Triage suspicious IPs for audit ownership
Turn a suspicious IP into a clear handoff with the evidence an owner needs.
Trigger
Webhook received
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
Action
Hazard Report API
Tool to fetch a cybersecurity hazard report for a specified ip address. use when assessing an ip's threat profile (vpn, proxy, blacklists, hosting risk).
Why this helps
Suspicious IPs sit unassigned when the initial evidence is too technical or scattered.
- Creates actionable handoffs
- Explains technical signals plainly
- Reduces unassigned findings
Setup
Build it in a few focused steps.
- 1Connect 21risk and Big data cloud once in the Notis portal.
- 2Create an automation named Suspicious IP triage.
- 3Tell Notis to assess the supplied IP, summarize the hazard signals, and recommend the appropriate audit owner based on your provided routing rules.
- 4Pick a webhook trigger and choose the report channel.
- 5Test with one suspicious IP.
Questions about this workflow
Does it know our audit owners automatically?
Provide your routing rules or owner list in the prompt for Notis to use.
What evidence is included?
The action returns hazard signals such as VPN, proxy, blacklist, and hosting risk indicators.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link 21risk to Big data cloud. A trigger fires from one place; an action lands in another.
21risk triggers
Big data cloud actions
Recurring trigger
Notis starts this workflow on a schedule, such as daily, weekly, or during business hours.
Am I Roaming API
Tool to determine if the user is roaming based on their ip address and gps coordinates. use after obtaining device location to verify roaming status before mobile actions.
Webhook trigger
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
ASN Extended Receiving From Info API
Tool to return upstream providers (receivingfrom) for a given asn. use when you need a paginated list of ases feeding traffic for the specified asn.
ASN Extended Transit To Info API
Tool to return downstream customers (transitto) for a given asn. use when you need a paginated list of ases receiving traffic from a specific asn.
ASN Rank List API
Tool to fetch a ranked list of autonomous systems by ipv4 announcement volumes. use after you need to compare or analyze as ranks.
BGP Active Prefixes API
Tool to retrieve ipv4 or ipv6 prefixes currently announced on bgp. use when inspecting bgp routing announcements for a given asn.
Reverse Geocoding With Timezone API
Tool to return reverse geocoding and time zone info for given coordinates. use when you need both locality details and timezone data in one call.
Country by IP Address API
Tool to geolocate an ip address and retrieve country details and demographics. use when you need country-level data after obtaining the target ip address.
Country Info API
Tool to fetch detailed country information by iso code. use when you need localized names, currencies, regions, and other metadata for a country.
Connect any two apps with Notis in the middle.
21risk and Big data cloud, or any other combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7-day trial of any paid plan, with 20$ of usage included.
No card. Works with personal or business Big data cloud.