Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The GreyNoise Action Bundle for ThreatQ enables analysts to use GreyNoise Enterprise for automated enrichment and investigations.

The action bundle provides the following actions:

• GreyNoise - Find Similar IPs - locates similar IPs to corresponding IPs from the selected data collection.
• GreyNoise - RIOT - check to see if IPs within a data collection are in GreyNoise's RIOT dataset (known good services).
• GreyNoise - IP Quick Check - performs a quick noise check on the IPs of the selected data collection.
• GreyNoise - CVE Enrichment - enriches selected CVEs with GreyNoise data.
• GreyNoise - IP Context - enriches select IPs with GreyNoise's full contextual data.  

The integration is both compatible with and returns IP Address type indicators.  Additionally, the GreyNoise - CVE Enrichment action is also compatible and enriches CVE type indicators and vulnerabilities.  

This action is intended for use with ThreatQ TDR Orchestrator (TQO). An active TQO license is required for this feature.

Prerequisites

• An active ThreatQ TDR Orchestrator (TQO) license.
• A data collection containing:
  • All actions except the CVE Enrichment action - IP Address type indicators.
  • The GreyNoise CVE Enrichment action - CVE type indicators and Vulnerability objects 

Installation

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the action bundle zip file.
3. Navigate to the integrations management page on your ThreatQ instance.
4. Click on the Add New Integration button.
5. Upload the zip file using one of the following methods:
   • Drag and drop the zip file into the dialog box
   • Select Click to Browse to locate the zip file on your local machine
6. Select the actions to install, when prompted, and click on the Install button.

   ThreatQ will inform you if the action already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the action contains changes to the user configuration. The new user configurations will overwrite the existing ones for the action and will require user confirmation before proceeding.

   The action(s) have been installed on your ThreatQ instance. You will still need to configure the action(s).

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Actions option from the Category dropdown (optional).
3. Click on the action entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   The configurations set on this page will be used as the default settings when inserting this action into a new workflow. Updating the configurations on this page will not update any instances of this action that have already been deployed to a workflow. In that scenario, you must update the action’s configurations within the workflow itself.

   Find Similar IPs Parameters

   Parameter	Description
   GreyNoise API Key	API Key for authentication with the IPInfo API
   Similarity Score Threshold	Enter a value, between 0-100, that will serve as the minimum similarity score required to ingest a similar IP Address.
   Feature Match Requirements	Enter a comma-separated list of features that need to be matched for a similar IP Address to be ingested. This parameter is case-sensitive.
   Classification Filter	Select one or more classifications to use for filtering the ingested similar IPs.  Options include: Malicious Unknown Benign Unselected classifications will not be ingested.
   Similar IP Context Filter	Select the context to include when ingesting similar IPs.  Options include: Actor Classification First Seen Last Seen ASN City Country Country Code Organization
   Similar IP Status	Select the status of the similar IP Addresses ingested.  Options include: Indirect Review Active Whitelisted
   Relate Similar IPs to Original IP	Enable this option to relate the similar IPs to the original IP Address.
   Objects Per Run	Maximum number of Objects to Submit per workflow run.
   Disable Proxies	Enable this option to have the action ignore proxies settings set in the ThreatQ UI.
   Enable SSL Verification	Enable this option to verify the provider's SSL certificate.

   
   

   RIOT Parameters

   Parameter	Description
   GreyNoise API Key	API Key for authentication with the IPInfo API
   Context Filter	Select the pieces of Context to ingest back into ThreatQ. Options include: RIOT Category Service Name Trust Level External Reference Last Updated
   RIOT IP Status	Select the status of the IP Addresses that are within the RIOT dataset.  Options include:  Whitelisted Review Active
   Non-RIOT IP Status	Select the status of the IP Addresses that are not within the RIOT dataset. Options include:  Whitelisted Review Active
   Objects Per Run	Maximum number of Objects to Submit per workflow run.
   Disable Proxies	Enable this option to have the action ignore proxies settings set in the ThreatQ UI.
   Enable SSL Verification	Enable this option to verify the provider's SSL certificate.

