Use flag removal to prompt an IP threat review
Give a reaction change a clear review meaning when the team uses its removal to signal a second look.
Trigger
Channel Message Received
Triggered when a message is posted in a Slack channel (public, private, or multi-party IM). Does NOT match direct messages.
Action
Get Threat for IP
Tool to return only the threat object for the calling IP. Use when only the threat details are required for the current IP.
Why this helps
A change in review status can be overlooked if nobody owns the next manual check.
- Turn an agreed reaction removal into a clear review signal.
- Keep the triggering message in context for the review.
- Reduce reliance on remembering a separate manual check.
Setup
Build it in a few focused steps.
- 1Connect Slack and Ipdata co to Notis once through the portal.
- 2Create a portal automation or ask Notis to run a threat review when your designated review reaction is removed.
- 3Use one instruction to inspect the affected message and run the calling-client-IP threat action only when the message includes an IP and matches your agreed review condition.
- 4Select Message Reaction Removed, configure the optional channel or emoji filter if available, and choose a run-report channel.
- 5Test by removing the designated reaction from a qualifying Slack message.
Questions about this workflow
Does this look up the IP in the reacted-to message?
The selected action provides threat details for the calling IP. It is not a specific-IP threat action, so this workflow should only be used when that calling-IP behavior is intended.
Why use reaction removal?
A team may agree that removing a review marker signals a second look. Make that meaning explicit in the automation instruction.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link Slack to Ipdata co. A trigger fires from one place; an action lands in another.
Slack triggers
Ipdata co actions
Recurring trigger
Notis starts this workflow on a schedule, such as daily, weekly, or during business hours.
Advanced ASN Lookup
Tool to perform advanced ASN lookup returning prefixes, peers, and registry details. Use after confirming ASN number when detailed ASN info is required.
Webhook trigger
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
Get Carrier Data for an IP
Tool to return mobile carrier data for a specific IP. Use when you need carrier name, MCC, and MNC for an IP address.
New Channel Created Trigger
Triggered when a new channel is created in Slack.
EU-specific IP lookup
Tool to lookup a specific IP address via the EU-only data residency endpoint. Use when you need IP lookup processed and stored within the EU.
Channel Message Received
Triggered when a message is posted in a Slack channel (public, private, or multi-party IM). Does NOT match direct messages.
IPData: Calling Code
Tool to fetch the international calling_code for an IP's country. Use when you need only the calling code field from ipdata_co.
Direct Message Received
Triggered when a new direct message (DM) is sent to a user in Slack. Catches all DMs across all DM channels.
IPDATA Field Carrier
Tool to return only the carrier object for the calling IP. Use when you need mobile carrier details of a specific IP.
Message Reaction Added
Triggered when a reaction is added to a message in Slack. Supports optional filtering by channel and emoji name.
Get City from IP
Tool to return only city for an IP. Use when only the city name is required.
Message Reaction Removed
Triggered when a reaction is removed from a message in Slack. Supports optional filtering by channel and emoji name.
IPData: Continent Code
Tool to return only continent_code for an IP. Use when only the continent code is required.
Reaction Added Trigger
DEPRECATED: use `SLACK_MESSAGE_REACTION_ADDED` instead. Triggered when a reaction is added to a message in Slack.
Get Continent Name from IP
Tool to return only continent name for an IP. Use when only the continent name is required.
Connect any two apps with Notis in the middle.
Slack and Ipdata co, or any other combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7-day trial of any paid plan, with 20$ of usage included.
No card. Works with personal or business Ipdata co.