ThreatConnect TIP

ThreatConnect TIP, or Threat Intelligence Platform, is a commercial tool that centralizes and manages threat data to help organizations anticipate and respond to cybersecurity threats.

With GreyNoise, you can look up IP addresses to validate if it was once involved with any mass automated activity.

As part of the enrichment process, you can query GreyNoise and find that an offending IP address in your SIEM alert is not in the GreyNoise dataset; this means it's more likely to be targeted activity, and you can raise the priority of that alert. In other words, this integration can tell you what IPs not to worry about and what IPs are worth looking into deeper.

This integration allows you to:

• ‍IP Lookup- Submit a single IP address to GreyNoise to validate whether or not it's part of mass automated activity.
• ‍GNQL Query - Perform a custom query using the GreyNoise Query Language to retrieve IP addresses that match specified criteria.
• ‍RIOT IP Lookup- Identify whether an IP is from known benign services and organizations that commonly cause false positives in network security and threat intelligence products.