Current ThreatQ Version Filter
 

GreyNoise Community Operation

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The GreyNoise Community operation provides you with the ability to query info about an IP address from GreyNoise's Community API.

The operation is compatible with IP Address-type indicators and provides the following action:

  • Query - queries for info about an IP address from GreyNoise's Community API.

See the Actions chapter for more information on this action.  

Installation

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

  1. Navigate to your integrations management page in ThreatQ.
  2. Select the Operation option from the Type dropdown (optional).
  3. Click on the integration entry to open its details page.
  4. Enter the following parameter under the Configuration tab:
    Parameter Description
    API Key A GreyNoise API Key that will allow a high rate limit.  
  5. Review any additional settings, make any changes if needed, and click on Save.
  6. Click on the toggle switch, located above the Additional Information section, to enable it.

Actions

The GreyNoise Community operation provides the following action:

Action Description Object Type Object Subtype
Query Queries for info about an IP address from GreyNoise's Community API. Indicator IP Address

Query

The Query action queries for info on a specific IP address.  The data returned is a flat JSON object as demonstrated in the sample response below.

<GET> https://api.greynoise.io/v3/community/<IP ADDRESS>

Sample Response:

{
  "ip": "8.8.8.8",
  "noise": false,
  "riot": true,
  "classification": "benign",
  "name": "Google Public DNS",
  "link": "https://viz.greynoise.io/riot/8.8.8.8",
  "last_seen": "2021-05-13",
  "message": "Success"
}

ThreatQuotient provides the following default mapping for this feed:

Feed Data Path ThreatQ Entity ThreatQ Object Type or Attribute Key Published Date Examples Notes
noise Indicator.Attribute Noise N/A False N/A
riot Indicator.Attribute RIOT N/A True Stands for Rule It Out
classification Indicator.Attribute Classification N/A benign N/A
name Indicator.Attribute Name N/A Google Public DNS N/A
link Indicator.Attribute Link N/A https://viz.greynoise.io/riot/8.8.8.8 N/A
last_seen Indicator.Attribute Last Seen N/A 2021-05-13 N/A

Change Log

  • Version 1.1.0
    • Added API Key parameter to the configuration section.  
  • Version 1.0.0
    • Initial release

PDF Guides

 

Document ThreatQ Version
GreyNoise Community Operation Guide v1.1.0 4.0.0 or Greater
GreyNoise Community Operation Guide v1.0.0 4.0.0 or Greater