Connect Google Security Operations (Chronicle) to AbuseIPDB threat intelligence

Google Security Operations is Google's cloud SIEM. Google's stix_taxii ingestion script pulls AbuseIPDB's crowdsourced IP threat indicators into it as STIX logs. Not yet verified end to end against AbuseIPDB.

AbuseIPDB is a crowdsourced database of IP addresses reported for abuse, such as brute-force logins, port scans, spam and web attacks. Its STIX/TAXII feeds deliver those addresses in STIX 2.1, the standard format threat intelligence tools exchange, over TAXII 2.1, the protocol those tools use to fetch it. Each address arrives as an indicator with its 0–100 confidence score, so you can check your logs against addresses other organizations have reported.

Already pull the AbuseIPDB blacklist through the API? Free and Paid feeds draw from that same blacklist, delivered straight into your SIEM or threat intelligence platform instead of to a script, and your check and blacklist integrations keep working as before. Your client signs in with your account email and one of your existing API keys. STIX/TAXII feeds are bought separately from your API plan and have their own daily indicator allowance; during the beta, accounts on a paid API plan can try one free feed first, with up to 10,000 indicators a day of addresses scoring at least 100. See Plans.

Not yet verified means AbuseIPDB hasn't tested this client end to end: the steps follow the vendor's documentation, so field names or screens in your version may differ. If a step doesn't match what you see, contact us.

Before you start: a feed on My TAXII Feeds using the IP threat indicators output format (you need its title), an API key, and a Google Cloud project where you can deploy a Cloud Run function, store the key in Secret Manager and trigger the function from Cloud Scheduler.

Google Security Operations has no TAXII source type in Feed management. Google's documented route for STIX/TAXII threat intelligence is its stix_taxii ingestion script, deployed as a Cloud Run function and triggered by Cloud Scheduler. Google describes these scripts as examples rather than supported product features.

1. Deploy the stix_taxii script as a Cloud Run function following Google's ingestion-scripts instructions, with the AbuseIPDB API key stored in Secret Manager, and create a Cloud Scheduler job that triggers it hourly on the Free and Paid plans, or at your agreed interval on Enterprise.
2. Set its environment variables:
   • TAXII_VERSION: 2.1
   • TAXII_DISCOVERY_URL: https://taxii.abuseipdb.com/taxii2/
   • TAXII_COLLECTION_NAMES: the feed's title as shown on My TAXII Feeds. Give each feed a distinct title, because the script finds the feed by its title. Don't leave it empty: the script would also poll the write-only AbuseIPDB reports collection, which returns 403.
   • TAXII_USERNAME: your AbuseIPDB account email.
   • TAXII_PASSWORD_SECRET_PATH: the Secret Manager path holding any API key on your account.
   • POLL_INTERVAL: minutes of history each run requests, not how often it runs (Cloud Scheduler sets that). Set it slightly above the gap between runs, e.g. 65 for an hourly schedule. Only Enterprise feeds use it; Free and Paid feeds ignore it.
3. After the first scheduled run, the feed's Last accessed date on My TAXII Feeds shows today (it is recorded once per UTC day). Then confirm objects arrived under log type STIX.

The script keeps no checkpoint: on Enterprise feeds, each run fetches only the last poll interval's worth of objects, so a late or skipped run loses that window. Setting the poll interval slightly above the scheduler cadence lets a late run still overlap the previous one; duplicates are cheaper than gaps. On Enterprise feeds, after a missed run, temporarily raise POLL_INTERVAL to cover the gap (within the 60-day window), run the function once, then set it back. Expect some duplicates. Free and Paid feeds ignore the time window; AbuseIPDB keeps your place in the feed.

Output format

Use the IP threat indicators output format. The STIX parser maps indicators. We expect it to ignore the extra objects in the other output formats, but this has not been tested.

Multiple feeds

Each custom feed is its own collection. List several feed titles, comma-separated, or run one function per feed.

If you hit issues, contact us.