Search - Usage Monitoring

What's a "Search"?

To simplify how we package and price our product, GreyNoise is introducing a new concept called a "Search."

For users familiar with GreyNoise, you may recall that we measured usage by a variety of different data points including, the number of IPs queried in a day, the amount of data exported from our product, and the number of active users on an account. We also tracked usage on our API and Visualizer differently.

Based on user feedback, we simplified the measure into an easy-to-understand action called a "Search."

So, what exactly is a search? It is any request for GreyNoise data that you make via any method.

Here are some examples:

  • Looking up an IP via the IP Context API = 1 Search
  • Looking up an IP on the Visualizer = 1 Search
  • Running a GNQL query within the Visualizer = 1 Search
  • Querying IP Similarity data on an IP = 1 Search
  • Looking at a Trends (Tag Details) Page = 1 Search
  • Running a Bulk Analysis (max 1000 IPs) = 1 Search
  • Running up to 1000 IPs through the Multi-IP Quick Check API = 1 Search

Are all Searches equal?

There are a few caveats on some of our "bulk" data lookups that are also worth noting. This is because there are several ways in the product to get a lot of information back about many different indicators in a single request. While the "bulk" requests make using the product more efficient, the information received is equivalent to doing the individual calls per IP.

Here are some examples:

  • Using the Multi-IP Context API = 1 Search is consumed for EACH IP submitted to the API
  • Using the GNQL API = 1 Search is consumed for EACH IP returned with the full context in the response. The default page size for this endpoint is 1,000, so if only a single page is requested, 1,000 Searches will be consumed. However, if a query has 50,000 results and all pages are requested, this will consume 50,000 Searches.
  • Running an Analysis Bulk Search on the Visualizer with more than 1,000 IPs = 1 Search per 1,000 IPs submitted to the Analysis page
  • Exporting results from an analysis with full context for each IP = 1 Search is consumed for EACH IP in the exported result
  • Exporting the results of a GNQL search in the Visualizer = 1 Search is consumed for EACH IP in the exported result

Search Counts By Feature

The following table labels all features within the product and what their search counts will be:

Interface

Feature

Count

Visualizer

GNQL Search

1 Search Each

Visualizer

GNQL Export

1 Search per IP in Export

Visualizer

IP Details View

1 Search Each

Visualizer

No Results Page View

1 Search Each

Visualizer

Analysis

1 Search per 1,000 IPs Submitted

Visualizer

Analysis Export

1 Search per IP in Export

Visualizer

Trends (Tag Details) View, plus manual download of IP List

1 Search Each

Visualizer

IP Similarity View

1 Search

Visualizer

IP Similarity Export

1 Search

Visualizer

IP Timeline View

No additional Search, included in IP Details View

API

Community IP Lookup

1 Search Each

API

GNQL

1 Search per IP in Result

API

GNQL Stats

1 Search Each

API

Context IP Lookup

1 Search Each

API

Context Multi-IP Lookup

1 Search per IP submitted

API

Quick IP Lookup

1 Search Each

API

Quick Multi-IP Lookup

1 Search Each

API

RIOT IP Lookup

1 Search Each

API

IP Similarity Lookup

1 Search Each

API

IP Timeline Lookup

1 Search Each

API

Metadata

No usage restriction, just requires paid subscription

What about user accounts?

We will no longer be limiting the number of accounts that can be associated with a subscription, so subscription holders can have as many users create accounts as they like.