   
   

   IP Quick Check Parameters

   Parameter	Description
   GreyNoise API Key	API Key for authentication with the IPInfo API
   Context Filter	Select the pieces of Context to ingest back into ThreatQ. Options include: RIOT Noise Noise Code
   RIOT IP Status	Select the status of the IP Addresses that are within the RIOT dataset.  Options include:  Whitelisted Review Active
   Non-RIOT IP Status	Select the status of the IP Addresses that are not within the RIOT dataset. Options include:  Whitelisted Review Active
   Objects Per Run	Maximum number of Objects to Submit per workflow run.
   Disable Proxies	Enable this option to have the action ignore proxies settings set in the ThreatQ UI.
   Enable SSL Verification	Enable this option to verify the provider's SSL certificate.

   
   

   CVE Enrichment Parameters

   Parameter	Description
   GreyNoise API Key	API Key for authentication with the IPInfo API
   Ingest Corresponding Vulnerability Object	If enabled, along with ingesting the CVE context, a vulnerability object will also be created for the underlying vulnerability details. Vulnerability objects & CVEs will share the same enrichment context. If it's not enabled, Vulnerability Name attribute is created for the CVE.
   Enrichment Context Filter	Select the pieces of context to ingest with each vulnerability (when available).  Options include:  CVSS Score (default) Affected Product (default) Affected Vendor (default) EPSS Score (default) Is CISA KEV (default) Has Exploit (default) Attack Vector (default)
   Objects Per Run	Maximum number of Objects to Submit per workflow run.
   Disable Proxies	Enable this option to have the action ignore proxies settings set in the ThreatQ UI.
   Enable SSL Verification	Enable this option to verify the provider's SSL certificate.

   
   

   IP Context Parameters

   Parameter	Description
   GreyNoise API Key	API Key for authentication with the IPInfo API
   Set Status to Active If Malicious	Enter a value, between 0-100, that will serve as the minimum similarity score required to ingest a similar IP Address.
   Enrichment Context Filter	Select the pieces of context to ingest with each vulnerability (when available).  Options include:  Actor (Not a Threat Actor) First Seen Last Seen Tags Classification CVEs Is Bot Is TOR Is VPN VPN Service ASN City Country Country Code Region Organization Category Operating System Destination Country Destination Country Code Source Country Source Country Code RDNS
   Objects Per Run	Maximum number of Objects to Submit per workflow run.
   Disable Proxies	Enable this option to have the action ignore proxies settings set in the ThreatQ UI.
   Enable SSL Verification	Enable this option to verify the provider's SSL certificate.

   
   
5. Review any additional settings, make any changes if needed, and click on Save.

Actions

The action bundle provides the following actions:

{
    "ip": {
        "ip": "52.73.169.169",
        "actor": "CyberGreen",
        "classification": "benign",
        "first_seen": "2017-09-19",
        "last_seen": "2022-11-29",
        "asn": "AS14618",
        "city": "Ashburn",
        "country": "United States",
        "country_code": "US",
        "organization": "Amazon.com, Inc."
    },
    "similar_ips": [
        {
            "ip": "67.198.237.116",
            "score": 0.82805526,
            "features": [
                "os",
                "ports",
                "rdns",
                "spoofable_bool"
            ],
            "actor": "unknown",
            "classification": "unknown",
            "first_seen": "2022-09-21",
            "last_seen": "2022-10-13",
            "asn": "AS35908",
            "city": "Los Angeles",
            "country": "United States",
            "country_code": "US",
            "organization": "Krypt Technologies"
        },
        {
            "ip": "54.36.163.223",
            "score": 0.82805526,
            "features": [
                "os",
                "ports",
                "rdns",
                "spoofable_bool"
            ],
            "actor": "unknown",
            "classification": "unknown",
            "first_seen": "2021-07-05",
            "last_seen": "2022-10-19",
            "asn": "AS16276",
            "city": "Redbridge",
            "country": "United Kingdom",
            "country_code": "GB",
            "organization": "OVH SAS"
        }
    ],
    "total": 68
}

{
  "ip": "1.1.1.1",
  "riot": true,
  "category": "public_dns",
  "name": "Cloudflare Public DNS",
  "description": "Cloudflare, Inc. is an American web infrastructure and website security company, providing content delivery network (CDN) services, distributed denial of service (DDoS) mitigation, Internet security, and distributed domain name system (DNS) services. This is their public DNS offering.",
  "explanation": "Public DNS services are used as alternatives to ISP's name servers. You may see devices on your network communicating with Cloudflare Public DNS over port 53/TCP or 53/UDP to resolve DNS lookups.",
  "last_updated": "2023-01-12T17:11:04Z",
  "reference": "https://one.one.one.one",
  "trust_level": "1"
}

