SmartView and Custom Actions

[masher]

If you've ever spent any time with the Logs & Monitor area of Smartconsole, there usually comes the time where a lookup of an IP address is needed. Right-clicking an IP address and going to Actions has always provided three options: ping, whois, and nslookup.

For many individuals or organizations, this might not be a full list of available resources for answering questions about IP addresses. In that case, there is an option to create custom commands. 

I list two examples below using ipinfo.io and shodan.io, but these could be customized to point to other internal solutions as well. 

Once custom commands have been opened, select Add and the following settings can be added:

The powershell command that I use in the arguments section:

"Convertfrom-JSON (Invoke-WebRequest http://ipinfo.io/<IP>?token=APITOKENFROMIPINFO).Content"

Which provides the following output when used against an IP:

 In a similar manner, querying Shodan via their API can also be an option:

 Convertfrom-JSON (Invoke-WebRequest https://api.shodan.io/shodan/host/<IP>?key=SHODANAPIKEYHERE).Content

 Response:

[PhoneBoy]

Huh, didn’t realize you could do that.
Cool tip 😁