Create Your Own Up-to-Date Threat Intelligence

This document introduces a script that automates collection and enrichment of high-confidence, recently reported IPs from AbuseIPDB, supporting global or country-focused analysis and producing JSON/CSV outputs. It explains how to configure filters (confidence score, time window, reporter country), integrate the results into SIEM/XDR for risk-based alerting, and use the data for threat hunting and direct blocklisting, with guidance for scheduled daily runs and noise reduction via reporter counts and recency scoring.