--- updatedAt: 2026-02-20T21:08:23.000Z agentTools: projectIndex: https://docs.greynoise.io/llms.txt --- # Intelligence Module Comparison: Internet Scanners ## Internet Scanner - Intelligence Module Comparison The following table compares the fields included for each Internet Scanner intelligence module. **Last Updated**: 2025-10-08 | Field Name | Triage | Investigate | Hunt | Endpoint(s) | | :------------------------------------------------------------------------ | :----- | :---------- | :--- | :--------------- | | actor | YES | YES | YES | IP/GNQL | | bot | YES | YES | YES | IP/GNQL | | classification | YES | YES | YES | IP/GNQL | | ip | YES | YES | YES | IP/GNQL | | last\_seen | YES | YES | YES | IP/GNQL | | last\_seen\_timestamp | YES | YES | YES | IP/GNQL | | metadata.asn | YES | YES | YES | IP/GNQL | | metadata.category | YES | YES | YES | IP/GNQL | | metadata.city | YES | YES | YES | IP/GNQL | | metadata.destination\_countries | YES | YES | YES | IP/GNQL | | metadata.destination\_country\_codes | YES | YES | YES | IP/GNQL | | metadata.domain | YES | YES | YES | IP/GNQL | | metadata.mobile | YES | YES | YES | IP/GNQL | | metadata.organization | YES | YES | YES | IP/GNQL | | metadata.rdns | YES | YES | YES | IP/GNQL | | metadata.rdns\_parent | YES | YES | YES | IP/GNQL | | metadata.region | YES | YES | YES | IP/GNQL | | metadata.single\_destination | YES | YES | YES | IP/GNQL | | metadata.source\_country | YES | YES | YES | IP/GNQL | | metadata.source\_country\_code | YES | YES | YES | IP/GNQL | | metadata.tor | YES | YES | YES | IP/GNQL | | spoofable | YES | YES | YES | IP/GNQL | | stats.actor.count | YES | YES | YES | STATS | | stats.category.count | YES | YES | YES | STATS | | stats.classification.count | YES | YES | YES | STATS | | stats.destination\_countries.count | YES | YES | YES | STATS | | stats.organization.count | YES | YES | YES | STATS | | stats.source\_country.count | YES | YES | YES | STATS | | stats.spoofable.count | YES | YES | YES | STATS | | stats.tags.count | YES | YES | YES | STATS | | tags.created\_at\\ | YES | YES | YES | IP/GNQL/METADATA | | tags.cves | YES | YES | YES | IP/GNQL/METADATA | | tags.description | YES | YES | YES | IP/GNQL/METADATA | | tags.id | YES | YES | YES | IP/GNQL/METADATA | | tags.intention | YES | YES | YES | IP/GNQL/METADATA | | tags.name | YES | YES | YES | IP/GNQL/METADATA | | tags.recommended\_block | YES | YES | YES | IP/GNQL/METADATA | | tags.references | YES | YES | YES | IP/GNQL/METADATA | | tags.slug | YES | YES | YES | IP/GNQL/METADATA | | tags.updated\_at | YES | YES | YES | IP/GNQL/METADATA | | tor | YES | YES | YES | IP/GNQL | | vpn | YES | YES | YES | IP/GNQL | | vpn\_service | YES | YES | YES | IP/GNQL | | first\_seen | | YES | YES | IP/GNQL | | metadata.destination\_asns | | YES | YES | IP/GNQL | | metadata.destination\_cities | | YES | YES | IP/GNQL | | metadata.sensor\_hits | | YES | YES | IP/GNQL | | metadata.sensor\_count | | YES | YES | IP/GNQL | | metadata.source\_latitude | | YES | YES | IP/GNQL | | metadata.source\_longitude | | YES | YES | IP/GNQL | | raw\_data.scan.port | | YES | YES | IP/GNQL | | raw\_data.scan.protocol | | YES | YES | IP/GNQL | | raw\_data.source.bytes | | YES | YES | IP/GNQL | | stats.asn.count | | YES | YES | STATS | | cve | | YES | YES | IP/GNQL | | id (cve) | | YES | YES | CVE | | details.vulnerability\_name | | YES | YES | CVE | | details.vulnerability\_description | | YES | YES | CVE | | details.cve\_cvss\_score | | YES | YES | CVE | | details.product | | YES | YES | CVE | | details.vendor | | YES | YES | CVE | | details.published\_to\_nist\_nvd | | YES | YES | CVE | | timeline.cve\_published\_date | | YES | YES | CVE | | timeline.cve\_last\_updated\_date | | YES | YES | CVE | | timeline.first\_known\_published\_date | | YES | YES | CVE | | timeline.cisa\_kev\_date\_added | | YES | YES | CVE | | exploitation\_details.attack\_vector | | YES | YES | CVE | | exploitation\_details.exploit\_found | | YES | YES | CVE | | exploitation\_details.exploitation\_registered\_in\_kev | | YES | YES | CVE | | exploitation\_details.epss\_score | | YES | YES | CVE | | exploitation\_stats.number\_of\_available\_exploits | | YES | YES | CVE | | exploitation\_stats.number\_of\_threat\_actors\_exploiting\_vulnerability | | YES | YES | CVE | | exploitation\_stats.number\_of\_botnets\_exploiting\_vulnerability | | YES | YES | CVE | | exploitation\_activity.activity\_seen | | YES | YES | CVE | | exploitation\_activity.benign\_ip\_count\_1d | | YES | YES | CVE | | exploitation\_activity.benign\_ip\_count\_10d | | YES | YES | CVE | | exploitation\_activity.benign\_ip\_count\_30d | | YES | YES | CVE | | exploitation\_activity.threat\_ip\_count\_1d | | YES | YES | CVE | | exploitation\_activity.threat\_ip\_count\_10d | | YES | YES | CVE | | exploitation\_activity.threat\_ip\_count\_30d | | YES | YES | CVE | | metadata.os | | | YES | IP/GNQL | | raw\_data.hassh.fingerprint | | | YES | IP/GNQL | | raw\_data.hassh.port | | | YES | IP/GNQL | | raw\_data.http.cookie\_keys | | | YES | IP/GNQL | | raw\_data.http.host | | | YES | IP/GNQL | | raw\_data.http.md5 | | | YES | IP/GNQL | | raw\_data.http.method | | | YES | IP/GNQL | | raw\_data.http.path | | | YES | IP/GNQL | | raw\_data.http.request\_authorization | | | YES | IP/GNQL | | raw\_data.http.request\_cookies | | | YES | IP/GNQL | | raw\_data.http.request\_headers | | | YES | IP/GNQL | | raw\_data.http.request\_origin | | | YES | IP/GNQL | | raw\_data.http.useragent | | | YES | IP/GNQL | | raw\_data.ja3.fingerprint | | | YES | IP/GNQL | | raw\_data.ja3.port | | | YES | IP/GNQL | | raw\_data.ssh.key | | | YES | IP/GNQL | | raw\_data.tls.cipher | | | YES | IP/GNQL | | raw\_data.tls.ja4 | | | YES | IP/GNQL | | raw\_data.http.ja4h | | | YES | IP/GNQL | | raw\_data.ssh.ja4ssh | | | YES | IP/GNQL | | raw\_data.tcp.ja4t | | | YES | IP/GNQL | | raw\_data.tcp.ja4l | | | YES | IP/GNQL | | stats.operating\_system.count | | | YES | STATS |