Skip to main content


This Integration is part of the Spur Context API Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.10.0 and later.

Enrich indicators using the Spur Context API. This integration was integrated and tested with version 2 of SpurContextAPI.

Configure SpurContextAPI on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for SpurContextAPI.

  3. Click Add instance to create and configure a new integration instance.

    API TokenTrue
  4. Click Test to validate the URLs, token, and connection.


You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.


Enrich indicators using the Spur Context API.

Base Command#



Argument NameDescriptionRequired
ipIP address to enrich.Required

Context Output#

SpurContextAPI.Context.ipstringIP that was enriched
SpurContextAPI.Context.asobjectAutonomous System details for an IP Address.
SpurContextAPI.Context.organizationstringThe organization using this IP address.
SpurContextAPI.Context.infrastructurestringThe primary infrastructure type that this IP address supports. Common tags are MOBILE and DATACENTER.
SpurContextAPI.Context.locationobjectData-center or IP Hosting location based on MaxMind GeoLite.
SpurContextAPI.Context.servicesarrayThe different types of proxy or VPN services that are running on this IP address
SpurContextAPI.Context.tunnelsarrayDifferent VPN or proxy tunnels that are currently in-use on this IP address
SpurContextAPI.Context.risksarrayRisks that we have determined based on our collection of data.
SpurContextAPI.Context.client_concentrationobjectThe strongest location concentration for clients using this IP address.
SpurContextAPI.Context.client_countriesnumberThe number of countries that we have observed clients located in for this IP address
SpurContextAPI.Context.client_spreadnumberThe total geographic area in kilometers where we have observed users
SpurContextAPI.Context.client_proxiesarrayThe different types of callback proxies we have observed on clients using this IP address.
SpurContextAPI.Context.client_countnumberThe average number of clients we observe on this IP address.
SpurContextAPI.Context.client_behaviorsarrayAn array of behavior tags for an IP Address.
SpurContextAPI.Context.client_typesarrayThe different type of client devices that we have observed on this IP address.