> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Investigate an IP

> Build host context, inspect services, trace DNS, and find related reporting

Use this workflow when an IP appears in an alert, report, log, or case and you
need a fast, defensible picture of the infrastructure around it.

<Info>
  This workflow uses `1.1.1.1` as an example. Replace it with the address you are
  investigating.
</Info>

## Investigation path

<img src="https://mintcdn.com/infrawatch/gwI605YQKPrABsns/images/sections/investigation-path.svg?fit=max&auto=format&n=gwI605YQKPrABsns&q=85&s=5a46ff2a937117c5d97ab1aa49f39938" alt="An IP address leads to host context, which branches into exposed services, passive DNS, and OSINT reports" className="my-8 w-full rounded-2xl" width="640" height="280" data-path="images/sections/investigation-path.svg" />

<Steps>
  <Step title="Build host context">
    Start with `hosts` for one compact view of the address:

    ```bash theme={null}
    curl --get "https://api.infrawatch.com/api/v1/search/hosts" \
      --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
      --data-urlencode "q=ip:1.1.1.1" \
      --data "limit=1"
    ```

    Review the current ASN, ISP, country, first and last observation times,
    ports, protocols, visible tags, and bounded service summaries.

    <Note>
      `services_truncated: true` means the host has more services than the
      summaries returned here. Continue to the service dataset for the complete
      matching page.
    </Note>
  </Step>

  <Step title="Inspect every matching service">
    Search `services` when you need endpoint-level HTTP, TLS, banner, status,
    fingerprint, and observation details:

    ```bash theme={null}
    curl --get "https://api.infrawatch.com/api/v1/search/services" \
      --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
      --data-urlencode "q=ip:1.1.1.1" \
      --data "limit=100"
    ```

    Each result represents one observed endpoint. Treat different ports and
    transports as separate evidence.
  </Step>

  <Step title="Pivot to names">
    Find DNS names observed pointing to the address:

    ```bash theme={null}
    curl --get "https://api.infrawatch.com/api/v1/search/dns" \
      --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
      --data-urlencode "q=answer_ip:1.1.1.1" \
      --data "limit=100"
    ```

    Use `first_seen_at` and `last_seen_at` to distinguish current-looking
    relationships from older infrastructure history. DNS observations are
    returned as UTC calendar dates.
  </Step>

  <Step title="Find related reporting">
    Search public intelligence associated with the address:

    ```bash theme={null}
    curl --get "https://api.infrawatch.com/api/v1/search/osint" \
      --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
      --data-urlencode "q=ip:1.1.1.1" \
      --data "limit=25"
    ```

    Results link to the original report and include its source and publication
    context.
  </Step>
</Steps>

## What to record

| Evidence                    | Why it matters                                          |
| --------------------------- | ------------------------------------------------------- |
| ASN and ISP                 | Establishes current network attribution                 |
| Ports and protocols         | Shows the externally visible attack surface             |
| HTTP, TLS, and fingerprints | Helps link technically similar services                 |
| First and last seen         | Provides temporal context for the observation           |
| DNS names                   | Reveals domains sharing or previously using the address |
| Visible tags and reports    | Adds reviewed classification and external context       |

## Continue the investigation

<CardGroup cols={2}>
  <Card title="Trace a DNS relationship" icon="https://mintcdn.com/infrawatch/hFIgmGIh7O3VGQHG/images/products/dns.svg?fit=max&auto=format&n=hFIgmGIh7O3VGQHG&q=85&s=47a48af3a654f274eadb1754689f8dc4" href="/use-cases/pivot-through-passive-dns" width="32" height="32" data-path="images/products/dns.svg">
    Pivot from a discovered name to its other observed answers.
  </Card>

  <Card title="Hunt similar services" icon="https://mintcdn.com/infrawatch/gCEz_Bv1hOrMPG8n/images/products/use-cases.svg?fit=max&auto=format&n=gCEz_Bv1hOrMPG8n&q=85&s=038f2239f51bdde5dd89ff8ef00d88e9" href="/use-cases/hunt-exposed-services" width="32" height="32" data-path="images/products/use-cases.svg">
    Turn a protocol, TLS fact, fingerprint, or tag into a broader hunt.
  </Card>
</CardGroup>