> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abusix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Customer and contract resolution

> Learn how to resolve customers in Guardian Ops using resolvers.

Customer resolution lays the foundation for effective abuse management in Guardian Ops. It helps link abuse reports to the correct customers, contracts, and tenants, ensuring that the right actions can be taken accurately. This also helps identify the responsible parties and manage abuse cases efficiently.

* Customers are individuals or companies; essentially, it's an entity with an identifier.
* Contracts are a customer's specific resources (e.g., mobile vs. DSL, servers, domains, etc.).
* Tenants can distinguish between subsidiaries that could have clashing customer identifiers

Each of the above entities can have additional metadata assigned to provide details and metadata that your agents can use to understand the specific nature of a customer or contract (e.g., resellers, external vs. internal, etc.).

Guardian Ops offers two resolution methods: the **Static** and the **API-based** resolver. While we recommend API-based resolution, static resolution provides an alternative with a range of functionality. This lets you choose the best method for your network and customer management setup.

> 💡 If you need time to prepare your API for sophisticated API resolution, begin with the Static resolver for IP-based resolution and upgrade to the API resolver when ready.

Guardian Ops requires a customer identifier to process abuse reports. This can be achieved in two ways:

1. **API requests:**\
   Guardian Ops can call your API with data from reports (e.g. IP address, timestamp when the event occurred, port, etc.) to retrieve the correct customer identifier and related information (customer, contract or tenant data). We strongly recommend this approach, especially for dynamic IP assignments or when additional metadata is needed.
   Oftentimes, IPs or domains change, but the fraudulent customer or contract stays the same. Abuse reports with changing IP addresses or domains that belong to the same customer can only be aggregated when using API customer resolution.
2. **Static fields:**\
   Guardian Ops maps values from any event attribute (IP addresses, domains, headers, etc.) to customer\_id, tenant\_id, and contract\_id fields.
   If you cannot use resolution via API, we recommend to use static resolving using IP or domain.

Please select the method that best fits your network and customer management setup, and follow the instructions below to set it up.

<Tabs>
  <Tab title="API Resolution">
    Customer Resolution via API provides the most flexibility, enabling dynamic resolution and customer enrichment. Most importantly, it aggregates abuse reports to the same customer even when IPs or domains change - tracking the fraudulent actor, not just their current infrastructure.
    It allows you to pass information (such as the **IP address**, **event timestamp**, **port**, etc.) from an abuse report to your **API endpoint**. Your backend system (e.g., CRM or RADIUS) then returns the correct **Customer Identifier** and, if you want, other data that Guardian Ops can store.

    ### Common Use Case

    Look up the customer assigned to an IP address at the time of an event using:

    * `IP address`
    * `Event timestamp`

    ### How to Configure API resolution

    1. Go to [app.abusix.com](http://app.abusix.com).
    2. Navigate to **Settings** → **Guardian Ops** → [Inbound Processing](https://app.abusix.com/guardian/ops/settings/inbound-processing)
    3. Add an **API Caller** node to your workflow
    4. Provide the **API endpoint** and any **parameters** your API requires for resolution.
    5. Hit **"Test"** to test credentials and receive a response to configure the mapping. To set up customer resolution, assigning a customer ID is required. **Contract ID**, **tenant ID** or fields related to these entities are optional.
       -> **Contracts** can be used to split your customers to separate automation later. For example, use contracts if you want fine grained control on which contract of a customer should be handled in automation.
    6. Save and continue to edit or activate your new Inbound Processing draft.

    > ⚠️ If your API is behind a firewall, ensure the following IPs are in your allowlists and not blocked by any firewall:
    >
    > 18.193.183.51 | 52.57.46.129 | 18.158.191.233

    <div className="mx-auto" style={{ width: "90%" }}>
      <img src="https://mintcdn.com/abusixinc/2veW4UItlUIOaDWZ/images/gops/gops-customer-resolution-api-caller-full.png?fit=max&auto=format&n=2veW4UItlUIOaDWZ&q=85&s=b81ad9bf502c6bf28688094c3afca16f" alt="API Caller node configuration for customer resolution" className="border mb-2" style={{ width: "100%" }} width="1439" height="3661" data-path="images/gops/gops-customer-resolution-api-caller-full.png" />

      <p className="text-sm text-gray-600 mb-4 ml-4">
        <strong>API Caller Configuration:</strong> Complete setup showing API endpoint configuration, parameter mapping, and customer resolution fields.
      </p>
    </div>
  </Tab>

  <Tab title="Static Resolver">
    The **Static Resolver** provides multiple resolver functions.

    ### What Is the Static Resolver?

    The **Static Resolver** maps values from any attribute within an event (JSON representation of an abuse report) to three fixed output fields: `customer_id`, `tenant_id`, and `contract_id`. This approach ensures a consistent data structure while maintaining flexibility in source selection. It also provides functionality to transform data, such as resolving domains to IP addresses. More functions will be added in the future.

    <div className="mx-auto" style={{ width: "90%" }}>
      <img src="https://mintcdn.com/abusixinc/3l1oFFHREBJebIGK/images/gops/gops-resolvers-static-resolver.png?fit=max&auto=format&n=3l1oFFHREBJebIGK&q=85&s=7433aba5583a15028618ae9deb42e89e" alt="Static Resolver Node configuration" className="border mb-2" style={{ width: "100%" }} width="878" height="1045" data-path="images/gops/gops-resolvers-static-resolver.png" />

      <p className="text-sm text-gray-600 mb-4 ml-4">
        <strong>Static Resolver Node:</strong> Map event fields to customer, tenant, or contract identifiers for flexible customer resolution.
      </p>
    </div>

    ### Common Use Cases

    * IP-based resolution (default configuration)
    * Domain-based resolution
    * Resolution from evidence headers (e.g. `from` header in spam evidence attached to reports) \*coming soon

    ### How to Configure a Static Resolver

    1. Go to [app.abusix.com](http://app.abusix.com)
    2. Navigate to **Settings** → **Guardian Ops** → [Inbound Processing](https://app.abusix.com/guardian/ops/settings/inbound-processing)
    3. Add a **Static Resolver** node to your workflow
    4. Map selected event attributes to customer ID (mandatory), contract ID and tenant ID.
    5. Save and continue to edit or activate your new Inbound Processing draft.
  </Tab>
</Tabs>