GreyNoise Community

GreyNoise is a cybersecurity platform that collects and analyzes Internet-wide scan and attack traffic. With this integration, users can contextualize existing alerts, filter false-positives, identify compromised devices, and track emerging threats. This Integration is design specifically for GreyNoise Community users and only provides the subset of intel available via the GreyNoise Community API.

Data Enrichment & Threat Intelligence · GreyNoise

Details

IDGreyNoise Community
ProviderGreyNoise
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/greynoise:1.0.0.10926121
Supported ModulesAgentix XSIAM

README

GreyNoise tells security analysts what not to worry about. We do this by curating data on IPs that saturate security
tools with noise. This unique perspective helps analysts confidently ignore irrelevant or harmless activity, creating
more time to uncover and investigate true threats. The Action allows IP enrichment via the GreyNoise Community API.

The GreyNoise Integration
should be used by customers with a paid subscription to GreyNoise with the exception of the IP command, which is available with limit results to free users.

This integration was integrated and tested with version 3.0.0 of GreyNoise Python SDK.
Supported Cortex XSOAR versions: 6.0.0 and later.

Configure GreyNoise in Cortex

Parameter Description Required
api_key GreyNoise API Key True
proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

greynoise-community-lookup

Queries IPs in the GreyNoise Community API.

Base Command

ip

Input

Argument Name Description Required
ip List of IPs. Required

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String The reliability value.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
IP.Address string IP address.
IP.ASN string ASN Value.
IP.Geo.Country string Source Country.
IP.Geo.Description string Additional Geo Information - City, Region, Country Code.
IP.Hostname string rDNS value.
IP.Malicious.Description string Description of Malicious IP.
IP.Malicious.Vendor string Vendor Identifying IP as Malicious.
GreyNoise.IP.actor string Name of identified organization scanning.
GreyNoise.IP.address string The IP address of the scanning device IP.
GreyNoise.IP.bot boolean Identifies if the IP is associated with BOT activity.
GreyNoise.IP.category string If a business service, identifies the category.
GreyNoise.IP.classification string Whether the device has been categorized as unknown, benign, or malicious.
GreyNoise.IP.description string If there is a business service, provides a description of the provider.
GreyNoise.IP.explanation string If there is a business service, provides an explanation of the category.
GreyNoise.IP.first_seen string The date of the first observed scanning activity.
GreyNoise.IP.found boolean Whether the IP is found in GreyNoise.
GreyNoise.IP.ip string The IP address of the scanning device IP.
GreyNoise.IP.last_seen string The date of the last observed scanning activity.
GreyNoise.IP.last_seen_timestamp string The timestamp of the last observed scanning activity.
GreyNoise.IP.last_updated string If there is a business service, indicates the last time the source record was parsed.
GreyNoise.IP.metadata.asn string The autonomous system identification number.
GreyNoise.IP.metadata.carrier string The carrier information for the IP address.
