Enrich a SOC IP Indicator - FullHunt API Documentation

This workflow enriches an IP address without converting incomplete evidence into a binary verdict.

Requirements

Nexus and Data Intelligence access
Python 3.10 or later with requests
A validated IPv4 or IPv6 indicator

Run the enrichment

export FULLHUNT_API_KEY="YOUR_API_KEY"
export FULLHUNT_INDICATOR_IP="192.0.2.10"
python enrich_ip.py

enrich_ip.py

import ipaddress
import json
import os

import requests

API_KEY = os.environ["FULLHUNT_API_KEY"]
INDICATOR = str(ipaddress.ip_address(os.environ["FULLHUNT_INDICATOR_IP"]))
HEADERS = {"X-API-KEY": API_KEY}
BASE_URL = "https://fullhunt.io/api/v1"


def get(path, params):
    response = requests.get(
        f"{BASE_URL}{path}",
        headers=HEADERS,
        params=params,
        timeout=30,
    )
    response.raise_for_status()
    return response.json()


record = {
    "indicator": {"type": "ip", "value": INDICATOR},
    "fullhunt": {
        "nexus_ip": get("/nexus/ip-lookup", {"query": INDICATOR}),
        "tor": get("/nexus/tor/check-ip", {"ip": INDICATOR}),
        "reverse_hosts": get("/intel/ip-to-hosts", {"ip": INDICATOR}),
    },
    "analyst": {
        "disposition": "unreviewed",
        "notes": [],
    },
}

print(json.dumps(record, indent=2))

192.0.2.0/24 is reserved for documentation. Replace it with the actual indicator when running the script.

Interpretation

Keep these observations separate:

Observation	What it supports	What it does not prove
Tor match	IP appeared in the Tor exit-node dataset	The activity is malicious
Reverse host	A hostname was associated with the IP	Current ownership or control
Network or organization field	Provider or registration context	Attribution to an attacker
Passive DNS history	Historical hostname relationship	Current resolution

Send the normalized object to your Security Information and Event Management (SIEM) system, then add event-specific context such as time, destination, authentication outcome, and observed behavior. Preserve raw FullHunt responses for investigation, but redact unnecessary personal data before wider distribution.