GreyNoise Indicator Feed

category: Data Enrichment & Threat Intelligence
provider: GreyNoise
sectionorder:
- Connect
- Collect
commonfields:
  id: GreyNoise Indicator Feed
  version: -1
configuration:
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  type: 8
  required: false
  section: Collect
- display: Username
  name: credentials
  type: 9
  required: false
  section: Connect
- additionalinfo: Indicators from this integration instance will be marked with this reputation
  defaultvalue: feedInstanceReputationNotSet
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
  section: Collect
- additionalinfo: Reliability of the source providing the intelligence data
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  section: Collect
- additionalinfo: Select which GreyNoise Feed to ingest.  Select the option that includes the classification(s) of the indicator you want to ingest.  By selection a option with more than one classification, the feed will include indicators that match any of the selected classifications.  The All option will include all indicators.  All options ingest indicators from the last 24 hours.
  defaultvalue: Malicious
  display: GreyNoise Feed Type
  name: greynoiseFeedType
  options:
  - Benign
  - Malicious
  - Suspicious
  - Benign + Malicious
  - Malicious + Suspicious
  - Benign + Malicious + Suspicious
  - All
  required: true
  type: 15
  section: Collect
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
  section: Collect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  display: Traffic Light Protocol Color
  name: tlp_color
  defaultvalue: GREEN
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
  section: Collect
- defaultvalue: indicatorType
  display: ''
  name: feedExpirationPolicy
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
  section: Collect
- defaultvalue: '10080'
  display: ''
  name: feedExpirationInterval
  type: 1
  required: false
  section: Collect
- defaultvalue: '1440'
  display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
  section: Collect
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
description: "GreyNoise is a cybersecurity platform that collects and analyzes Internet-wide scan and attack traffic. With this integration, users can contextualize existing alerts, filter false-positives, identify compromised devices, and track emerging threats. This Integration provides a feed of IPv4 Internet Scanners from GreyNoise."
display: GreyNoise Indicator Feed
name: GreyNoise Indicator Feed
script:
  commands:
  - description: Gets the feed indicators.
    name: greynoise-get-indicators
    outputs:
    - contextPath: GreyNoiseFeed.Indicators.Value
      description: 'The value of the indicator.'
      type: String
    - contextPath: GreyNoiseFeed.Indicators.Type
      description: 'The type of the indicator.'
      type: String
    - contextPath: GreyNoiseFeed.Indicators.Tags
      description: 'The GreyNoise tags associated with the indicator.'
      type: String
  dockerimage: demisto/greynoise:1.0.0.10133006
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests
fromversion: 6.10.0