GreyNoise.IP.metadata.category string Whether the device belongs to a business, isp, hosting, education, or mobile network.
GreyNoise.IP.metadata.datacenter string The datacenter information for the IP address.
GreyNoise.IP.metadata.destination_countries array The list of countries targeted by scanning.
GreyNoise.IP.metadata.destination_country_codes array The list of country codes targeted by scanning.
GreyNoise.IP.metadata.domain string The domain associated with the IP address.
GreyNoise.IP.metadata.latitude number The latitude coordinate of the IP address location.
GreyNoise.IP.metadata.longitude number The longitude coordinate of the IP address location.
GreyNoise.IP.metadata.mobile boolean Whether the device is on a mobile network.
GreyNoise.IP.metadata.organization string The organization that owns the network that the IP address belongs to.
GreyNoise.IP.metadata.os string The name of the operating system of the device.
GreyNoise.IP.metadata.rdns string Reverse DNS lookup of the IP address.
GreyNoise.IP.metadata.rdns_parent string The parent domain of the reverse DNS lookup.
GreyNoise.IP.metadata.rdns_validated boolean Whether the reverse DNS lookup has been validated.
GreyNoise.IP.metadata.region string The full name of the region the device is geographically located in.
GreyNoise.IP.metadata.sensor_count number The number of sensors that observed activity from this IP.
GreyNoise.IP.metadata.sensor_hits number The number of sensors events recorded from this IP.
GreyNoise.IP.metadata.single_destination boolean Whether the IP targets a single destination.
GreyNoise.IP.metadata.source_city string The city where the IP is geographically located.
GreyNoise.IP.metadata.source_country string The full name of the IP source country.
GreyNoise.IP.metadata.source_country_code string The country code of the IP source country.
GreyNoise.IP.name string If there is a business service, indicates the provider name.
GreyNoise.IP.raw_data.source.bytes number The number of bytes sent by the source.
GreyNoise.IP.reference string If there is a business service, indicates the references used to validate the entry.
GreyNoise.IP.riot boolean Whether the IP is in the business services dataset.
GreyNoise.IP.seen boolean Whether the IP is in the internet scanner dataset.
GreyNoise.IP.spoofable boolean Whether the IP complete a three-way handshake during scanning.
GreyNoise.IP.tags.category string The category of the given tag.
GreyNoise.IP.tags.created date The date the tag was added to the GreyNoise system.
GreyNoise.IP.tags.description string A description of what the tag identifies.
GreyNoise.IP.tags.id string The unique id of the tag.
GreyNoise.IP.tags.intention string The intention of the associated activity the tag identifies.
GreyNoise.IP.tags.name string The name of the tag.
GreyNoise.IP.tags.recommend_block boolean Indicates if IPs associated with this tag should be blocked.
GreyNoise.IP.tags.references string A list of references used to create the tag.
GreyNoise.IP.tags.slug string The unique slug of the tag.
GreyNoise.IP.tags.updated_at date The date the tag was last updated.
GreyNoise.IP.tor boolean Whether the IP is on the known TOR exit node list.
GreyNoise.IP.trust_level string If there is a business service, indicates the level of trustworthiness.
GreyNoise.IP.vpn boolean Whether the IP is associated with a knwon VPN service.
GreyNoise.IP.vpn_service string If the IP is part of a VPN, provides the name of the service.

