GreyNoise Review

What GreyNoise Is

GreyNoise operates a sensor network across IPv4. Sensors collect unsolicited connections, and source IPs get classified. This feeds a database of IPs doing mass scans.

GreyNoise helps analysts who waste time on false positives. Most IPs hitting your firewall are not targeting you; they are automated scanners sweeping the internet. GreyNoise labels these IPs: Benign, known good scanners; Malicious, associated with threats; Unknown, no data.

The RIOT dataset lists major infrastructure providers, such as Google, AWS, and Cloudflare. If an IP in your logs matches, RIOT flags it as benign.

What It's Good For

GreyNoise filters SIEM alerts. It looks up an IP and helps you determine if it's a harmless scanner or something malicious.

GreyNoise helps deprioritize benign traffic, saving you time. You can then focus on real threats.

GreyNoise is useful for threat hunting. It identifies and tags scanner behavior, making it searchable. You can find IPs tied to specific tools or campaigns, such as ZMap scans on port 22 or a specific CVE scanner.

When new CVEs are released, GreyNoise quickly detects spikes in scanning activity. Within hours, it shows up, and you can query those IPs to see who's exploiting them.

GreyNoise boosts automated enrichment by filtering out benign scanners. Your workflow becomes more efficient.

Getting Started

The Community tier is free, offering 50 IP lookups per day, API and web UI access, and limited GNQL queries.

The free tier allows users to try it out by grabbing 10-20 IPs from recent SIEM alerts and looking them up, often finding benign scanners.

The API counts a lookup as one GET call.

GET https://api.greynoise.io/v3/community/{ip}
Headers: key: YOUR_API_KEY

The response contains a few key fields. The noise field is a boolean that indicates if the IP is mass scanning. The riot field is a boolean that marks known safe infrastructure. You receive a classification, which can be benign, malicious, or unknown. The name field tells you the specific scanner or service.

GNQL Filter Reference

GNQL cuts through the noise, filtering the entire internet scan dataset. Hunter tier users get full access, community users get partial. Key filters comprise IP address, port, protocol, country, city, organization, OS, service, vulnerability. Users query these fields to obtain precise results.

frontmatter unchanged

Combining Filters for Precise Results

You can refine your search by combining filters. Use boolean operators to create complex queries. A query like classification:malicious tag:Mirai country:RU returns IPs from Russia that are conducting Mirai-related scanning and are classified as malicious.

Combining filters gives you specificity, which is the power of getting precise results. No more results.

Pricing

Annual pricing available at a discount. Contact sales for a quote.

Limitations

GreyNoise only tracks IPs that scan the entire internet. If an IP only targets specific hosts or hosts C2 servers, GreyNoise labels it "unknown", they don't have a record of it hitting their sensors.

GreyNoise isn't for identity-based OSINT; it doesn't track individuals. It only provides network-layer classification, and only for mass-scanning IPs.

GreyNoise doesn't correlate CVEs with service banners; it flags IPs scanning for specific CVEs. Your asset's vulnerability is your responsibility.

The free tier offers 50 API calls daily, which is enough for manual checks. For automation, the cost is $299/mo for Hunter.

An "unknown" label from GreyNoise means no mass-scanning history, but it doesn't mean it's safe; further investigation is required.

Alternatives

• Criminal IP — malicious activity scoring with CVE mapping. GreyNoise and Criminal IP complement each other: use GreyNoise to filter out confirmed benign scanner traffic, then use Criminal IP to assess malicious activity scores and vulnerability context.
• Shodan — raw device discovery and service banner indexing. Shodan tells you what services are exposed across the internet; GreyNoise tells you which IPs are scanning that internet.
• AlienVault OTX — free community threat intelligence feeds with IP reputation data. OTX covers more general threat indicators but lacks GreyNoise's continuous mass-scanning classification.
• VirusTotal — file, URL, and IP reputation aggregation from dozens of AV and TI vendors. VirusTotal's IP reputation is broader in source count but shallower in scanning behavior classification.

Bottom Line

GreyNoise handles internet background noise. SOC analysts use it to sort through SIEM alerts. The Community tier works for manual checks. The Hunter tier adds automation and bulk data enrichment.

GreyNoise and Criminal IP complement each other. GreyNoise filters out noise, Criminal IP scores the rest. You get a clearer picture.

See Also

Threat Intelligence Platforms: A Reconnaissance Guide

Threat intelligence platforms track attackers. Companies use them to monitor their exposure, respond to incidents, and understand threat actor tactics.

What Threat Intelligence Platforms Do

These platforms collect data from various sources, such as OSINT, dark web chatter, and security blogs. They analyze it to identify patterns. Patterns help you anticipate attacks.

Key Features

The key features include data collection, ingesting threat feeds, vulnerability databases, and dark web chatter. Analysis applies machine learning, natural language processing to identify trends. Dashboards show threat heatmaps, timelines, and geographic distribution.

Top Threat Intelligence Platforms

The top threat intelligence platforms are Maltego, CrowdStrike Falcon Insight, and ThreatConnect. Maltego visualizes relationships between IP addresses, domains, and threat actors. CrowdStrike Falcon Insight offers real-time threat detection and response. ThreatConnect provides analytics and visualization for threat intelligence.

How to Choose

Consider your needs. Do you track specific threats or monitor overall exposure? Some platforms specialize; others offer broad coverage, such as Maltego, CrowdStrike Falcon Insight, ThreatConnect.

Threat Intelligence in Practice

Use these platforms to enhance your security posture. They help you stay ahead of attackers. Stay informed and adapt quickly.

Threat Hunting Tools: A Reconnaissance Guide

Threat hunting tools help you find what's hiding. These tools dig deeper into your network, uncovering threats that automated systems might miss.

What Threat Hunting Tools Do

Threat hunting tools query your network, searching for anomalies. They use various techniques, such as behavioral analysis and signature-based detection.

The key features include querying, which lets you ask specific questions about your network. Analysis applies various techniques to identify potential threats.

Top Threat Hunting Tools

The top threat hunting tools are Splunk, ELK Stack, and BloodHound. Splunk analyzes log data to detect threats. ELK Stack offers log analysis and visualization. BloodHound maps your Active Directory, identifying potential attack paths.

Think about your network. What tools will help you find threats there? Consider integration with existing security tools.

Threat Hunting in Practice

Threat hunting is proactive. You're looking for threats that automated tools might overlook. Stay vigilant and adapt your strategy as needed.

Related Comparisons

• Best Threat Intelligence Platforms
• Best Threat Hunting Tools

Further Reading

• GreyNoise official site
• GreyNoise documentation