Check IP reputation after a Drive share
Add a lightweight threat check whenever sensitive evidence is shared.
Trigger
File Shared (Permissions Added)
Triggers when new sharing permissions are granted to a file or folder. Uses Drive's `changes.list` endpoint with inline `permissions` in the `fields` mask so each change carries the file's current permission set provider-atomically. We diff that against `seen_permission_keys` to identify newly added grants. Drive page tokens are the primary cursor; if Drive rejects a stored token, the trigger raises `PollingTriggerError` without clearing state rather than silently re-baselining and dropping events. Limitation: truly ephemeral permissions (added and revoked between two polls without any other file modification in between) are not detected. Drive Activity API would catch those but requires an additional OAuth scope and a different payload contract.
Action
Check IP Reputation
Tool to check the reputation of an ip address. use when you need to determine if an ip address has been reported for abusive activity within a specified look-back period. example: checkip(ipaddress='8.8.8.8', maxageindays=90).
Why this helps
Sharing a file can expand exposure before anyone reviews the addresses inside it.
- Review addresses before broader access
- Create a repeatable sharing safeguard
- Keep security context with the sharing event
Setup
Build it in a few focused steps.
- 1Connect Google Super and Abuselpdb in Notis.
- 2Create an automation that checks every IP found in a file when new permissions are added.
- 3Pick File Shared as the trigger.
- 4Choose a report destination and test with one shared file.
Questions about this workflow
Does this revoke access?
No. This workflow checks IP reputation and reports results; it does not change Drive permissions.
Can the report include who received access?
Yes. Ask Notis to include the sharing event details in the report.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link Google Super to Abuselpdb. A trigger fires from one place; an action lands in another.
Google Super triggers
Abuselpdb actions
Recurring trigger
Notis starts this workflow on a schedule, such as daily, weekly, or during business hours.
Retrieve IP Blacklist
Tool to retrieve a list of the most reported ip addresses. use when building dynamic blocklists or threat intelligence feeds.
Webhook trigger
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
Bulk Report
Tool to submit multiple ip abuse reports in bulk. use when you need to report a large set of ips at once by uploading a csv file with required headers. csv must include columns: ip, categories, reportdate, comment.
Aggregate Metric Changed
Triggers when an aggregate metric (SUM/COUNT/AVG/MIN/MAX) changes in a Google Sheets spreadsheet. This trigger monitors an aggregate calculation on a target column (optionally filtered by a search column/value) and fires when the calculated result changes.
Check Block
Tool to check the reputation of all ip addresses in a cidr range. use when you need aggregated abuse data for a network block.
Attendee Response Changed
Polling trigger that fires when any attendee's RSVP changes to accepted, declined, or tentative. Returns attendee info and current status.
Check IP Reputation
Tool to check the reputation of an ip address. use when you need to determine if an ip address has been reported for abusive activity within a specified look-back period. example: checkip(ipaddress='8.8.8.8', maxageindays=90).
Cell Range Values Changed
Triggers when values in a specified A1 range change in Google Sheets. This trigger monitors a specific cell or range of cells and fires when any values change.
Clear Address Reports
Tool to remove all reports associated with a specific ip address. use when you need to purge your own abuse records after verifying control of the ip.
Comment Added (Docs/Sheets/Slides)
Triggers when a new comment is added to Google Docs, Sheets, or Slides.
Get Abuse Reports
Tool to retrieve a list of abuse reports for a specific ip address. use when you need to fetch historic reports with optional filtering by status, date range, reporter, and pagination.
Conditional Format Rule Changed
Triggers when conditional formatting rules change in a Google Spreadsheet. Detects when rules are added, updated, or removed. Uses snapshot-based diffing to detect changes between polls.
Data Validation Rule Changed
Triggers when data validation rules change (added/updated/removed) in a Google Spreadsheet. Uses snapshot-based diffing to detect changes between polls.
Connect any two apps with Notis in the middle.
Google Super and Abuselpdb, or any other combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7-day trial of any paid plan, with 20$ of usage included.
No card. Works with personal or business Abuselpdb.