Find the organization behind an incident IP
Add company context to IPs shared during an incident so your team has a clearer starting point for investigation.
Trigger
Channel Message Received
Triggered when a message is posted in a Slack channel (public, private, or multi-party IM). Does NOT match direct messages.
Action
Get Company Info for an IP
Tool to retrieve company info for a specific IP. Use when you need organization details behind an IP.
Why this helps
Incident responders can spend time chasing organizational context that could be checked while reading the Slack report.
- See organization details associated with an IP.
- Reduce manual research during incident response.
- Keep the original report and lookup context connected.
Setup
Build it in a few focused steps.
- 1Connect Slack and Ipinfo io to Notis once in the portal.
- 2Create an automation in the portal or ask Notis conversationally.
- 3Write one instruction asking Notis to retrieve company information for IPs in incident-channel messages and summarize the result.
- 4Pick Channel Message Received and choose the channel where Notis reports runs.
- 5Test with one real incident message that includes an IP.
Questions about this workflow
Does this identify a person using the IP?
No. The action retrieves company information associated with an IP, not a person's identity.
Can I use it for any channel?
The Slack trigger supports public, private, and multi-party IM channels. The instruction can describe the incident messages that should be relevant.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link Slack to Ipinfo io. A trigger fires from one place; an action lands in another.
Slack triggers
Ipinfo io actions
Recurring trigger
Notis starts this workflow on a schedule, such as daily, weekly, or during business hours.
Batch Lite Lookup
Tool to perform bulk Lite IP lookups. Use when you need to group up to 1000 IP or URL pattern lookups into a single request.
Webhook trigger
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
Batch IP Lookup
Tool to perform batch IP lookups. Use when grouping up to 1,000 IPs or URL patterns into a single POST request.
New Channel Created Trigger
Triggered when a new channel is created in Slack.
Get Abuse Contact
Tool to retrieve abuse contact information for a specific IP address. Use when you need organizational abuse details of an IP.
Channel Message Received
Triggered when a message is posted in a Slack channel (public, private, or multi-party IM). Does NOT match direct messages.
Get IP Carrier Info
Tool to get carrier information for a given IP address. Use when you need mobile carrier details.
Direct Message Received
Triggered when a new direct message (DM) is sent to a user in Slack. Catches all DMs across all DM channels.
Get Company Info for an IP
Tool to retrieve company info for a specific IP. Use when you need organization details behind an IP.
Message Reaction Added
Triggered when a reaction is added to a message in Slack. Supports optional filtering by channel and emoji name.
Get IP Information
Tool to retrieve detailed information about an IP address. Use when you need geolocation, ASN, and network flags for a specific IP or 'me'.
Message Reaction Removed
Triggered when a reaction is removed from a message in Slack. Supports optional filtering by channel and emoji name.
Get IP Privacy Details
Tool to retrieve privacy-related flags (VPN, proxy, Tor, relay, hosting) for an IP address. Use when you need to detect anonymizing usage after confirming an IP.
Reaction Added Trigger
DEPRECATED: use `SLACK_MESSAGE_REACTION_ADDED` instead. Triggered when a reaction is added to a message in Slack.
Connect any two apps with Notis in the middle.
Slack and Ipinfo io, or any other combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7-day trial of any paid plan, with 20$ of usage included.
No card. Works with personal or business Ipinfo io.