# Automatic IP reputation check

**URL:** <https://discuss.elastic.co/t/automatic-ip-reputation-check/265215>\
**Category:** Elasticsearch\
**Created:** [February 23, 2021, 3:08pm UTC](https://discuss.elastic.co/t/automatic-ip-reputation-check/265215 "2021-02-23T15:08:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sbathla](https://avatars.discourse-cdn.com/v4/letter/s/c4cdca/32.png) [@sbathla](https://discuss.elastic.co/u/sbathla)\
**Post date:** [February 23, 2021, 3:08pm UTC](https://discuss.elastic.co/t/automatic-ip-reputation-check/265215/1 "2021-02-23T15:08:47Z")

</div>

Hi All,

Is there any way to do ip reputation check automatically with logstash or elasticsearch without manually effort for checking reputation against each ip?

---

<div class="post-metadata">

**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Post date:** [February 23, 2021, 4:18pm UTC](https://discuss.elastic.co/t/automatic-ip-reputation-check/265215/2 "2021-02-23T16:18:39Z")

</div>

It's not released yet, but Filebeat 7.12 will tentatively have a beta module for [Threat Intel](https://www.elastic.co/guide/en/beats/filebeat/7.12/filebeat-module-threatintel.html) which might help with what you're looking for.

---

<div class="post-metadata">

**Author:** ![sbathla](https://avatars.discourse-cdn.com/v4/letter/s/c4cdca/32.png) [@sbathla](https://discuss.elastic.co/u/sbathla)\
**Post date:** [March 15, 2021, 4:20pm UTC](https://discuss.elastic.co/t/automatic-ip-reputation-check/265215/3 "2021-03-15T16:20:06Z")

</div>

Hi Ben,

Thanks for your reply..

I understand from your response that in-built feature for ip reputation check is not available with current EL version..But could you please help me with alternative way like integration of talos,virustotal etc with elasticsearch....

---

<div class="post-metadata">

**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Post date:** [March 16, 2021, 8:45pm UTC](https://discuss.elastic.co/t/automatic-ip-reputation-check/265215/4 "2021-03-16T20:45:12Z")

</div>

Unfortunately, I'm not familiar with these sources, so I can't provide much help. However, if they have accessible API's you could try using Logstash's [http filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-http.html) to enrich that data through a Logstash pipeline.

On a related note, this is very speculative (and my own observance from looking at some GitHub issues), but based on where 7.12 is currently at in the cycle, it might be only two or three weeks from release. So if you can wait a bit longer it might be available soon-ish.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 13, 2021, 8:45pm UTC](https://discuss.elastic.co/t/automatic-ip-reputation-check/265215/5 "2021-04-13T20:45:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.