{
  "ip": "12.199.79.244",
  "noise": true,
  "riot": false,
  "code": "0x01"
}

{
  "id": "CVE-2024-23897",
  "details": {
    "vulnerability_name": "Jenkins Command Line Interface (CLI) Path Traversal Vulnerability",
    "vulnerability_description": "Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.",
    "cve_cvss_score": 9.8,
    "product": "Jenkins Command Line Interface (CLI)",
    "vendor": "Jenkins",
    "published_to_nist_nvd": true
  },
  "timeline": {
    "cve_published_date": "2024-01-24T18:15:09Z",
    "cve_last_updated_date": "2024-05-14T15:01:24Z",
    "first_known_published_date": "2024-01-30T00:00:00Z",
    "cisa_kev_date_added": "2024-08-19T00:00:00Z"
  },
  "exploitation_details": {
    "attack_vector": "NETWORK",
    "exploit_found": true,
    "exploitation_registered_in_kev": true,
    "epss_score": 0.97225
  },
  "exploitation_stats": {
    "number_of_available_exploits": 48,
    "number_of_threat_actors_exploiting_vulnerability": 2,
    "number_of_botnets_exploiting_vulnerability": 0
  },
  "exploitation_activity": {
    "activity_seen": false,
    "benign_ip_count_1d": 0,
    "benign_ip_count_10d": 0,
    "benign_ip_count_30d": 0,
    "threat_ip_count_1d": 0,
    "threat_ip_count_10d": 0,
    "threat_ip_count_30d": 0
  }
}

{
  "data": [
    {
      "actor": "unknown",
      "bot": false,
      "classification": "malicious",
      "cve": [],
      "first_seen": "2024-08-19",
      "ip": "45.63.52.184",
      "last_seen": "2024-08-19",
      "metadata": {
        "asn": "AS20473",
        "category": "hosting",
        "city": "Los Angeles",
        "country": "United States",
        "country_code": "US",
        "destination_countries": ["Canada"],
        "destination_country_codes": ["CA"],
        "organization": "The Constant Company, LLC",
        "os": "",
        "rdns": "45.63.52.184.vultrusercontent.com",
        "region": "California",
        "sensor_count": 1,
        "sensor_hits": 5,
        "source_country": "United States",
        "source_country_code": "US",
        "tor": false
      },
      "published_at": "2024-08-19 00:00:00+00:00",
      "raw_data": {
        "hassh": [],
        "ja3": [],
        "scan": [
          {
            "port": 983,
            "protocol": "TCP"
          }
        ],
        "web": {}
      },
      "seen": true,
      "spoofable": true,
      "tags": [],
      "vpn": false,
      "vpn_service": ""
    }
  ]
}

Enriched Data

Object counts and action runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and action runtime may vary based on system resources and load.

Find Similar IPs

RIOT

IP Quick Check

CVE Enrichment

IP Context

Use Case Example

• Find Similar IPs - you have a list of known IPs from a bad actor, and want to find similar IPs to uncover previously unknown actor infrastructure to proactively prevent future attacks.
• RIOT - you have a list of IPs and are unsure if they are malicious or benign. You would use the RIOT endpoint to see if any of the IPs are known good (benign).
• IP Quick Check - you have a list of IPs and want to see if any of them have been observed scanning or attacking devices on the internet. 
• CVE Enrichment - you have a list of CVEs and want to enrich them with additional context from GreyNoise to better understand the risk associated with each CVE.
• IP Context - you have a list of IPs and want to enrich them with additional context from GreyNoise to better understand whether or not they are just noise or are actually malicious.

Known Issues / Limitations

• A maximum of 100 similar indicators can be brought back per IOC in your data collection.

Change Log

• Version 1.1.0
  • Added two new actions: GreyNoise CVE Enrichment and GreyNoise IP Context.
  • Added the follow configuration options to all actions:
    • Disable Proxies - enable this option to have the action ignore proxy settings set in the ThreatQ UI.
    • Enable SSL Verification - enable this option to verify the provider's SSL certificate.
• Version 1.0.0
  • Initial release