Check an incoming IP before it reaches your systems
Give your team a fast reputation check whenever a suspicious IP arrives.
Trigger
Webhook received
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
Action
Check IP Reputation
Tool to check the reputation of an ip address. use when you need to determine if an ip address has been reported for abusive activity within a specified look-back period. example: checkip(ipaddress='8.8.8.8', maxageindays=90).
Why this helps
Investigating one IP at a time creates delays during incidents and makes people switch between vaults, logs, and security tools.
- Get a risk signal in one message
- Use stored environment context consistently
- Reduce manual copy and paste during incidents
Setup
Build it in a few focused steps.
- 1Connect 1Password and Abuselpdb once in Notis.
- 2Create an automation named Incoming IP reputation check.
- 3Tell Notis to read the relevant 1Password context and check the IP from each webhook with Abuselpdb.
- 4Choose notis_webhook as the trigger and select a report channel.
- 5Send one real IP webhook to test the result.
Questions about this workflow
What does the webhook need to contain?
Include the IP address and any context you want Notis to consider, such as the affected service or environment.
Does this change anything in Abuselpdb?
No. Action 32 retrieves reputation data for the supplied IP.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link 1password to Abuselpdb. A trigger fires from one place; an action lands in another.
1password triggers
Abuselpdb actions
Recurring trigger
Notis starts this workflow on a schedule, such as daily, weekly, or during business hours.
Retrieve IP Blacklist
Tool to retrieve a list of the most reported ip addresses. use when building dynamic blocklists or threat intelligence feeds.
Webhook trigger
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
Bulk Report
Tool to submit multiple ip abuse reports in bulk. use when you need to report a large set of ips at once by uploading a csv file with required headers. csv must include columns: ip, categories, reportdate, comment.
Check Block
Tool to check the reputation of all ip addresses in a cidr range. use when you need aggregated abuse data for a network block.
Check IP Reputation
Tool to check the reputation of an ip address. use when you need to determine if an ip address has been reported for abusive activity within a specified look-back period. example: checkip(ipaddress='8.8.8.8', maxageindays=90).
Clear Address Reports
Tool to remove all reports associated with a specific ip address. use when you need to purge your own abuse records after verifying control of the ip.
Get Abuse Reports
Tool to retrieve a list of abuse reports for a specific ip address. use when you need to fetch historic reports with optional filtering by status, date range, reporter, and pagination.
Connect any two apps with Notis in the middle.
1password and Abuselpdb, or any other combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7-day trial of any paid plan, with 20$ of usage included.
No card. Works with personal or business Abuselpdb.