SOAR Integration Overview: XSOAR (Demisto)
Install From MarketPlace
To install the GreyNoise Content Pack within XSOAR, navigate to the Marketplace, search for GreyNoise
then select Install from the Contact Pack Details page.

Searching for GreyNoise in XSOAR Marketplace

Installing GreyNoise Content Pack
Configure an Instance of the GreyNoise Integration
To begin using the GreyNoise integration, browse to Integrations -> Servers & Services and search for GreyNoise within XSOAR. On the GreyNoise Integration item, click the Add Instance link then Enter a GreyNoise API key and test the connection.

Adding a new Instance of GreyNoise to XSOAR

Adding the GreyNoise API key and testing
Performing an On-Demand IP Lookup
From the XSOAR Playground, start by typing:
!greynoise
As list of available commands will be displayed. Select the greynoise-ip-quick-check option then enter the ip=
input follow by one or more IPs to query:

GreyNoise command context window

GreyNoise Quick Lookup command
Navigate to the Playground War Room to see the results of the lookup:

GreyNoise Quick Lookup Result
To do a full GreyNoise Context lookup, modify the command to be:
!greynoise !ip ip=x.x.x.x

GreyNoise Context lookup result
To do a perform IP Timeline lookup, run a command similar to the following:
!greynoise-timeline ip="45.164.214.212" days="90" maximum_results="10"

GreyNoise IP Timeline result
To perform an IP Similarity search, run a command similar to the following:
!greynoise-similarity ip="59.88.225.2" minimum_score="95" maximum_results="10"

GreyNoise Similarity result
Playbooks
The XSOAR integration also includes some basic playbooks that can be used in conjunction with the GreyNoise lookup data. Here are some examples:
Calculate Severity for Egress Traffic - Can be used when determining severity of a Destination IP

GreyNoise Calculate Severity for Egress Traffic Playbook
Calculate Severity for Ingress Traffic- Can be used when determining severity of a Source IP

GreyNoise Calculate Severity for Ingress Traffic Playbook
Calculate Severity - Includes flag for Ingress vs Egress to Trigger Above Workflows

GreyNoise Calculate Severity for Egress or Ingress with Flag Traffic Playbook
Generic IP Enrichment Workflow

GreyNoise IP Reputation using GreyNoise Data
Updated 26 days ago