ipinfo-alert-enrichment-workers

Privacy-first IP enrichment for Slack alerts using Cloudflare Workers and IPinfo.

This public repo is a sanitized showcase of an alert enrichment pattern:

• receive an intentional signal
• enrich the IP with IPinfo
• classify the result for triage
• post a clear Slack message

It is built for signal over noise and designed to avoid exposing private infrastructure details.

---

What this project demonstrates

This repository shows how to:

• accept Slack slash commands for on-demand IP lookup
• optionally accept a generic security event from an upstream source
• enrich IP data with IPinfo
• classify IP context into a human-readable triage result
• send bot-authored Slack messages from Cloudflare Workers

This is an example integration and demo implementation, not a production SIEM.

---

Public-repo sanitization notes

This version is intentionally debranded and sanitized:

• no real worker names
• no real Slack channel names
• no real workspace IDs
• no real upstream vendor identifiers
• no private URLs, account IDs, or deployment routes
• no secrets or live environment values

---

Architecture

Slack slash command or upstream event
              |
              v
     Cloudflare Worker
              |
              v
           IPinfo
              |
              v
     Slack bot message

Core design goals:

• event-driven
• privacy-first
• no persistence by default
• explainable output
• low infrastructure overhead

---

Example use cases

1. Manual enrichment

An analyst runs a Slack command such as:

/ip 8.8.8.8

The worker sends a fast ephemeral ACK, enriches the IP via IPinfo, and posts a formatted message to Slack.

2. Alert enrichment

An upstream alerting system posts a generic security event with an IP. The worker enriches the IP, scores the result using simple logic, and posts a triage-ready message to Slack.

---

Features

• fast Slack ACK for slash commands
• async enrichment using ctx.waitUntil
• IPinfo-based context lookup
• ASN normalization
• network-type classification
• simple severity labeling
• country flag formatting
• generic ingestion pathway for future event sources
• privacy-safe defaults

---

Repo structure

.
├── README.md
├── worker.public.js
├── .env.example
├── wrangler.toml.example
├── docs/
│   ├── ARCHITECTURE.md
│   ├── USAGE.md
│   ├── SECURITY.md
│   ├── SAMPLE_PAYLOADS.md
│   └── COMMIT_PLAN.md
└── examples/
    └── sample-event.json

---

Environment variables

See .env.example for the public variable template.

Main values:

• IPINFO_TOKEN
• SLACK_BOT_TOKEN
• INGEST_SHARED_SECRET
• DEFAULT_ALERT_CHANNEL
• DEFAULT_HEALTH_CHANNEL

---

Security model

This demo intentionally avoids:

• storing lookup history
• ingesting raw traffic
• logging full payload contents by default
• exposing internal infrastructure naming

Only intentionally submitted IPs, or IPs included in an upstream alert event, are enriched.

---

Deployment outline

1. Create a Cloudflare Worker
2. Add the required secrets
3. Configure Slack slash command request URL
4. Optionally configure a generic upstream POST endpoint
5. Invite the Slack bot to the destination channel
6. Test manual lookup and event ingestion

Detailed steps are in docs/USAGE.md.

---

Positioning

This repo is meant to show a clean pattern for:

• IP enrichment for Slack alerts
• Cloudflare Workers + IPinfo integration
• security alert enrichment with low overhead

---

License

MIT recommended for the public example repo.