So let's take a look at the new trends feature that we have available in GreyNoise and some of the options that we have for working with it. So right here I have a simple query, looking at hosts that are tagged with the CGI script scanner with the classification of malicious in the last day, you can see I have a number of results here. And as I start to look at some of these different hosts, I can see all the same details we would expect to see from GreyNoise.
But when I start to look at these tags now, specifically, if I click on CGI script scanner, we're starting to show additional details around what we've observed and what kind of information we can provide around the scan activity related to this tag. So we can see time series data for the last 3, 10, or 30 days, the amount of IPs that GreyNoise has observed with scan activity related to this tag. And we're also going to provide some additional details.
So one of the things that we are providing is a block list or an EDL that we can use with this URL. And we can provide this to our firewalls. So for example, if there is a new vulnerability or something that's just causing a lot of alerts to trigger, we can use this to just block a lot of this noise of the internet and buy some time as we are starting to do some of that initial triage, or just block a lot of these IPs that we see attempting this activity, internet wide.
And we can also see the same details for any tags related to certain vulnerabilities. So if we looked at Log4j for example, we still see all of our same hosts in here when we run our query. And again, as we start to drill into the details, we can see that there are additional CVEs related to this.
We're also going to publish the additional references in here, we publish the timelines for when GreyNoise created the tag when the CVEs were republished, and still providing the same time series data. We provide the blocklist. Or we can always just choose to download this list of IPs that GreyNoise has observed as well right from here.