Command Example

!greynoise-community-lookup ips=1.1.1.1
!IPReputation ip=1.1.1.1

Human Readable Output

IP: 1.1.1.1 found with Reputation: Good

Belongs to Common Business Service: Cloudflare Public DNS

GreyNoise Business Service Intelligence Lookup

IP Business Service Category Name Trust Level Description Last Updated
1.1.1.1 true public_dns Cloudflare Public DNS 1 - Reasonably Ignore Cloudflare, Inc. is an American web infrastructure and website security company, providing content delivery network (CDN) services, distributed denial of service (DDoS) mitigation, Internet security, and distributed domain name system (DNS) services. This is their public DNS offering. 2025-06-26T09:10:56Z

IP: 1.1.1.1 No Mass-Internet Scanning Observed

GreyNoise Internet Scanner Intelligence Lookup

IP Internet Scanner
1.1.1.1 false

Configuration parameters

  • integrationReliability — Integration Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • api_key — API Key
  • credentials — API Key
  • proxy — Use system proxy settings

Commands (1)

  • ip

    Gathers information on the IP from the GreyNoise Community API.

Source

GreyNoise_Community.py GreyNoise_Community_test.py GreyNoise_Community.yml GreyNoise_Community_description.md
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: GreyNoise
sectionorder:
- Connect
commonfields:
  id: GreyNoise Community
  version: -1
configuration:
- display: Integration Reliability
  name: integrationReliability
  defaultvalue: C - Fairly reliable
  type: 15
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  additionalinfo: Reliability of the source providing the intelligence data
  required: false
  section: Connect
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
  section: Connect
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
  section: Connect
- display: API Key
  name: api_key
  required: false
  type: 4
  hidden: true
  section: Connect
- display: API Key
  name: credentials
  required: false
  type: 9
  displaypassword: API Key
  hiddenusername: true
  section: Connect
- additionalinfo: Whether to use XSOAR's system proxy settings to connect to the API.
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: GreyNoise is a cybersecurity platform that collects and analyzes Internet-wide scan and attack traffic. With this integration, users can contextualize existing alerts, filter false-positives, identify compromised devices, and track emerging threats. This Integration is design specifically for GreyNoise Community users and only provides the subset of intel available via the GreyNoise Community API.
display: GreyNoise Community
name: GreyNoise Community
script:
  commands:
  - arguments:
    - default: true
      description: A comma-separated list of IPs.
      isArray: true
      name: ip
      required: true
    description: Gathers information on the IP from the GreyNoise Community API.
    name: ip
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: The reliability of the data.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: IP.ASN
      description: The autonomous system name for the IP address.
      type: string
    - contextPath: IP.Address
      description: IP address.
      type: string
    - contextPath: IP.address
      description: IP address.
      type: string
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: string
    - contextPath: IP.Geo.Description
      description: Additional information about the location such as city and region.
      type: string
    - contextPath: IP.Hostname
      description: The hostname that is mapped to IP address.
      type: string
    - contextPath: IP.Malicious.Vendor
      description: The vendor reporting the IP address as malicious.
      type: string
    - contextPath: IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: string
    - contextPath: GreyNoise.IP.actor
      description: The overt actor the device has been associated with.
      type: string
    - contextPath: GreyNoise.IP.address
      description: The IP address of the scanning device IP.
      type: string
    - contextPath: GreyNoise.IP.bot
      description: Whether the IP is associated with BOT activity.
      type: boolean
    - contextPath: GreyNoise.IP.category
      description: The category of the business service.
      type: string
    - contextPath: GreyNoise.IP.classification
      description: Whether the device has been categorized as unknown, benign, or malicious.
      type: string
    - contextPath: GreyNoise.IP.description
      description: Description of the business service.
      type: string
    - contextPath: GreyNoise.IP.explanation
      description: Explanation of why the IP is considered a business service.
      type: string
    - contextPath: GreyNoise.IP.first_seen
      description: The date the device was first observed by GreyNoise. Format is ISO8601.
      type: date
    - contextPath: GreyNoise.IP.found
      description: Whether the IP was found in GreyNoise records.
      type: boolean
    - contextPath: GreyNoise.IP.ip
      description: The IP address of the scanning device IP.
      type: string
    - contextPath: GreyNoise.IP.last_seen
      description: The date the device was last observed by GreyNoise. Format is ISO8601.
      type: date
    - contextPath: GreyNoise.IP.last_seen_timestamp
      description: The timestamp when the device was last observed by GreyNoise.
      type: string
    - contextPath: GreyNoise.IP.last_updated
      description: When the business service information was last updated.
      type: date
    - contextPath: GreyNoise.IP.metadata.asn
      description: The autonomous system identification number.
      type: string
    - contextPath: GreyNoise.IP.metadata.carrier
      description: The carrier information for the IP address.
