Integration Library

Atomic action to enrich IP addresses using the Community API

Perform automated investigative operations with GreyNoise IP enrichment and GNQL queries

Add actions that provide valuable context and modify cases based on GreyNoise IP enrichment.

Perform IP analysis using GreyNoise to categorize IP addresses to eliminate noise

Contextualize alerts, filter false-positives, find compromised devices, and track emerging threats.

Get context on an IP address around the activity GreyNoise has observed

Automate security processes, leveraging RIOT and Noise IP lookups to enhance threat detection

Identify IP addresses with malicious behaviors

A set of actions to run in ST2 that interact with the GreyNoise API

Use Actions for IP enrichments and GNQL queries via the GreyNoise API.

Confidently ignore irrelevant or harmless activity

Automate threat detection and enhance your security posture

Run queries, list tags, and check IP activity and get IP details in Torq workflows

Enrich indicators from the GreyNoise enterprise API and free community API

Identify events to ignore, such as mass-internet scanners and harmless services

Distinguishing between malicious and benign activity

Enrich IPv4 observables on the EclecticIQ Platform

Enrich IP addresses with GreyNoise data and get internet scanning activity for a CVE

Answer the question of "Is everyone else seeing this, or is it just me?"

Enrich your threat intelligence with valuable context on IPs scanning the internet

Look up IP addresses to validate if it was once involved with any mass automated activity

Query GreyNoise for metadata including reverse DNS tags, geolocation, and scanned paths/ports

Filter out background noise and focus on genuine threats

Query GreyNoise directly from within your Copilot for Security portal

Filter out background noise and get valuable context on IP activity

Add GreyNoise blocklists to your Sophos firewall