category: Data Enrichment & Threat Intelligence provider: GreyNoise sectionorder: - Connect commonfields: id: GreyNoise version: -1 configuration: - display: Integration Reliability name: integrationReliability defaultvalue: B - Usually reliable type: 15 options: - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged additionalinfo: Reliability of the source providing the intelligence data required: false section: Connect - defaultvalue: indicatorType name: feedExpirationPolicy display: '' options: - never - interval - indicatorType - suddenDeath type: 17 required: false section: Connect - defaultvalue: '20160' name: feedExpirationInterval display: '' type: 1 required: false section: Connect - display: API Key name: apikey required: false type: 4 hidden: true section: Connect - display: API Key name: credentials required: false type: 9 displaypassword: API Key hiddenusername: true section: Connect - additionalinfo: Whether to allow connections without verifying SSL certificates validity. display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - additionalinfo: Whether to use XSOAR's system proxy settings to connect to the API. display: Use system proxy settings name: proxy type: 8 required: false section: Connect defaultclassifier: 'null' description: GreyNoise is a cybersecurity platform that collects and analyzes Internet-wide scan and attack traffic. With this integration, users can contextualize existing alerts, filter false-positives, identify compromised devices, and track emerging threats. display: GreyNoise name: GreyNoise script: commands: - arguments: - default: true description: A comma-separated list of IPs. isArray: true name: ip required: true description: Runs reputation on IPs. name: ip outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Reliability description: The reliability of the data. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: IP.Address description: IP address. type: string - contextPath: IP.ASN description: The autonomous system name for the IP address. type: string - contextPath: IP.Hostname description: The hostname that is mapped to IP address. type: string - contextPath: IP.Geo.Country description: The country in which the IP address is located. type: string - contextPath: IP.Geo.Description description: Additional information about the location such as city and region. type: string - contextPath: IP.Malicious.Vendor description: The vendor reporting the IP address as malicious. type: string - contextPath: IP.Malicious.Description description: A description explaining why the IP address was reported as malicious. type: string - contextPath: GreyNoise.IP.address description: The IP address of the scanning device IP. type: string - contextPath: GreyNoise.IP.first_seen description: The date the device was first observed by GreyNoise. Format is ISO8601. type: date - contextPath: GreyNoise.IP.last_seen description: The date the device was last observed by GreyNoise. Format is ISO8601. type: date - contextPath: GreyNoise.IP.seen description: Whether the IP is in record with GreyNoise. type: boolean - contextPath: GreyNoise.IP.tags description: A list of the tags the device has been assigned over the past 90 days. type: array - contextPath: GreyNoise.IP.actor description: The overt actor the device has been associated with. type: string - contextPath: GreyNoise.IP.spoofable description: Whether the ip is spoofable. type: boolean - contextPath: GreyNoise.IP.classification description: Whether the device has been categorized as unknown, benign, or malicious. type: string - contextPath: GreyNoise.IP.cve description: CVEs associated with IP. type: array - contextPath: GreyNoise.IP.metadata.asn description: The autonomous system identification number. type: string - contextPath: GreyNoise.IP.metadata.city description: The city the device is geographically located in. type: string - contextPath: GreyNoise.IP.metadata.category description: Whether the device belongs to a business, isp, hosting, education, or mobile network. type: string - contextPath: GreyNoise.IP.metadata.country description: The full name of the country. type: string - contextPath: GreyNoise.IP.metadata.country_code description: The two-character country code of the country. type: string - contextPath: GreyNoise.IP.metadata.destination_countries description: The list of countries targeted by scanning. type: array - contextPath: GreyNoise.IP.metadata.destination_county_codes description: The list of countries (codes) targeted by scanning. type: array - contextPath: GreyNoise.IP.metadata.organization description: The organization that owns the network that the IP address belongs to. type: string - contextPath: GreyNoise.IP.metadata.os description: The name of the operating system of the device. type: string - contextPath: GreyNoise.IP.metadata.rdns description: Reverse DNS lookup of the IP address. type: string - contextPath: GreyNoise.IP.metadata.region description: The full name of the region the device is geographically located in. type: string - contextPath: GreyNoise.IP.metadata.sensor_count description: The number of sensors that observed activity from this IP. type: number - contextPath: GreyNoise.IP.metadata.sensor_hits description: The number of sensors events recorded from this IP. type: number - contextPath: GreyNoise.IP.metadata.source_country description: The full name of the IP source country. type: string - contextPath: GreyNoise.IP.metadata.source_country_code description: The country code of the IP source country. type: string - contextPath: GreyNoise.IP.metadata.tor description: Whether the device is a known Tor exit node. type: boolean - contextPath: GreyNoise.IP.tor description: Whether the device is a known Tor exit node. type: boolean - contextPath: GreyNoise.IP.raw_data.scan.port description: The port number(s) the devices has been observed scanning. type: number - contextPath: GreyNoise.IP.raw_data.scan.protocol description: The protocol of the port the device has been observed scanning. type: string - contextPath: GreyNoise.IP.raw_data.web.paths