TIP Integration Overview: Recorded Future

Install From Extensions List

To do the following, you must have permission to add Extensions in Recorded Future and access to the GreyNoise Enterprise API.

From the Recorded Future homepage, navigate to Menu>Tools > Extensions. Search the Extensions list for GreyNoise and Click Enable. Once enabled, click on Preferences of the extension, and enter your API Key.

901 — The GreyNoise Extension in the extensions list.

Performing an On-Demand IP Lookup

Once the GreyNoise extension is enabled, the Intelligence Card for IPv4 addresses will include a GreyNoise Card. Expand the card to query the IP address and return the information that GreyNoise knows about the IP

793 — GreyNoise Intelligence Card before executing the query

IPs that are Internet Noise

If an IP is found in only the GreyNoise Noise data set, Recorded Future will provide the following:

774 — Recorded Future indicating IP in GreyNoise NOISE dataset

IPs that are Benign Services

If an IP is found in only the GreyNoise RIOT data set, Recorded Future will provide the following:

774 — Recorded Future indicating IP in GreyNoise RIOT dataset

IPs that are Internet Noise and a Benign Service

If an IP is found in both the GreyNoise Noise and RIOT data set, Recorded Future will provide the following:

776 — Recorded Future indicating IP in both GreyNoise datasets

IPs that are Not Noise

If an IP is not found in the GreyNoise data set, Recorded Future will provide the following:

776 — Recorded Future indicating IP not in GreyNoise dataset