      type: string
    - contextPath: GreyNoise.IP.metadata.category
      description: Whether the device belongs to a business, isp, hosting, education, or mobile network.
      type: string
    - contextPath: GreyNoise.IP.metadata.datacenter
      description: The datacenter information for the IP address.
      type: string
    - contextPath: GreyNoise.IP.metadata.destination_countries
      description: The list of countries targeted by scanning.
      type: array
    - contextPath: GreyNoise.IP.metadata.destination_county_codes
      description: The list of countries (codes) targeted by scanning.
      type: array
    - contextPath: GreyNoise.IP.metadata.domain
      description: The domain associated with the IP address.
      type: string
    - contextPath: GreyNoise.IP.metadata.latitude
      description: The latitude coordinate of the IP address location.
      type: number
    - contextPath: GreyNoise.IP.metadata.longitude
      description: The longitude coordinate of the IP address location.
      type: number
    - contextPath: GreyNoise.IP.metadata.mobile
      description: Whether the device is on a mobile network.
      type: boolean
    - contextPath: GreyNoise.IP.metadata.organization
      description: The organization that owns the network that the IP address belongs to.
      type: string
    - contextPath: GreyNoise.IP.metadata.os
      description: The name of the operating system of the device.
      type: string
    - contextPath: GreyNoise.IP.metadata.rdns
      description: Reverse DNS lookup of the IP address.
      type: string
    - contextPath: GreyNoise.IP.metadata.rdns_parent
      description: The parent domain of the reverse DNS lookup.
      type: string
    - contextPath: GreyNoise.IP.metadata.rdns_validated
      description: Whether the reverse DNS lookup has been validated.
      type: boolean
    - contextPath: GreyNoise.IP.metadata.region
      description: The full name of the region the device is geographically located in.
      type: string
    - contextPath: GreyNoise.IP.metadata.sensor_count
      description: The number of sensors that observed activity from this IP.
      type: number
    - contextPath: GreyNoise.IP.metadata.sensor_hits
      description: The number of sensors events recorded from this IP.
      type: number
    - contextPath: GreyNoise.IP.metadata.single_destination
      description: Whether the IP targets a single destination.
      type: boolean
    - contextPath: GreyNoise.IP.metadata.source_city
      description: The city where the IP is geographically located.
      type: string
    - contextPath: GreyNoise.IP.metadata.source_country
      description: The full name of the IP source country.
      type: string
    - contextPath: GreyNoise.IP.metadata.source_country_code
      description: The country code of the IP source country.
      type: string
    - contextPath: GreyNoise.IP.name
      description: The name of the business service.
      type: string
    - contextPath: GreyNoise.IP.raw_data.source.bytes
      description: The number of bytes sent by the source.
      type: number
    - contextPath: GreyNoise.IP.reference
      description: Reference link for the business service.
      type: string
    - contextPath: GreyNoise.IP.riot
      description: Whether the IP is a common business service.
      type: boolean
    - contextPath: GreyNoise.IP.seen
      description: IP is in record with GreyNoise.
      type: boolean
    - contextPath: GreyNoise.IP.spoofable
      description: Boolean indicates if IP is spoofable.
      type: boolean
    - contextPath: GreyNoise.IP.tags.category
      description: The category of the given tag.
      type: string
    - contextPath: GreyNoise.IP.tags.created
      description: The date the tag was added to the GreyNoise system.
      type: date
    - contextPath: GreyNoise.IP.tags.description
      description: A description of what the tag identifies.
      type: string
    - contextPath: GreyNoise.IP.tags.id
      description: The unique id of the tag.
      type: string
    - contextPath: GreyNoise.IP.tags.intention
      description: The intention of the associated activity the tag identifies.
      type: string
    - contextPath: GreyNoise.IP.tags.name
      description: The name of the tag.
      type: string
    - contextPath: GreyNoise.IP.tags.recommend_block
      description: Indicates if IPs associated with this tag should be blocked.
      type: boolean
    - contextPath: GreyNoise.IP.tags.references
      description: A list of references used to create the tag.
      type: string
    - contextPath: GreyNoise.IP.tags.slug
      description: The unique slug of the tag.
      type: string
    - contextPath: GreyNoise.IP.tags.updated_at
      description: The date the tag was last updated.
      type: date
    - contextPath: GreyNoise.IP.tor
      description: Whether or not the device is a known Tor exit node.
      type: boolean
    - contextPath: GreyNoise.IP.trust_level
      description: If the IP is a business service, how trustworthy is the IP.
      type: string
    - contextPath: GreyNoise.IP.vpn
      description: Whether the device is VPN endpoint or not.
      type: boolean
    - contextPath: GreyNoise.IP.vpn_service
      description: The name of the VPN service provider of the device.
      type: string
    - contextPath: GreyNoise.IP.noise
      description: IP is in record with GreyNoise.
      type: boolean
    - contextPath: GreyNoise.IP.link
      description: Link to the IP in GreyNoise.
      type: string
    - contextPath: GreyNoise.IP.message
      description: Message from GreyNoise API.
      type: string
  dockerimage: demisto/greynoise:1.0.0.10926121
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 5.5.0