description: Any HTTP paths the device has been observed crawling the Internet for. type: array - contextPath: GreyNoise.IP.raw_data.web.useragents description: Any HTTP user-agents the device has been observed using while crawling the Internet. type: array - contextPath: GreyNoise.IP.raw_data.ja3.fingerprint description: The JA3 TLS/SSL fingerprint. type: string - contextPath: GreyNoise.IP.raw_data.ja3.port description: The corresponding TCP port for the given JA3 fingerprint. type: number - contextPath: GreyNoise.IP.raw_data.hassh.fingerprint description: HASSH hash fingerprint string. type: string - contextPath: GreyNoise.IP.raw_data.hassh.port description: TCP port connection where the HASSH hash was identified. type: number - contextPath: GreyNoise.IP.bot description: Whether the IP is associated with known bot activity or not. Common examples include credential stuffing, content scraping, or brute force attacks. type: Boolean - contextPath: GreyNoise.IP.found description: Whether the IP was found in GreyNoise records. type: boolean - contextPath: GreyNoise.IP.last_seen_timestamp description: The timestamp when the device was last observed by GreyNoise. type: string - contextPath: GreyNoise.IP.metadata.carrier description: The carrier information for the IP address. type: string - contextPath: GreyNoise.IP.metadata.datacenter description: The datacenter information for the IP address. type: string - contextPath: GreyNoise.IP.metadata.destination_asns description: The list of ASNs targeted by scanning. type: array - contextPath: GreyNoise.IP.metadata.destination_cities description: The list of cities targeted by scanning. type: array - contextPath: GreyNoise.IP.metadata.destination_country_codes description: The list of country codes targeted by scanning. type: array - contextPath: GreyNoise.IP.metadata.domain description: The domain associated with the IP address. type: string - contextPath: GreyNoise.IP.metadata.latitude description: The latitude coordinate of the IP address location. type: number - contextPath: GreyNoise.IP.metadata.longitude description: The longitude coordinate of the IP address location. type: number - contextPath: GreyNoise.IP.metadata.mobile description: Whether the device is on a mobile network. type: boolean - contextPath: GreyNoise.IP.metadata.rdns_parent description: The parent domain of the reverse DNS lookup. type: string - contextPath: GreyNoise.IP.metadata.rdns_validated description: Whether the reverse DNS lookup has been validated. type: boolean - contextPath: GreyNoise.IP.metadata.single_destination description: Whether the IP targets a single destination. type: boolean - contextPath: GreyNoise.IP.metadata.source_city description: The city where the IP is geographically located. type: string - contextPath: GreyNoise.IP.metadata.tor description: Whether the device is a known Tor exit node. type: boolean - contextPath: GreyNoise.IP.tor description: Whether the device is a known Tor exit node. type: boolean - contextPath: GreyNoise.IP.vpn description: Whether the device is a VPN endpoint or not. type: boolean - contextPath: GreyNoise.IP.vpn_service description: The name of the VPN service provider of the device. type: string - contextPath: GreyNoise.IP.category description: The category of the business service. type: string - contextPath: GreyNoise.IP.description description: Description of the business service. type: string - contextPath: GreyNoise.IP.explanation description: Explanation of why the IP is considered a business service. type: string - contextPath: GreyNoise.IP.riot description: Whether the IP is a common business service. type: boolean - contextPath: GreyNoise.IP.last_updated description: When was the last time the business service information was updated. type: date - contextPath: GreyNoise.IP.name description: The name of the business service. type: string - contextPath: GreyNoise.IP.reference description: Reference link for the business service. type: string - contextPath: GreyNoise.IP.trust_level description: If the IP is a business service, how trustworthy is the IP. type: string - contextPath: GreyNoise.IP.raw_data.http.md5 description: MD5 hashes of HTTP requests made by the device. type: array - contextPath: GreyNoise.IP.raw_data.http.method description: HTTP methods used by the device. type: array - contextPath: GreyNoise.IP.raw_data.http.path description: HTTP paths the device has been observed accessing. type: array - contextPath: GreyNoise.IP.raw_data.http.request_header description: HTTP request headers used by the device. type: array - contextPath: GreyNoise.IP.raw_data.http.useragent description: HTTP user-agents the device has been observed using. type: array - contextPath: GreyNoise.IP.raw_data.source.bytes description: The number of bytes sent by the source. type: number - contextPath: GreyNoise.IP.raw_data.tls.cipher description: TLS cipher suites used by the device. type: array - contextPath: GreyNoise.IP.raw_data.tls.ja4 description: JA4 TLS/SSL fingerprints. type: array - arguments: - default: true description: A comma-separated list of CVE IDs. isArray: true name: cve required: true description: Queries GreyNoise for CVE Vuln Intelligence. name: cve outputs: - contextPath: CVE.ID description: CVE ID. type: string - contextPath: GreyNoise.CVE.details.vulnerability_name description: 'The vulnerability name.' type: String - contextPath: GreyNoise.CVE.details.vulnerability_description description: 'A description of the vulnerability.' type: String - contextPath: GreyNoise.CVE.details.cve_cvss_score description: 'The CVSS score.' type: Number - contextPath: GreyNoise.CVE.details.product description: 'The vulnerable product.' type: String - contextPath: GreyNoise.CVE.details.vendor description: 'The vendor that produces the vulnerable product.' type: String - contextPath: GreyNoise.CVE.details.published_to_nist_nvd description: 'Is this CVE published to NIST NVD?' type: Boolean - contextPath: GreyNoise.CVE.timeline.cve_published_date description: 'When was the CVE published.' type: Date - contextPath: GreyNoise.CVE.timeline.cve_last_updated_date description: 'When was the CVE information last updated.' type: Date - contextPath: GreyNoise.CVE.timeline.first_known_published_date description: 'When first exploit associated with CVE was published.' type: Date - contextPath: GreyNoise.CVE.timeline.cisa_kev_date_added description: 'When the CVE was added to KEV.' type: Date - contextPath: GreyNoise.CVE.exploitation_details.attack_vector description: 'The attack vector category.' type: String - contextPath: GreyNoise.CVE.exploitation_details.exploit_found description: 'Whether any known exploits are available.' type: Boolean - contextPath: GreyNoise.CVE.exploitation_details.exploitation_registered_in_kev description: 'Whether exploitation has been registered in KEV database.' type: Boolean - contextPath: GreyNoise.CVE.exploitation_details.epss_score description: 'EPSS score associated with this exploitation (Exploit Prediction Scoring System).' type: Number - contextPath: GreyNoise.CVE.exploitation_stats.number_of_available_exploits description: 'The total number of exploits available (public + commercial).' type: Number - contextPath: GreyNoise.CVE.exploitation_stats.number_of_threat_actors_exploiting_vulnerability description: 'The total number of known threat actors.' type: Number - contextPath: GreyNoise.CVE.exploitation_stats.number_of_botnets_exploiting_vulnerability description: 'The total number of botnets.' type: Number - contextPath: GreyNoise.CVE.exploitation_activity.activity_seen description: 'Whether GreyNoise has seen activity.' type: Boolean - contextPath: GreyNoise.CVE.exploitation_activity.benign_ip_count_1d description: 'The total number of benign IP addresses GreyNoise has seen exercising (Scanning or Exploiting) this vulnerability in the last day.' type: Number - contextPath: GreyNoise.CVE.exploitation_activity.benign_ip_count_10d description: 'The total number of benign IP addresses GreyNoise has seen exercising (Scanning or Exploiting) this vulnerability in the last 10 days.' type: Number - contextPath: GreyNoise.CVE.exploitation_activity.benign_ip_count_30d description: 'The total number of benign IP addresses GreyNoise has seen exercising (Scanning or Exploiting) this vulnerability in the last 30 days.' type: Number - contextPath: GreyNoise.CVE.exploitation_activity.threat_ip_count_1d description: 'The total number of threat IP addresses GreyNoise has seen exercising (Scanning or Exploiting) this vulnerability in the last day.' type: Number - contextPath: GreyNoise.CVE.exploitation_activity.threat_ip_count_10d description: 'The total number of threat IP addresses GreyNoise has seen exercising (Scanning or Exploiting) this vulnerability in the last 10 days.' type: Number - contextPath: GreyNoise.CVE.exploitation_activity.threat_ip_count_30d description: 'The total number of threat IP addresses GreyNoise has seen exercising (Scanning or Exploiting) this vulnerability in the last 30 days.' type: Number - contextPath: DBotScore.Indicator description: 'The indicator that was tested.' type: String - contextPath: DBotScore.Type description: 'The indicator type.' type: String - contextPath: DBotScore.Vendor description: 'The vendor used to calculate the score.' type: String - contextPath: DBotScore.Score description: 'The actual score.' type: Number - arguments: - default: true description: A list of IP addresses to run a quick check on. isArray: true name: ip required: true description: 'Check whether a given IP address is "Internet background noise", or has been observed scanning or attacking devices across the Internet. Note: It checks against the last 60 days of Internet scanner data.' name: greynoise-ip-quick-check outputs: - contextPath: GreyNoise.IP.address description: The IP address of the scanning device IP. type: string - contextPath: GreyNoise.IP.noise description: Whether the IP is internet background noise or attacking. type: boolean - contextPath: GreyNoise.IP.riot description: Whether the IP is a common business service. type: boolean - contextPath: GreyNoise.IP.code description: Code which correlates to why GreyNoise labeled the IP as noise. type: string - contextPath: GreyNoise.IP.code_value description: Message which correlates to why GreyNoise labeled the IP as noise. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.found description: Whether the IP has been observed scanning the internet. type: boolean - contextPath: GreyNoise.IP.business_service_intelligence.found description: Whether the IP is a common business service. type: boolean - contextPath: GreyNoise.IP.internet_scanner_intelligence.classification description: If the IP has been observed, what is the GreyNoise classification. type: string - contextPath: GreyNoise.IP.business_service_intelligence.trust_level description: If the IP is a business service, how trustworthy is the IP. type: string - arguments: - description: 'The date the device was most recently observed by GreyNoise. Example: 1d, 2d, 12h, or 1m.' name: last_seen - description: The organization that owns the network the IP address belongs to. name: organization - auto: PREDEFINED description: 'Classification of the device. Possible values: unknown, benign, suspicious, malicious.' name: classification predefined: - unknown - benign - malicious - suspicious - auto: PREDEFINED defaultValue: 'false' description: Whether the IP is spoofable or not. name: spoofable predefined: - 'true' - 'false' - description: The actor the device has been associated with. name: actor - description: A CVE to get scanning data about, example CVE-2021-12345. name: cve - defaultValue: '10' description: Maximum amount of results to grab. name: size - description: |- GNQL query to filter records. Note: It merges other arguments and takes higher precedence over the same argument if supplied. Example: malicious, spoofable:false SSH Scanner, spoofable:false classification:benign tags:POP3 Scanner cve:CVE-2010-0103. name: advanced_query - description: Scroll token to paginate through results. name: next_token