Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The GreyNoise Community Action submits a collection of IP Addresses to the GreyNoise Community API in individual HTTP Requests. GreyNoise returns a response for each object containing any information they have about the indicator. A sample response can be found within this file.

The integration can perform the following action:

• GreyNoise Community - enriches IP Addresses with attributes describing the observed behavior of the IP Address.

The action is compatible with the following indicator type:

• IP Address

The action returns the following enriched indicator types:

• IP Address

This action is intended for use with ThreatQ TDR Orchestrator (TQO). An active TQO license is required for this feature.

Prerequisites

The action requires the following:

• A GreyNoise API key.
• An active ThreatQ TDR Orchestrator (TQO) license.
• A data collection containing the following indicator type:
  • IP Address

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.
 

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Actions option from the Category dropdown (optional).
3. Click on the action entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   The configurations set on this page will be used as the default settings when inserting this action into a new workflow. Updating the configurations on this page will not update any instances of this action that have already been deployed to a workflow. In that scenario, you must update the action’s configurations within the workflow itself.

   Parameter	Description
   GreyNoise API Key	Your API Key for authentication with the GreyNoise API.
   Objects Per Run	The maximum number of objects to submit per workflow run.  The max value for this parameter is 50,000.
   GreyNoise Context Filter	Maximum number of objects to submit per workflow run.  Options include: Classification Link Last Seen Name RIOT Noise

   
   
5. Review any additional settings, make any changes if needed, and click on Save.

Actions

The integration provides the following action:

{
    "ip": "111.121.216.118",
    "noise": true,
    "riot": false,
    "classification": "malicious",
    "name": "unknown",
    "link": "https://viz.greynoise.io/ip/111.121.216.118",
    "last_seen": "2022-12-02",
    "message": "Success"
}

Enriched Data

Object counts and action runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and action runtime may vary based on system resources and load.

Use Case Example

1. A Threat Analyst identifies a collection of IP Addresses they would like to enrich.
2. The Threat Analyst adds the GreyNoise Community Action to a Workflow
3. The Threat Analyst configures the action with the desired parameters, and enables the Workflow
4. The Workflow executes all Actions in the graph, including GreyNoise Community
5. The action returns the documented Attributes from the provider, and the Workflow ingests this data into the ThreatQ platform.

   Example Return Results:

   • 99 Indicators
   • 30 Indicator Attributes

Known Issues / Limitations

• The GreyNoise Community API is limited to 50 lookups per day.

Change Log

• Version 1.0.3
  • Initial release on the ThreatQ Marketplace.