# How to Install IP Address Reputation

**IP Address Reputation** is a *serverless* integration available at Azion Marketplace.

This integration uses a reputation score for a given IP address, provided by IPQualityScore. The score is based on several factors, including whether the IP address was used for spamming or other malicious activity, how often the IP address was reported as suspicious or fraudulent, and other informations.

A higher score indicates the IP address has a better reputation and is less likely to be used maliciously. On the other hand, a lower score indicates that the IP address is more likely to be used for malicious activity and should be used with caution.

---

## Getting the integration

To install the **IP Address Reputation** integration provided by Azion Marketplace, follow these steps:

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Marketplace**.
2. On the Marketplace homepage, select the integration's card.
3. Once the integration's page opens, click the **Install** button, at the bottom-right corner of the page.

You'll see a message indicating that your integration was successfully installed.

:::tip
You can search any integration by browsing through the cards, using the filters, or typing a keyword in the search bar.
:::

---

## Getting the API Key at IPQualityScore

To use the IP Address Reputation, you'll have to obtain the API key at IPQualityScore. To do so, follow these steps:

1. Create an [account at IPQualityScore](https://www.ipqualityscore.com/create-account).
2. Wait for the email with your personal information.
    - In the email, you'll receive your API key. You'll need this information to configure your Azion integration later.

---

## Configuring the integration

### Setting up a firewall

To start the configuration of the **IP Address Reputation** integration, follow these steps:

1. On the **Products menu**, select **Firewall** in the **SECURE** section.
2. Click the **+ Firewall** button.
3. Give an easy-to-remember name to your firewall.
4. Click the **Functions** switch to enable functions.
5. Click the **Save** button.

Done. Now you've instantiated the firewall for your function.

### Setting up the Firewall function

To instantiate the **IP Address Reputation** integration, while still on the Firewall page:

1. Select the **Functions Instances** tab and follow these steps:
2. Click the **+ Function Instance** button.
3. Give an easy-to-remember name to your instance.
4. On the dropdown menu, select the **IP Address Reputation** function.
  - This action will load the **Arguments** tab, where you can add the parameters to execute your application.
5. In the **Arguments** tab, you'll pass the keys you get on the IPQualityScore site and your variables. The `JSON` will look like this:

```json
{
  "api_key": "XXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "allow_public_access_points": true,
  "fast": true,
  "strictness": 0,
  "lighter_penalties": true,
  "user_language": "en-US",
  "transaction_strictness": 0
}
```

To run the integration, the only parameter you'll need to configure is the `api_key`, passing the API key you've received by email from IPQualityScore.

The other fields are:

- `allow_public_access_points`: allows public connections. This is a boolean field, with the default value of `true`.
- `fast`: enables a fast check. When you enable this parameter, your API won't do some forensic checks. This is a boolean field, with the default value of `true`.
- `strictness`: fraud scoring, higher values (above 2) have more chance to return false positives. This is an integer field, with the default value of 0. Use the range `0-3` for this.
- `lighter_penalties`: lowers the score for proxy IP addresses, preventing false positives. This is a boolean field, with the default value of `true`.
- `user_language`: the user header language. This is a string field with no default value.
- `transaction_strictness`: adjusts penalty weights for irregularities and fraud patterns detected on order and transaction details optionally provided with each API request. This feature is only useful when providing order and transaction details. This is an integer field with no default value.

Some other parameters, that aren't in the `JSON` example provided in the Arguments box, could be used, including:

- `when_score_above`: sets a score threshold. Whenever the IPQS Risk Score exceeds this threshold, the function will perform the action defined by the `execute` argument. If the value isn't set, then no action will be taken by the function. This is an integer field with no default value.
- `execute`: the action that will be performed when the `when_score_above` threshold was surpassed. This is a string field with three possible values: `deny`, `drop`, and `add_header`. There's no default value.
- `get_data_from`: determines if the IP will be retrieved from a query string request from the header or the body. If the value is `remote_addr`, the value that will be extracted is: `ngx.var.remote_addr`. This is a string field with four possible values: `remote_addr`, `querystring`, `body`, and `header`. The default value is `remote_addr`.
- `data_name`: identify the field or argument from when the IPQS function will extract the IP to validate. This is only used when the parameter `search_in` is different from the parameter `remote_addr`. This is a string field, with the default value of `X-Forwarded-For`.

6. Click the **Save** button.

### Setting up the Firewall Rules Engine

To finish, you have to set up the **Rules Engine** to configure the *criteria* and the *behavior* to run the function.

Still on the **Firewall** page:

1. Select the **Rules Engine** tab.
2. Click the **+ Rule Engine** button.
3. Give a name to the rule.
4. Select a *criteria* to run and catch the domains that you want to run the integration on.
  - Example: if `Host` *matches* `yourdomain.com`.
5. Below, select a *behavior* to the *criteria*. In this case, it'll be **Run Function**. 
    - Select the adequate function according to the name you gave it during the instantiation step.
6. Click the **Save** button.

On the Console, you must now configure your domain so your firewall protects it.

7. On the **Products menu**, select **Woklodas**.
8. Click on the domain you want to protect with your IP Address Reputation function.
9. In the **Settings** section, click on the `Firewall` selector and choose the firewall you created.
10. Click the **Save** button.

Done. Now the IP Address Reputation integration is running for every request made to the domain you indicated.
---

#### Important

For each field present in the results, the integration will add a request header with the prefix `IPQS`. For example, if the request has an `ASN` field, the header will have an `IPQS-ASN` with the same value added to the header. You can also use this information to create and manage your decisions in the Rules Engine. You can check the [full list of fields](https://www.ipqualityscore.com/documentation/proxy-detection-api/overview).

It's a good practice to create an application rule redirecting your request to another URL/Origin whenever the risk score is greater than 85. If you want or need it, you can follow the usage of your API key through the IPQualityScore dashboard. Every request to your firewall will count as a new request for IP address lookup.

---