description: Get the information of IP based on the providence filters. name: greynoise-query outputs: - contextPath: GreyNoise.IP.address description: The IP address of the scanning device IP. type: string - contextPath: GreyNoise.IP.bot description: Whether the IP is associated with known bot activity or not. Common examples include credential stuffing, content scraping, or brute force attacks. type: Boolean - contextPath: GreyNoise.IP.first_seen description: The date the device was first observed by GreyNoise. Format is ISO8601. type: date - contextPath: GreyNoise.IP.last_seen description: The date the device was last observed by GreyNoise. Format is ISO8601. type: date - contextPath: GreyNoise.IP.seen description: Whether the IP is in record with GreyNoise. type: boolean - contextPath: GreyNoise.IP.tags description: A list of the tags the device has been assigned over the past 90 days. type: array - contextPath: GreyNoise.IP.tags.category description: The category of the given tag. type: string - contextPath: GreyNoise.IP.tags.created description: The date the tag was added to the GreyNoise system. type: date - contextPath: GreyNoise.IP.tags.description description: A description of what the tag identifies. type: string - contextPath: GreyNoise.IP.tags.id description: The unique id of the tag. type: string - contextPath: GreyNoise.IP.tags.intention description: The intention of the associated activity the tag identifies. type: string - contextPath: GreyNoise.IP.tags.name description: The name of the tag. type: string - contextPath: GreyNoise.IP.tags.recommend_block description: Indicates if IPs associated with this tag should be blocked. type: boolean - contextPath: GreyNoise.IP.tags.references description: A list of references used to create the tag. type: string - contextPath: GreyNoise.IP.tags.slug description: The unique slug of the tag. type: string - contextPath: GreyNoise.IP.tags.updated_at description: The date the tag was last updated. type: date - contextPath: GreyNoise.IP.actor description: The overt actor the device has been associated with. type: string - contextPath: GreyNoise.IP.spoofable description: Whether the ip is spoofable. type: boolean - contextPath: GreyNoise.IP.classification description: Whether the device has been categorized as unknown, benign, or malicious. type: string - contextPath: GreyNoise.IP.cve description: CVEs associated with IP. type: array - contextPath: GreyNoise.IP.metadata.asn description: The autonomous system identification number. type: string - contextPath: GreyNoise.IP.metadata.city description: The city the device is geographically located in. type: string - contextPath: GreyNoise.IP.metadata.category description: Whether the device belongs to a business, isp, hosting, education, or mobile network. type: string - contextPath: GreyNoise.IP.metadata.country description: The full name of the country. type: string - contextPath: GreyNoise.IP.metadata.country_code description: The two-character country code of the country. type: string - contextPath: GreyNoise.IP.metadata.destination_countries description: The list of countries targeted by scanning. type: array - contextPath: GreyNoise.IP.metadata.destination_county_codes description: The list of countries (codes) targeted by scanning. type: array - contextPath: GreyNoise.IP.metadata.organization description: The organization that owns the network that the IP address belongs to. type: string - contextPath: GreyNoise.IP.metadata.os description: The name of the operating system of the device. type: string - contextPath: GreyNoise.IP.metadata.rdns description: Reverse DNS lookup of the IP address. type: string - contextPath: GreyNoise.IP.metadata.region description: The full name of the region the device is geographically located in. type: string - contextPath: GreyNoise.IP.metadata.sensor_count description: The number of sensors that observed activity from this IP. type: number - contextPath: GreyNoise.IP.metadata.sensor_hits description: The number of sensors events recorded from this IP. type: number - contextPath: GreyNoise.IP.metadata.source_country description: The full name of the IP source country. type: string - contextPath: GreyNoise.IP.metadata.source_country_code description: The country code of the IP source country. type: string - contextPath: GreyNoise.IP.metadata.tor description: Whether the device is a known Tor exit node. type: boolean - contextPath: GreyNoise.IP.tor description: Whether the device is a known Tor exit node. type: boolean - contextPath: GreyNoise.IP.vpn description: Whether the device is a VPN endpoint or not. type: boolean - contextPath: GreyNoise.IP.vpn_service description: The name of the VPN service provider of the device. type: string - contextPath: GreyNoise.IP.raw_data.scan.port description: The port number(s) the devices has been observed scanning. type: number - contextPath: GreyNoise.IP.raw_data.scan.protocol description: The protocol of the port the device has been observed scanning. type: string - contextPath: GreyNoise.IP.raw_data.web.paths description: Any HTTP paths the device has been observed crawling the Internet for. type: array - contextPath: GreyNoise.IP.raw_data.web.useragents description: Any HTTP user-agents the device has been observed using while crawling the Internet. type: array - contextPath: GreyNoise.IP.raw_data.ja3.fingerprint description: The JA3 TLS/SSL fingerprint. type: string - contextPath: GreyNoise.IP.raw_data.ja3.port description: The corresponding TCP port for the given JA3 fingerprint. type: number - contextPath: GreyNoise.IP.raw_data.hassh.fingerprint description: HASSH hash fingerprint string. type: string - contextPath: GreyNoise.IP.raw_data.hassh.port description: TCP port connection where the HASSH hash was identified. type: number - contextPath: GreyNoise.IP.business_service_intelligence.category description: The category of the business service. type: string - contextPath: GreyNoise.IP.business_service_intelligence.description description: Description of the business service. type: string - contextPath: GreyNoise.IP.business_service_intelligence.explanation description: Explanation of why the IP is considered a business service. type: string - contextPath: GreyNoise.IP.business_service_intelligence.found description: Whether the IP is a common business service. type: boolean - contextPath: GreyNoise.IP.business_service_intelligence.last_updated description: When was the last time the business service information was updated. type: date - contextPath: GreyNoise.IP.business_service_intelligence.name description: The name of the business service. type: string - contextPath: GreyNoise.IP.business_service_intelligence.reference description: Reference link for the business service. type: string - contextPath: GreyNoise.IP.business_service_intelligence.trust_level description: If the IP is a business service, how trustworthy is the IP. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.actor description: The overt actor the device has been associated with. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.bot description: Whether the IP is associated with known bot activity or not. Common examples include credential stuffing, content scraping, or brute force attacks. type: Boolean - contextPath: GreyNoise.IP.internet_scanner_intelligence.classification description: Whether the device has been categorized as unknown, benign, or malicious. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.cve description: CVEs associated with IP. type: array - contextPath: GreyNoise.IP.internet_scanner_intelligence.first_seen description: The date the device was first observed by GreyNoise. Format is ISO8601. type: date - contextPath: GreyNoise.IP.internet_scanner_intelligence.found description: Whether the IP was found in GreyNoise records. type: boolean - contextPath: GreyNoise.IP.internet_scanner_intelligence.last_seen description: The date the device was last observed by GreyNoise. Format is ISO8601. type: date - contextPath: GreyNoise.IP.internet_scanner_intelligence.last_seen_timestamp description: The timestamp when the device was last observed by GreyNoise. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.asn description: The autonomous system identification number. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.carrier description: The carrier information for the IP address. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.category description: Whether the device belongs to a business, isp, hosting, education, or mobile network. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.city description: The city the device is geographically located in. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.country description: The full name of the country. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.country_code description: The two-character country code of the country. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.datacenter description: The datacenter information for the IP address. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.destination_asns description: The list of ASNs targeted by scanning. type: array - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.destination_cities description: The list of cities targeted by scanning. type: array - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.destination_countries description: The list of countries targeted by scanning. type: array - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.destination_country_codes description: The list of country codes targeted by scanning. type: array - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.domain description: The domain associated with the IP address. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.latitude description: The latitude coordinate of the IP address location. type: number - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.longitude description: The longitude coordinate of the IP address location. type: number - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.mobile description: Whether the device is on a mobile network. type: boolean - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.organization description: The organization that owns the network that the IP address belongs to. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.os description: The name of the operating system of the device. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.rdns description: Reverse DNS lookup of the IP address. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.rdns_parent description: The parent domain of the reverse DNS lookup. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.rdns_validated description: Whether the reverse DNS lookup has been validated. type: boolean - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.region description: The full name of the region the device is geographically located in. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.sensor_count description: The number of sensors that observed activity from this IP. type: number - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.sensor_hits description: The number of sensor events recorded from this IP. type: number - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.single_destination description: Whether the IP targets a single destination. type: boolean - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.source_city description: The city where the IP is geographically located. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.source_country description: The full name of the IP source country. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.metadata.source_country_code description: The country code of the IP source country. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.tor description: Whether the device is a known Tor exit node. type: boolean - contextPath: GreyNoise.IP.internet_scanner_intelligence.raw_data.hassh.fingerprint description: HASSH hash fingerprint string. