GreyNoise

GreyNoise Documentation Hub

Welcome to the GreyNoise Documentation Hub. You'll find comprehensive guides and documentation to help you start working with GreyNoise as quickly as possible, as well as support if you get stuck. Let's jump right in!

Get Started    API Reference

Integration Overview: XSOAR (Demisto)

Install From MarketPlace

To install the GreyNoise Content Pack within XSOAR, navigate to the Marketplace, search for GreyNoise then select Install from the Contact Pack Details page.

Searching for GreyNoise in XSOAR MarketplaceSearching for GreyNoise in XSOAR Marketplace

Searching for GreyNoise in XSOAR Marketplace

Installing GreyNoise Content PackInstalling GreyNoise Content Pack

Installing GreyNoise Content Pack

Configure an Instance of the GreyNoise Integration

To begin using the GreyNoise integration, browse to Integrations -> Servers & Services and search for GreyNoise within XSOAR. On the GreyNoise Integration item, click the Add Instance link then Enter a GreyNoise API key and test the connection.

Adding a new Instance of GreyNoise to XSOARAdding a new Instance of GreyNoise to XSOAR

Adding a new Instance of GreyNoise to XSOAR

Adding the GreyNoise API key and testingAdding the GreyNoise API key and testing

Adding the GreyNoise API key and testing

Performing an On-Demand IP Lookup

From the XSOAR Playground, start by typing:

!greynoise

As list of available commands will be displayed. Select the greynoise-ip-quick-check option then enter the ip= input follow by one or more IPs to query:

GreyNoise command context windowGreyNoise command context window

GreyNoise command context window

GreyNoise Quick Lookup commandGreyNoise Quick Lookup command

GreyNoise Quick Lookup command

Navigate to the Playground War Room to see the results of the lookup:

GreyNoise Quick Lookup ResultGreyNoise Quick Lookup Result

GreyNoise Quick Lookup Result

To do a full GreyNoise Context lookup, modify the command to be:
!greynoise !ip ip=x.x.x.x

GreyNoise Context lookup resultGreyNoise Context lookup result

GreyNoise Context lookup result

Playbooks

The XSOAR integration also includes some basic playbooks that can be used in conjunction with the GreyNoise lookup data. Here are some examples:

Calculate Severity for Egress Traffic - Can be used when determining severity of a Destination IP

GreyNoise Calculate Severity for Egress Traffic PlaybookGreyNoise Calculate Severity for Egress Traffic Playbook

GreyNoise Calculate Severity for Egress Traffic Playbook

Calculate Severity for Ingress Traffic- Can be used when determining severity of a Source IP

GreyNoise Calculate Severity for Ingress Traffic PlaybookGreyNoise Calculate Severity for Ingress Traffic Playbook

GreyNoise Calculate Severity for Ingress Traffic Playbook

Calculate Severity - Includes flag for Ingress vs Egress to Trigger Above Workflows

GreyNoise Calculate Severity for Egress or Ingress with Flag Traffic PlaybookGreyNoise Calculate Severity for Egress or Ingress with Flag Traffic Playbook

GreyNoise Calculate Severity for Egress or Ingress with Flag Traffic Playbook

Generic IP Enrichment Workflow

GreyNoise IP Reputation using GreyNoise DataGreyNoise IP Reputation using GreyNoise Data

GreyNoise IP Reputation using GreyNoise Data

Updated 5 months ago


Integration Overview: XSOAR (Demisto)


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.