Skip to main content
Cotool enriches logs ingested into Cotool Logs with IP context at ingest time. Events that carry a public client IP gain geolocation and ASN columns (geo_country_iso_code, geo_country_name, geo_continent_code, geo_continent_name, as_number, as_organization_name, as_domain), so questions like “logins from outside the US” or “activity from hosting-provider ASNs” are a single query with no external lookups.

​
How it works

  • IPs are resolved against the IPinfo Lite database, which Cotool downloads and refreshes periodically and keeps locally on Cotool’s servers — no IP addresses are ever sent to an external service during ingest.
  • Only publicly routable IPs are enriched; private and reserved-range IPs index with NULL enrichment columns.
  • Enrichment happens once, at ingest time. Events indexed before enrichment was enabled keep NULL columns.

​
Enabling and disabling

The IPinfo integration on the Integrations page is connected automatically and requires no credentials. Disabling it stops IP enrichment for newly ingested events; re-enabling resumes enrichment from that point forward.

​
Attribution

IP address data powered by IPinfo. Cotool uses the IPinfo Lite database, which is licensed under CC BY-SA 4.0.