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.raw_data.hassh.port description: TCP port connection where the HASSH hash was identified. type: number - contextPath: GreyNoise.IP.internet_scanner_intelligence.raw_data.http.md5 description: MD5 hashes of HTTP requests made by the device. type: array - contextPath: GreyNoise.IP.internet_scanner_intelligence.raw_data.http.method description: HTTP methods used by the device. type: array - contextPath: GreyNoise.IP.internet_scanner_intelligence.raw_data.http.path description: HTTP paths the device has been observed accessing. type: array - contextPath: GreyNoise.IP.internet_scanner_intelligence.raw_data.http.request_header description: HTTP request headers used by the device. type: array - contextPath: GreyNoise.IP.internet_scanner_intelligence.raw_data.http.useragent description: HTTP user-agents the device has been observed using. type: array - contextPath: GreyNoise.IP.internet_scanner_intelligence.raw_data.ja3.fingerprint description: The JA3 TLS/SSL fingerprint. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.raw_data.ja3.port description: The corresponding TCP port for the given JA3 fingerprint. type: number - contextPath: GreyNoise.IP.internet_scanner_intelligence.raw_data.scan.port description: The port number(s) the device has been observed scanning. type: number - contextPath: GreyNoise.IP.internet_scanner_intelligence.raw_data.scan.protocol description: The protocol of the port the device has been observed scanning. type: string - contextPath: GreyNoise.IP.internet_scanner_intelligence.raw_data.source.bytes description: The number of bytes sent by the source. type: number - contextPath: GreyNoise.IP.internet_scanner_intelligence.raw_data.tls.cipher description: TLS cipher suites used by the device. type: array - contextPath: GreyNoise.IP.internet_scanner_intelligence.raw_data.tls.ja4 description: JA4 TLS/SSL fingerprints. type: array - contextPath: GreyNoise.IP.internet_scanner_intelligence.raw_data.web.paths description: Any HTTP paths the device has been observed crawling the Internet for. type: array - contextPath: GreyNoise.IP.internet_scanner_intelligence.raw_data.web.useragents description: Any HTTP user-agents the device has been observed using while crawling the Internet. type: array - contextPath: GreyNoise.IP.internet_scanner_intelligence.seen description: Whether the IP is in record with GreyNoise. type: boolean - contextPath: GreyNoise.IP.internet_scanner_intelligence.spoofable description: Whether the ip is spoofable. type: boolean - contextPath: GreyNoise.IP.internet_scanner_intelligence.tags description: A list of the tags the device has been assigned over the past 90 days. type: array - contextPath: GreyNoise.IP.internet_scanner_intelligence.vpn description: Whether the device is a VPN endpoint or not. type: boolean - contextPath: GreyNoise.IP.internet_scanner_intelligence.vpn_service description: The name of the VPN service provider of the device. type: string - contextPath: GreyNoise.Query.complete description: Whether all results have been fetched or not. type: boolean - contextPath: GreyNoise.Query.count description: Count of the total matching records. type: number - contextPath: GreyNoise.Query.message description: Message from the API response. type: string - contextPath: GreyNoise.Query.query description: Query which was used to filter the records. type: string - contextPath: GreyNoise.Query.scroll description: Scroll token to paginate through results. type: string - arguments: - description: 'The date the device was most recently observed by GreyNoise. Example: 1d, 2d, 12h, or 1m.' name: last_seen - description: The organization that owns the network that the IP address belongs to. name: organization - auto: PREDEFINED description: Classification of the device like unknown, benign, malicious. name: classification predefined: - unknown - benign - malicious - auto: PREDEFINED defaultValue: 'false' description: Whether the IP is spoofable or not. name: spoofable predefined: - 'true' - 'false' - description: The actor the device has been associated with. name: actor - description: A CVE to get scanning data about, example CVE-2021-12345. name: cve - defaultValue: '10' description: Maximum amount of results to grab. name: size - description: |- GNQL query to filter records. Note: It merges other arguments and takes higher precedence over the same argument if supplied. Example: malicious, spoofable:false SSH Scanner, spoofable:false classification:benign tags:POP3 Scanner cve:CVE-2010-0103. name: advanced_query description: Get aggregate statistics for the top organizations, actors, tags, ASNs, countries, classifications, and operating systems of all the results of a given GNQL query. name: greynoise-stats outputs: - contextPath: GreyNoise.Stats.query description: The query which was used to filter the records. type: string - contextPath: GreyNoise.Stats.count description: Count of total aggregated records. type: number - contextPath: GreyNoise.Stats.stats.classifications.classification description: Classification name. type: string - contextPath: GreyNoise.Stats.stats.classifications.count description: Classification count. type: number - contextPath: GreyNoise.Stats.stats.spoofable.spoofable description: Whether records are spoofable or not. type: boolean - contextPath: GreyNoise.Stats.stats.spoofable.count description: Spoofable count. type: number - contextPath: GreyNoise.Stats.stats.organizations.organization description: Organization name. type: string - contextPath: GreyNoise.Stats.stats.organizations.count description: Organization count. type: number - contextPath: GreyNoise.Stats.stats.actors.actor description: Actor name. type: string - contextPath: GreyNoise.Stats.stats.actors.count description: Actor count. type: number - contextPath: GreyNoise.Stats.stats.countries.country description: Country name. type: string - contextPath: GreyNoise.Stats.stats.countries.count description: Country count. type: number - contextPath: GreyNoise.Stats.stats.source_countries.country description: Country name. type: string - contextPath: GreyNoise.Stats.stats.source_countries.count