Skip to content
Notis

Add identity context to an incoming threat report

Gather the identity document and IP reputation result together when a report needs investigation.

Trigger

Webhook received

Notis starts this workflow when an external tool or custom backend sends an HTTP request.

Action

Retrieve DID Document

Retrieves the DID document for a decentralized identifier.

Why this helps

Threat reports often send teams to different tools to collect basic identity and network context.

  • Check the reported IP with Abuselpdb.
  • Resolve the supplied valid DID through Dock certs.
  • Give investigators one report containing both results and any missing inputs.

Setup

Build it in a few focused steps.

  • 1Connect Abuselpdb and Dock certs once in Notis.
  • 2Create an automation in Automations, New Automation, or describe the investigation handoff from any channel.
  • 3Ask Notis to check the report IP and retrieve the DID document for the supplied DID.
  • 4Choose the Notis webhook trigger and select where run reports should go.
  • 5Test with one real report containing an IP and a valid DID.

Questions about this workflow

Can Dock certs find a DID if the report does not provide one?

No. The retrieval action requires a valid DID, so the report should call out a missing DID.

Does resolving a DID prove the IP is malicious?

No. The DID document and IP reputation are separate information for a reviewer to assess.

When this happens · Trigger

Do this · Action

Supported Triggers and Actions

Notis builds workflows that link Abuselpdb to Dock certs. A trigger fires from one place; an action lands in another.

Abuselpdb triggers

Dock certs actions

Recurring trigger

Notis starts this workflow on a schedule, such as daily, weekly, or during business hours.

TriggerScheduled

Create API Key

Creates a new API key.

ActionInstant

Webhook trigger

Notis starts this workflow when an external tool or custom backend sends an HTTP request.

TriggerInstant

Create Webhook

Creates a webhook endpoint.

ActionInstant

Delete API Key

Deletes an API key.

ActionInstant

Delete Credential

Deletes a verifiable credential.

ActionInstant

Delete Tag

Permanently deletes a tag.

ActionInstant

Delete Webhook

Deletes a webhook.

ActionInstant

Retrieve API Key

Retrieves details about an API key.

ActionInstant

Retrieve API Keys

Lists all API keys for the account.

ActionInstant

Connect any two apps with Notis in the middle.

Abuselpdb and Dock certs, or any other combination from 1,000+ integrations.

When this happens · Trigger

Do this · Action

Save your first hour today.

7-day trial of any paid plan, with 20$ of usage included.
No card. Works with personal or business Dock certs.