The Scenario
Your SIEM fired an alert at 11 PM. By midnight you had 5,000 suspicious login-attempt IP addresses exported into a Google Sheet. You're a security analyst. Before you can triage and escalate, you need to know which of these IPs belong to known threat actors, which are coming from high-risk ASNs, and which countries are generating the volume.
The raw IP list tells you nothing. Your threat intelligence platform requires manual IP entry or a CSV upload with a 24-hour turnaround. The on-call team is waiting for your triage summary.
The bad version:
- Look up IPs one by one in VirusTotal — 5,000 lookups, one browser tab, all night.
- Upload the CSV to a threat intel service, wait for the report, receive a PDF that doesn't map back to your sheet columns.
- Write a Python script that calls a free IP geolocation API with a 45-requests-per-minute rate limit — at that rate, 5,000 IPs takes nearly two hours.
The security team lead wants a triage summary before the 8 AM standup.
The Easy Way: One Prompt in SheetXAI
SheetXAI reads your Google Sheet and calls Interzoid's IP intelligence API for every address — writing country, ASN, organization, and reputation score directly into the sheet.
For each IP address in column A, call Interzoid to get the country, ASN, organization, and reputation score and write them to columns B through E.
What You Get
- Column B: country of origin per IP.
- Column C: Autonomous System Number.
- Column D: ASN organization name.
- Column E: reputation score from Interzoid.
- A dataset ready for triage — filter by column E to surface the highest-risk IPs first, filter by column B to see the country distribution.
What If the Data Is Not Quite Ready
Column A has some private IP addresses (192.168.x.x, 10.x.x.x) mixed in
For each IP in column A, first check if it's a private or reserved address range (10.x.x.x, 192.168.x.x, 172.16-31.x.x, 127.x.x.x). Flag private IPs as 'INTERNAL' in column B and skip Interzoid. For all public IPs, call Interzoid and write country, ASN, organization, and reputation to columns B through E.
You want to immediately surface only high-threat IPs
Enrich all IPs in column B using Interzoid's IP profile tool and write the city, ASN organization, and threat flag to columns C, D, and E, then filter rows where the threat flag is true.
Column A has IPv6 addresses mixed with IPv4 — handle both
For each IP in column A, determine whether it's IPv4 or IPv6. Call Interzoid for both types and write country, ASN, organization, and reputation to columns B through E. Flag any IPs that returned an error from Interzoid in column F.
Full triage pass in one shot
For each IP in column A: skip private/internal ranges (flag as 'INTERNAL' in column B). For all public IPs, call Interzoid and write country to column B, ASN to column C, organization to column D, and reputation score to column E. Flag rows where the reputation score indicates high threat as 'HIGH RISK' in column F. Then create a 'Triage' sheet with only HIGH RISK rows, sorted by reputation score descending, for immediate escalation.
The 8 AM standup has a triage sheet with the 47 highest-risk IPs already isolated.
Try It
Get the 7-day free trial of SheetXAI and open your IP export — ask SheetXAI to enrich column A with Interzoid threat intelligence before your morning triage. Then see the spoke on bulk validating phone numbers for compliance, or the full Interzoid integration overview.