was triggered. - `criticality` integer — Numeric criticality level of the rule (1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious). - `criticalityLabel` 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High' — Human-readable criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High. - `evidenceString` string — Human-readable evidence summary with source references and sighting details. - `mitigationString` string — Recommended mitigation or remediation guidance for this risk rule. - `timestamp` string, date-time — ISO 8601 timestamp of when the evidence was observed. - `aiInsights` AiInsights — AI-generated threat analysis. Included when the fields parameter contains 'aiInsights'. Text is null when fewer than 3 risk rules are triggered. - `text` string, nullable — AI-generated threat analysis paragraph. Null when fewer than 3 risk rules are triggered. - `numberOfReferences` integer — Number of intelligence references used to generate the insight. - `comment` string, nullable — Explanatory comment (e.g., why insights are not available). - `links` LinksData — Validated intelligence relationships to threat actors, malware, MITRE ATT&CK techniques, and other entities. Included when the fields parameter contains 'links'. Unlike relatedEntities, these are editorially validated relationships. - `hits` object[] — Intelligence hits containing sectioned relationship data. - `start_date` string — Start date of the intelligence hit time window. - `stop_date` string — End date of the intelligence hit time window. - `total_count` integer — Total number of entity relationships in this hit. - `sample_reference_ids` string[] — Sample reference IDs supporting this hit. - `counts` object[] — Breakdown counts by entity type. - `count` integer — Number of entities. - `type` object — Entity type metadata. - `id` string - `name` string - `type` string - `event_count` integer — Number of events in this hit. - `sections` object[] — Relationship sections grouped by category. - `section_id` object — Section identifier. - `id` string — Section ID. - `name` string — Section category name (e.g., 'Actors, Tools & TTPs', 'Victims & Exploit Targets', 'Indicators & Detection Rules'). - `type` string — Section type (e.g., 'Category'). - `total_count` integer — Total entities in this section. - `lists` object[] — Entity lists within this section, grouped by entity type. - `entities` LinksEntity[] - … - `total_count` integer — Total entities in this list. - `type` object — Entity type metadata for this list. - … - `method_aggregates` object[] — Aggregated counts of linked entities by analysis method. - `count` integer — Number of links found by this method. - `type` string — Analysis method type. - `counts` object[] — Summary counts of linked entities by type. - `count` integer — Number of linked entities of this type. - `type` object — Entity type metadata. - `id` string - `name` string - `type` string - `description` string - `intelCard` string, uri — URL to the Recorded Future Intelligence Card for this IP. - `location` object — Geolocation and network ownership data for the IP address. Included when the fields parameter contains 'location'. - `organization` string — Hosting organization or ISP name. - `cidr` object — CIDR block containing this IP. - `id` string — CIDR entity ID. - `name` string — CIDR notation (e.g., '64.227.176.0/20'). - `type` string — Entity type. - `location` object — Geographic location. - `continent` string - `country` string - `city` string - `asn` union — Autonomous System Number. May be a simple string (e.g., 'AS14061') or an entity object with id/name/type. - string — ASN string (e.g., 'AS14061'). - object - `id` string — ASN entity ID (e.g., 'asn:AS14061'). - `name` string — ASN display name (e.g., 'AS14061'). - `type` string — Entity type. - `dnsPortCert` object — DNS records, open ports, and TLS certificates associated with the IP. Included when the fields parameter contains 'dnsPortCert'. - `certificates` object[] — TLS/SSL certificates observed on this IP. - `dns` object — DNS resolution data. - `forwardDns` object[] — Domains resolving to this IP. - `reverseDns` object[] — Reverse DNS (PTR) records for this IP. - `ports` object[] — Open ports observed on this IP. - `port` integer — Port number. - `protocol` string — Protocol (e.g., 'tcp', 'udp'). - `name` string — Service name (e.g., 'ssh', 'http'). - `product` string — Software product name. - `version` string — Software version. - `extraInfo` string — Additional service information. - `scanner` object — Scanning behavior analysis for the IP. Included when the fields parameter contains 'scanner'. - `verdict` string — Scanning verdict (e.g., 'scanner', 'not_scanner'). - `lastSeen` string, date-time — Last observed scanning activity. - `scannerCountry` string — Country of origin for scanning activity. - `scannedIpCountries` string[] — Countries of IPs targeted by this scanner. - `globalScanner` boolean — Whether this IP is classified as a global scanner. - `tags` object — Scanner classification tags. - `entity` object[] — Entity-level tags. - `rdns` string[] — Reverse DNS hostnames for this IP. - `webRequests` object[] — Observed web requests made by this scanner. - `userAgents` string[] — User agent strings observed from this scanner. - `ports` object — Ports scanned by this IP, grouped by protocol. - `tcp` integer[] — TCP ports scanned. - `udp` integer[] — UDP ports scanned. - `riskyCIDRIPs` object[] — Other risky IPs in the same CIDR block. Included when the fields parameter contains 'riskyCIDRIPs'. - `score` integer — Risk score of the related IP. - `ip` object - `id` string — IP entity ID. - `name` string — IP address string. - `type` string — Entity type (e.g., 'IpAddress'). - `timestamps` Timestamps — First and last seen timestamps for the entity in Recorded Future data. - `firstSeen` string, date-time — ISO 8601 timestamp of first observation. - `lastSeen` string, date-time — ISO 8601 timestamp of most recent observation. - `sightings` Sighting[] — Intelligence sightings from various source types. Each item's `type` field indicates the category (recentDarkWeb, recentPaste, recentInfoSec, recentSocialMedia, mostRecent, first). Included when the fields parameter contains 'sightings'. - `source` string — Source name (e.g., 'GitHub', 'PasteBin', 'Turk Hack Team Forum'). - `url` string, uri — URL to the original source. - `published` string, date-time — ISO 8601 timestamp of when the sighting was published. - `fragment` string — Text fragment from the source mentioning the entity. - `title` string — Title of the source document. - `type` 'recentDarkWeb' | 'recentPaste' | 'recentInfoSec' | 'recentSocialMedia' | 'mostRecent' | 'first' — Sighting category. - `threatLists` ThreatList[] — Curated threat list memberships. - `id` string — Threat list entity ID. - `name` string — Threat list name. - `type` string — Entity type (e.g., 'EntityList'). - `description` string — Description of the threat list and its purpose. - `riskMapping` RiskMapping[] — Risk rule to MITRE ATT&CK mapping. - `rule` string — Risk rule name. - `categories` object[] — Framework categories this rule maps to. - `framework` string — Framework name (e.g., 'MITRE ATT&CK'). - `name` string — Category or technique name. - `analystNotes` object[] — Insikt Group analyst notes. Can be very large (67KB+). - `relatedEntities` object[] — Co-occurrence relationships (not editorially validated). Can be 19-29KB. - `counts` object[] — Daily reference count time-series. - `metrics` object[] — Flat metric counters. - `metadata` object — Request metadata. Included when the metadata query parameter is set to true. --- [API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)