🛡️ Suricata AbuseIPDB Reporter

An integration tool designed to analyze Suricata logs and report IP addresses to the AbuseIPDB database. To prevent excessive reporting of the same IP address within a short time period, the tool uses a temporary cache file to track previously reported IP addresses.

⭐ If you like this repository or find it useful, I'd greatly appreciate it if you could give it a star. Many thanks!
☁️ Also, check this out: sefinek/Suricata-To-AbuseIPDB

Important

• If you'd like to make changes to any files in this repository, please start by creating a public fork.

📋 Requirements

• Node.js + npm
• PM2 (npm i -g pm2)
• Git
• Linux (Ubuntu or Debian)

✅ Features

1. Easy Configuration – The config.js file allows for quick and simple configuration.
2. Simple Installer – Enables fast and seamless integration deployment.
3. Self-IP Protection (IPv4 & IPv6) – The script will never report IP addresses belonging to you or your server, even if you're using a dynamic IP address.
4. IP Filtering – Local and special-purpose IP addresses will never be reported.
5. IP Whitelist – Maintain a whitelist.txt file with IP addresses that should never be reported (e.g., your home IP when running on a VPS). The file is watched for changes and reloaded automatically.
6. Report Cooldown – Prevents duplicate reports of the same IP within a configurable time window.
7. Bulk Reporting Support – If the script encounters a rate limit, it will start buffering collected IPs and send a bulk report.
8. Discord Webhooks Integration:
   • Critical notifications
   • Script error alerts
   • Daily summaries of reported IPs
9. Automatic Updates – The script regularly fetches and applies the latest updates. You can disable this feature if you'd prefer.

📥 Installation (Ubuntu & Debian)

Install Node.js

See https://gist.github.com/sefinek/fb50041a5f456321d58104bbf3f6e649.

Install Git

See https://gist.github.com/sefinek/1de50073ffbbae82fc901506304f0ada.

Clone & Set up

sudo apt update && sudo apt upgrade
cd ~
git clone --recurse-submodules https://github.com/sefinek/Suricata-To-AbuseIPDB.git
cd Suricata-To-AbuseIPDB
npm install
cp config.default.js config.js
npm install -g pm2
pm2 start
eval "$(pm2 startup | grep sudo)"
pm2 save

🔍 Check Logs

pm2 logs suricata-abuseipdb

📄 Example Reports & screenshots

Suricata (signature 2100498, severity: 2): GPL ATTACK_RESPONSE id check returned root]

Suricata (signature 2029346, severity: 1): ET MALWARE Possible Winnti DNS Lookup]

Suricata (signature 2022048, severity: 1): ET MALWARE Cryptowall .onion Proxy Domain]

🤝 Development

If you want to contribute to the development of this project, feel free to create a new Pull request. I will definitely appreciate it!

🔑 GPL-3.0 License

Copyright © 2024-2026 Sefinek