The Scenario
Your security team pulled 500 IP addresses from your SaaS application's server logs — a mix of login attempts, API calls, and admin actions from the past week. Some of these look unusual: repeated authentication failures, calls from geographic regions your users don't operate in, traffic patterns that don't match normal usage.
Before your security analyst starts a manual review, you need each IP enriched with country, city, ISP, and whether it's a known VPN or proxy.
The bad version:
- Paste the first batch of 50 IPs into an IP lookup tool, download results, paste into a staging tab
- Repeat for all 10 batches, then combine them in a new tab and align the country/city columns against the original log rows
- Discover that one batch came back with different column headers than the others and now your VLOOKUP is pulling from the wrong column on rows 251-300
The analyst is waiting on the enriched list before starting review. You're an ops manager who got handed this because "you know spreadsheets." That is not the same skill as what this task is actually asking for.
The Easy Way: One Prompt in SheetXAI
SheetXAI is an AI agent that lives inside your Google Sheet. Through its built-in Neutrino IP info integration, it enriches every IP address in column A with geographic and network metadata and writes each field into the column you specify.
For each IP address in column A, use Neutrino IP info to get the country, city, and ISP and put them in columns B, C, and D respectively.
What You Get
- Column B: country for every IP
- Column C: city
- Column D: ISP name
- All 500 rows processed in one pass — no batching, no re-combining, no column alignment problems
What If the Data Is Not Quite Ready
Some rows also need VPN and proxy flags
For each IP address in column A, use Neutrino IP probe to get the country in column B, city in column C, ISP in column D, whether it is a VPN in column E (TRUE or FALSE), and whether it is a proxy in column F (TRUE or FALSE).
You want to filter to only suspicious rows before handing off to the analyst
Enrich all IPs in column A with Neutrino — write country in column B, city in column C, ISP in column D, VPN flag in column E, and proxy flag in column F. Then highlight any row where column E or column F is TRUE in red.
Some rows contain IPv6 addresses mixed with IPv4
For each row in column A, note whether the IP address is IPv4 or IPv6 in column B. Then enrich all addresses with Neutrino and write country in column C, city in column D, and ISP in column E.
Full enrichment and triage in one shot
Enrich all IP addresses in column A with Neutrino — write country in column B, city in column C, ISP in column D, VPN in column E, and proxy in column F. Highlight VPN and proxy rows in red. Then add a summary row at the bottom showing the count of unique countries, the count of VPN addresses, and the count of proxy addresses.
Try It
Get the 7-day free trial of SheetXAI and open your server log IP sheet, then ask SheetXAI to enrich column A with Neutrino country, city, and VPN flags before handing the list to your security analyst. See also the IP blocklist screening spoke if you want to cross-check each address against known threat lists at the same time.