description: Country count. type: number - contextPath: GreyNoise.Stats.stats.destination_countries.country description: Country name. type: string - contextPath: GreyNoise.Stats.stats.destination_countries.count description: Country count. type: number - contextPath: GreyNoise.Stats.stats.tags.tag description: Tag name. type: string - contextPath: GreyNoise.Stats.stats.tags.count description: Tag count. type: number - contextPath: GreyNoise.Stats.stats.operating_systems.operating_system description: Operating system name. type: string - contextPath: GreyNoise.Stats.stats.operating_systems.count description: Operating system count. type: number - contextPath: GreyNoise.Stats.stats.categories.category description: Category name. type: string - contextPath: GreyNoise.Stats.stats.categories.count description: Category count. type: number - contextPath: GreyNoise.Stats.stats.asns.asn description: Asn name. type: string - contextPath: GreyNoise.Stats.stats.asns.count description: Asn count. type: number - arguments: - default: true description: The IP address to be checked if it is potentially harmful or not. name: ip required: true description: Identifies IPs from known benign services and organizations that commonly cause false positives in network security and threat intelligence products. The collection of IPs in RIOT is continually curated and verified to provide accurate results. These IPs are extremely unlikely to pose a threat to your network. name: greynoise-riot outputs: - contextPath: GreyNoise.Riot.ip description: The IP given to check riot information about. type: String - contextPath: GreyNoise.Riot.riot description: The riot of the IP. "True" or "False". type: String - contextPath: GreyNoise.Riot.category description: The category of the IP if riot is "True". type: String - contextPath: GreyNoise.Riot.name description: The name of the IP if the riot is "True". type: String - contextPath: GreyNoise.Riot.description description: The description of the IP if riot is "True". type: String - contextPath: GreyNoise.Riot.explanation description: The explanation of the IP if riot is "True". type: String - contextPath: GreyNoise.Riot.last_updated description: The last time the business service information was updated. type: Date - contextPath: GreyNoise.Riot.reference description: The reference of the IP if riot is "True". type: String - contextPath: GreyNoise.Riot.trust_level description: The trust level of the IP if riot is "True". type: String - arguments: - default: true description: The IP address to query in GreyNoise Context Command. name: ip required: true description: Identifies IPs that have been observed mass-scanning the internet. name: greynoise-context outputs: - contextPath: GreyNoise.IP.address description: The IP address of the scanning device IP. type: string - contextPath: GreyNoise.IP.first_seen description: The date the device was first observed by GreyNoise. Format is ISO8601. type: date - contextPath: GreyNoise.IP.last_seen description: The date the device was last observed by GreyNoise. Format is ISO8601. type: date - contextPath: GreyNoise.IP.seen description: Whether the IP is in record with GreyNoise. type: boolean - contextPath: GreyNoise.IP.tags description: A list of the tags the device has been assigned over the past 90 days. type: array - contextPath: GreyNoise.IP.tags.category description: The category of the given tag. type: string - contextPath: GreyNoise.IP.tags.created description: The date the tag was added to the GreyNoise system. type: date - contextPath: GreyNoise.IP.tags.description description: A description of what the tag identifies. type: string - contextPath: GreyNoise.IP.tags.id description: The unique id of the tag. type: string - contextPath: GreyNoise.IP.tags.intention description: The intention of the associated activity the tag identifies. type: string - contextPath: GreyNoise.IP.tags.name description: The name of the tag. type: string - contextPath: GreyNoise.IP.tags.recommend_block description: Indicates if IPs associated with this tag should be blocked. type: boolean - contextPath: GreyNoise.IP.tags.references description: A list of references used to create the tag. type: string - contextPath: GreyNoise.IP.tags.slug description: The unique slug of the tag. type: string - contextPath: GreyNoise.IP.tags.updated_at description: The date the tag was last updated. type: date - contextPath: GreyNoise.IP.actor description: The overt actor the device has been associated with. type: string - contextPath: GreyNoise.IP.spoofable description: Whether the ip is spoofable. type: boolean - contextPath: GreyNoise.IP.classification description: Whether the device has been categorized as unknown, benign, or malicious. type: string - contextPath: GreyNoise.IP.cve description: CVEs associated with IP. type: array - contextPath: GreyNoise.IP.metadata.asn description: The autonomous system identification number. type: string - contextPath: GreyNoise.IP.metadata.city description: The city the device is geographically located in. type: string - contextPath: GreyNoise.IP.metadata.category description: Whether the device belongs to a business, isp, hosting, education, or mobile network. type: string - contextPath: GreyNoise.IP.metadata.country description: The full name of the country. type: string - contextPath: GreyNoise.IP.metadata.country_code description: The two-character country code of the country. type: string - contextPath: GreyNoise.IP.metadata.destination_countries description: The list of countries targeted by scanning. type: array - contextPath: GreyNoise.IP.metadata.destination_county_codes description: The list of countries (codes) targeted by scanning. type: array - contextPath: GreyNoise.IP.metadata.destination_asns description: The list of ASNs targeted by scanning. type: array - contextPath: GreyNoise.IP.metadata.destination_cities description: The list of cities targeted by scanning. type: array - contextPath: GreyNoise.IP.metadata.organization description: The organization that owns the network that the IP address