What this endpoint does

This endpoint returns enrichment data for a single IP address, controlled by the fields parameter which selects which categories of intelligence to include. For IP triage and threat assessment, request the core fields entity,risk,aiInsights,links,intelCard,location to get identification, risk scoring with triggered rule evidence, AI-generated analysis, technically validated relationships (MITRE ATT&CK techniques, threat actors, malware), an Intelligence Card URL, and geolocation with network ownership. IP-specific enrichment fields include dnsPortCert for DNS resolutions and open ports, scanner for scanning behavior verdicts and targeted countries, and riskyCIDRIPs for other risky IPs in the same CIDR block. The IP entity ID format is ip: followed by the address (e.g., ip:1.2.3.4); use the IP Search endpoint to find IPs by risk score, risk rules, or time range. Consult the Enrichment: Field Attributes reference for the full list of available fields, or call GET /v2/ip/fields to list valid field names programmatically.

Response data

The response contains a data object with only the enrichment sections specified in the fields parameter. The risk section provides a numeric score (0-99), criticality label, count of triggered rules out of total rules evaluated, and detailed evidence for each triggered rule including source citations. The links section contains technically validated relationships from sandbox analysis and Insikt Group research — distinct from relatedEntities which reflects co-occurrence in articles and is very large. The location section includes geolocation (city, country, continent), network ownership (organization, ISP), ASN, and CIDR block. The scanner section provides scanning behavior verdicts, targeted ports and countries, and whether the IP is classified as a global scanner.