---
updatedAt: 2025-01-27T14:08:04.000Z
agentTools:
  projectIndex: https://docs.greynoise.io/llms.txt
---

# SOAR Integration Overview: Splunk SOAR (Phantom)

## Download App from Splunkbase

Find the latest version here: <https://splunkbase.splunk.com/app/6347/>.

<Image title="Screen Shot 2022-03-18 at 4.16.16 PM.png" alt={1221} src="https://files.readme.io/8e80cff-Screen_Shot_2022-03-18_at_4.16.16_PM.png">
  The GreyNoise App download from SplunkBase
</Image>

## Install From Splunk SOAR Apps

From within Splunk SOAR, in the Apps UI, click the Install App button

<Image title="apps_landing_screen.png" alt={1491} src="https://files.readme.io/c38fc75-apps_landing_screen.png">
  Click the Install App button
</Image>

Select the downloaded GreyNoise App bundle and click Install

<Image title="apps_install_window.png" alt={1470} src="https://files.readme.io/7cee65d-apps_install_window.png">
  Installing the GreyNoise App
</Image>

<Image title="Screen Shot 2021-08-19 at 9.11.28 AM.png" alt={2112} src="https://files.readme.io/55fecb4-Screen_Shot_2021-08-19_at_9.11.28_AM.png">
  GreyNoise App details
</Image>

## Configure an Instance of the GreyNoise Integration

The GreyNoise App will appear under the Unconfigured Apps menu.  Select the Configure New Asset button.  Give the asset a name and description.

<Image title="Screen Shot 2021-08-19 at 9.12.34 AM.png" alt={1186} src="https://files.readme.io/3862bac-Screen_Shot_2021-08-19_at_9.12.34_AM.png">
  Creating a new GreyNoise Asset
</Image>

Under the Asset Settings section, add a GreyNoise API key and configure a GNQL to use for the On Poll action.

<Image title="Screen Shot 2021-08-19 at 9.12.50 AM.png" alt={1756} src="https://files.readme.io/660c2b2-Screen_Shot_2021-08-19_at_9.12.50_AM.png">
  Adding the GreyNoise API Key
</Image>

## Performing an On-Demand IP Lookup

A variety of actions can be run on-demand, including IP Reputation (Noise), RIOT Lookup and Community API Lookup.

<Image title="Screen Shot 2021-08-19 at 9.26.05 AM.png" alt={2648} src="https://files.readme.io/758bb13-Screen_Shot_2021-08-19_at_9.26.05_AM.png">
  IP Reputation (Noise) Lookup results
</Image>

<Image title="Screen Shot 2021-08-19 at 9.25.25 AM.png" alt={2648} src="https://files.readme.io/dab2ea7-Screen_Shot_2021-08-19_at_9.25.25_AM.png">
  RIOT IP Lookup results
</Image>

<Image title="Screen Shot 2021-08-19 at 9.24.58 AM.png" alt={2160} src="https://files.readme.io/33918e9-Screen_Shot_2021-08-19_at_9.24.58_AM.png">
  Community IP Lookup results
</Image>

## Playbooks

In addition to the App, GreyNoise has also published playbooks that can help with common tasks.  The playbooks can be downloaded from my.phantom.us and uploaded to your local phantom instance.

[GreyNoise GNQL Enrichment](https://my.phantom.us/4.10/playbook/greynoise-gnql-enrichment/)

![2110](https://files.readme.io/d997536-greynoise_gnql_enrichment.png "greynoise_gnql_enrichment.png")

[GreyNoise Update Severity from IP Reputation](https://my.phantom.us/4.10/playbook/greynoise-update-severity-from-ip-reputation/)

![3370](https://files.readme.io/cc00fde-greynoise_update_severity_from_ip_reputation.png "greynoise_update_severity_from_ip_reputation.png")

[GreyNoise IP Enrichment](https://my.phantom.us/4.10/playbook/greynoise-ip-enrichment/)

![1538](https://files.readme.io/dd67f9d-greynoise_ip_enrichment.png "greynoise_ip_enrichment.png")

[GreyNoise On Poll Set Severity](https://my.phantom.us/4.10/playbook/greynoise-on-poll-set-severity/)

![2024](https://files.readme.io/282ff64-greynoise_on_poll_set_severity.png "greynoise_on_poll_set_severity.png")