belongs to. type: string - contextPath: GreyNoise.IP.metadata.os description: The name of the operating system of the device. type: string - contextPath: GreyNoise.IP.metadata.rdns description: Reverse DNS lookup of the IP address. type: string - contextPath: GreyNoise.IP.metadata.rdns_parent description: The parent domain of the reverse DNS lookup. type: string - contextPath: GreyNoise.IP.metadata.rdns_validated description: Whether the reverse DNS lookup has been validated. type: boolean - contextPath: GreyNoise.IP.metadata.region description: The full name of the region the device is geographically located in. type: string - contextPath: GreyNoise.IP.metadata.sensor_count description: The number of sensors that observed activity from this IP. type: number - contextPath: GreyNoise.IP.metadata.sensor_hits description: The number of sensors events recorded from this IP. type: number - contextPath: GreyNoise.IP.metadata.source_country description: The full name of the IP source country. type: string - contextPath: GreyNoise.IP.metadata.source_country_code description: The country code of the IP source country. type: string - contextPath: GreyNoise.IP.metadata.source_city description: The city where the IP is geographically located. type: string - contextPath: GreyNoise.IP.metadata.tor description: Whether the device is a known Tor exit node. type: boolean - contextPath: GreyNoise.IP.tor description: Whether the device is a known Tor exit node. type: boolean - contextPath: GreyNoise.IP.metadata.carrier description: The carrier information for the IP address. type: string - contextPath: GreyNoise.IP.metadata.datacenter description: The datacenter information for the IP address. type: string - contextPath: GreyNoise.IP.metadata.domain description: The domain associated with the IP address. type: string - contextPath: GreyNoise.IP.metadata.latitude description: The latitude coordinate of the IP address location. type: number - contextPath: GreyNoise.IP.metadata.longitude description: The longitude coordinate of the IP address location. type: number - contextPath: GreyNoise.IP.metadata.mobile description: Whether the device is on a mobile network. type: boolean - contextPath: GreyNoise.IP.metadata.single_destination description: Whether the IP targets a single destination. type: boolean - contextPath: GreyNoise.IP.vpn description: Whether the device is a VPN endpoint or not. type: boolean - contextPath: GreyNoise.IP.vpn_service description: The name of the VPN service provider of the device. type: string - contextPath: GreyNoise.IP.raw_data.scan.port description: The port number(s) the devices has been observed scanning. type: number - contextPath: GreyNoise.IP.raw_data.scan.protocol description: The protocol of the port the device has been observed scanning. type: string - contextPath: GreyNoise.IP.raw_data.web.paths description: Any HTTP paths the device has been observed crawling the Internet for. type: array - contextPath: GreyNoise.IP.raw_data.web.useragents description: Any HTTP user-agents the device has been observed using while crawling the Internet. type: array - contextPath: GreyNoise.IP.raw_data.ja3.fingerprint description: The JA3 TLS/SSL fingerprint. type: string - contextPath: GreyNoise.IP.raw_data.ja3.port description: The corresponding TCP port for the given JA3 fingerprint. type: number - contextPath: GreyNoise.IP.raw_data.hassh.fingerprint description: HASSH hash fingerprint string. type: string - contextPath: GreyNoise.IP.raw_data.hassh.port description: TCP port connection where the HASSH hash was identified. type: number - contextPath: GreyNoise.IP.raw_data.http.md5 description: MD5 hashes of HTTP requests made by the device. type: array - contextPath: GreyNoise.IP.raw_data.http.method description: HTTP methods used by the device. type: array - contextPath: GreyNoise.IP.raw_data.http.path description: HTTP paths the device has been observed accessing. type: array - contextPath: GreyNoise.IP.raw_data.http.request_header description: HTTP request headers used by the device. type: array - contextPath: GreyNoise.IP.raw_data.http.useragent description: HTTP user-agents the device has been observed using. type: array - contextPath: GreyNoise.IP.raw_data.source.bytes description: The number of bytes sent by the source. type: number - contextPath: GreyNoise.IP.raw_data.tls.cipher description: TLS cipher suites used by the device. type: array - contextPath: GreyNoise.IP.raw_data.tls.ja4 description: JA4 TLS/SSL fingerprints. type: array - contextPath: GreyNoise.IP.bot description: Whether the IP is associated with known bot activity or not. Common examples include credential stuffing, content scraping, or brute force attacks. type: Boolean - name: greynoise-similarity description: >- Search for similar internet scanner IPs found in the GreyNoise Noise (internet scanner) dataset. arguments: - name: ip default: true description: IP address to find similar IPs to. required: true - name: minimum_score description: >- The minimum similarity score to match to. Value between 80 and 100. Default value is 90. defaultValue: '90' - name: maximum_results description: The maximum number of results to return. Default value is 50. defaultValue: '50' outputs: - contextPath: GreyNoise.Similar.ip_address description: Similar IP address. type: string - name: greynoise-timeline description: >- Retrieve daily scanner timeline information for an Internet Scanner. arguments: - name: ip default: true description: IP address to find similar IPs to. required: true - name: days description: >- The number of days to retrieve daily summaries for. Value between 1 and 90. Default value is 30. defaultValue: '30' - name: maximum_results description: The maximum number of results to return. Default value is 50. defaultValue: '50' outputs: - contextPath: GreyNoise.Timeline.ip_address description: Timeline IP address. type: string dockerimage: demisto/greynoise:1.0.0.10926121 runonce: false script: '-' subtype: python3 type: python tests: - No tests (auto formatted) fromversion: 5.0.0