The GreyNoise integration for Chronicle is a pre-built scrpt that leverages the GreyNoise GNQL Query API to pull GreyNoise indicators and to submit the to the Chronicle SIEM ingestion API.
The code and installation instructions can be found: https://github.com/GreyNoise-Intelligence/greynoise-chronicle-siem
Integration in BETA
Please note that this integraiton is still in BETA testing. We are open to suggestions and improvements for how to improve this integration. Please submit feedback to [email protected]
Follow the information included on the GitHub page to create and manage the external script.
Each IPv4 internet scanner IP address will exist within Chronicle in Raw Log format with identified UDM fields.
The GitHub repo includes an indicator dashboard that can be imported into Chronicle to help identify the indicators created by the integration.
Updated 2 months ago