The Scenario
Your company's SIEM exported 500 IP addresses from the past week's server logs into an Excel workbook. Some of these IPs made repeated failed login attempts. Some called API endpoints in patterns that don't match legitimate usage. Your security analyst wants to know, before she starts reviewing, which ones are associated with known VPN services or proxy networks — and where in the world they're coming from.
You have the workbook. You've been asked to get the enrichment done before the 3 PM review.
The bad version:
- Open a browser-based IP lookup tool, paste the first IP, copy the country, city, ISP into the workbook
- Repeat 499 more times
- Look up from the screen at 2:50 PM, realize you've processed 63 rows, and tell the analyst the enrichment isn't ready
Nobody assigned this to you because you're good at repetitive data entry. This landed on your desk because it seemed like a spreadsheet task. It is not a spreadsheet task. It's an API enrichment task disguised as one.
The Easy Way: One Prompt in SheetXAI
SheetXAI is an AI agent inside your Excel workbook. Through its built-in Neutrino IP info integration, it enriches every IP address in column A with geographic and network metadata and writes each field into the columns you specify.
For each IP address in column A, use Neutrino IP info to get the country, city, and ISP and put them in columns B, C, and D respectively.
What You Get
- Column B: country for every IP
- Column C: city
- Column D: ISP name
- All 500 rows in one operation — ready for the analyst's 3 PM review
What If the Data Is Not Quite Ready
You also need VPN and proxy flags
For each IP address in column A, use Neutrino IP probe to get country in column B, city in column C, ISP in column D, VPN flag in column E (TRUE or FALSE), and proxy flag in column F (TRUE or FALSE).
You want suspicious rows highlighted for the analyst
Enrich all IPs in column A with Neutrino — write country in column B, city in column C, ISP in column D, VPN in column E, proxy in column F. Highlight any row where column E or column F is TRUE in red.
Some rows have IPv6 mixed with IPv4
For each row in column A, note whether the address is IPv4 or IPv6 in column B. Then enrich all addresses with Neutrino and write country in column C, city in column D, and ISP in column E.
Full enrichment and triage in one shot
Enrich all IP addresses in column A with Neutrino — write country in column B, city in column C, ISP in column D, VPN in column E, proxy in column F. Highlight VPN and proxy rows red. Add a summary row at the bottom showing the count of unique countries, VPN addresses, and proxy addresses.
Try It
Get the 7-day free trial of SheetXAI and open your server log IP workbook, then ask SheetXAI to enrich column A with Neutrino country, city, and VPN flags before your security analyst's review. See also the IP blocklist screening spoke if you want to cross-check against known threat lists at the same time.