1 of 20
2 of 20
3 of 20
4 of 20
5 of 20
6 of 20
7 of 20
8 of 20
9 of 20
10 of 20
11 of 20
12 of 20
13 of 20
14 of 20
15 of 20
16 of 20
17 of 20
18 of 20
19 of 20
20 of 20

doc

How to install the IP Address Reputation solution on Azion’s Marketplace

Overview

IPQualityScore provides a reputation score for a given IP address. The score is based on several factors, including whether the IP address was used for spamming or other malicious activity, how often the IP address was reported as suspicious or fraudulent, and other information. A higher score indicates the IP address has a better reputation and is less likely to be used maliciously. On the other hand, a lower score indicates that the IP address is more likely to be used for malicious activity and should be used with caution.

  1. Getting the solution
  2. Using the solution
  3. Getting the API Key at IPQualityScore
  4. Configuring the solution
  5. Instantiating the solution
  6. Configuring a rule on Rules Engine

1. Getting the solution

To use the IP Address Reputation solution provided at Azion’s Marketplace, follow these steps:

  1. Access Real-Time Manager (RTM) and log in.
    • If you don’t have an account yet, create one by visiting the sign-up page.
  2. On the upper-left corner of the page, select Products Menu > Marketplace.
  3. On the Marketplace’s homepage, type “IP” in the search box or browse through the cards below it to find the desired IP Address Reputation solution.
  4. Select the desired IP Address Reputation card. The solution’s page appears.
  5. On the Subscribe for section at the bottom-right corner of the page, click the Get It Now button.

A successful message appears. Your solution is installed and ready to use.

2. Using the solution

Your edge functions library holds the solutions you get on Marketplace. To use the IP Address Reputation solution, you must create a new edge application to use with your new IP Address Reputation function.

To learn how to create an edge application, visit the documentation on getting started. You can also create an edge application through RTM > Products Menu > Edge Application and follow the instructions.

3. Getting the API Key at IPQualityScore

To use the IP Address Reputation, you’ll have to obtain the API key at IPQualityScore. To do so, follow these steps:

  1. Create an account at IPQualityScore.
  2. Wait for the email with your personal information.
    • In the email you’ll receive your API key. That’s the only information you need to configure your solution.

4. Configuring the solution

On the Edge Application page, locate the new IP Address Reputation edge application and select it.

On the Main Settings tab, locate the Edge Functions switch. This switch should be on the off position, you must turn it on:

  1. Activate the switch.
  2. On the bottom-right corner, click the Save button.

A successful message appears informing that the edge application is updated.

This will enable the Functions tab on your Edge Application, allowing you to instantiate the IP Address Reputation edge function on your edge application.

5. Instantiating the solution

To enable the IP Address Reputation function, follow these steps:

  1. Still in the Edge Application page, select the Functions tab located in the top list.
  2. Click the Add Function button.
  3. On the edge function’s name text box, type an easy to remember name.
  4. On the dropdown function menu, select the IP Address Reputation function.
    • This will load the function, showing a box with the code of the functions and two tabs: Code and Args.

The Code tab can’t be edited. This tab is only to study the code of the function. Every parameter must be passed on the Args tab.

On the Args tab you’ll change the configuration of your IP Address Reputation function. For this, select the Args tab to open the box for the Args. Here you can add the parameters to execute your application. On the Args tab you’ll see the JSON file you have to edit to use the solution.

The JSON will look like this:

{
  "api_key": "XXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "allow_public_access_points": true,
  "fast": true,
  "strictness": 0,
  "lighter_penalties": true,
  "user_language": "en-US",
  "transaction_strictness": 0
}

To run the solution, the only parameter you’ll need to configure is the api_key, passing the API key you’ve received by email.

The other fields are:

  • allow_public_access_points: allows public connections. This is a boolean field, with the default value of true.
  • fast: enables a fast check. When you enable this parameter, your API won’t do some forensic checks. This is a boolean field, with the default value of true.
  • strictness: Fraud Scoring, higher values (above 2) have more chance to return false positives. Use the range 0-3 for this. This is an integer field, with the default value of 0.
  • lighter_penalties: lowers the score for proxy IPn addresses, preventing false positives. This is a boolean field, with the default value of true.
  • user_language: the user header language. This is a string field with no default value.
  • transaction_strictness: adjusts penalty weights for irregularities and fraud patterns detected on order and transaction details optionally provided with each API request. This feature is only useful when providing order and transaction details. This is an integer field with no default value.

Some other parameters, that aren’t in the JSON example provided at the Args box, could be used. They are:

  • when_score_above: sets a score threshold. Whenever the IPQS Risk Score exceeds this threshold, the function will perform the action defined by the execute argument. If the value isn’t set, then no action will be taken by the function. This is an integer field with no default value.
  • execute: the action that will be performed when when_score_above threshold was surpassed. This is a string field with three possible values: deny, drop, add_header. There’s no default value.
  • get_data_from: determines if the IP will be retrieved from a querystring request from the header or from the body. If the value is remote_addr, the value that will be extracted is: ngx.var.remote_addr. This is a string field with four possible values: remote_addr, querystring, body, header. The default value is remote_addr.
  • data_name: identify the field or argument from when the IPQS function will extract the IP to validate. This is only used when the parameter search_in is different from the parameter remote_addr. This is a string field, with the default value of X-Forwarded-For.

6. Configuring a rule on Rules Engine

Still in the Edge Application page, in the Rules Engine tab, you have to configure the rules you want (criteria and behavior) to apply in order to run your function.

To do so, follow these steps:

  1. Select the Rules Engine tab.
  2. Click on Default Rule.
  3. On the behavior field, select Run Function from the dropdown menu and then select the IP Address Reputation function, according to the name you gave it in the instantiation step.

Note: you can’t change the criteria field for the Default Rule on Rules Engine.

  1. Click the Save button.

Important

It’s a good practice to create another rule redirecting your application to another URL. If the IP Address Reputation finds no errors, you won’t see any messages. If you don’t want or need it, you can follow the usage of your API key through the IPQualityScore dashboard. Every refresh on your edge application will count as a new request for IP address lookup.

For each field present in the results, the solution will add the prefix IPQS to the request header. This means that for each query, the header will have a prefix with the field. For example, if the request has an ASN field, the header will have an IPQS-ASN with the same value added to the header. You can also use this information to create and manage your decisions in the Rules Engine. You can find a [full list of fields here] (https://www.ipqualityscore.com/documentation/proxy-detection/overview).

Didn’t find what you were looking for? Open a support ticket.