What is the GreyNoise Community Dataset?

The Community Dataset is a collection of internet scan and attack traffic contributed by sensors that GreyNoise users deploy in their own environments. It is aggregated across every user running a sensor and made available as a distinct, queryable dataset alongside the core GreyNoise dataset.

Unlike the primary GreyNoisedataset, which is collected directly by GreyNoise's own Global Observation Grid (GOG), the Community dataset is collected by sensors that are owned and deployed by the community, but which flow through the same GreyNoise sensor pipeline and analysis engine. This means community-contributed traffic receives the same tagging, classification, and enrichment as data collected on GreyNoise's own infrastructure, while remaining identifiable as an independent source.

How the Community Dataset relates to Project Swarm

The Community Dataset is the aggregate output of Project Swarm, GreyNoise's research initiative that opens up its deception platform to the global security community. When a Project Swarm participant deploys a sensor, that sensor's traffic is:

1. Captured and analyzed by GreyNoise's sensor pipeline, with the same fidelity (full session capture, tagging, classification) as the core GreyNoise sensor network.
2. Made available to the sensor owner directly, in their personal workspace (workspace_label:personal), for their own investigation and research.
3. Aggregated, but stripped of any information that would identify the contributing sensor or its owner, into the shared Community Dataset (workspace_label:community), where it becomes available to everyone with access to query it.

In short, Project Swarm is the program that lets people contribute sensors, and the Community Dataset is the data those contributions produce once aggregated. Deploying a sensor through Project Swarm feeds the Community Dataset.

Who can access the Community Dataset?

The Community Dataset is available to:

• All paying GreyNoise Customers, as part of their existing subscription.
• Anyone who joins Project Swarm and deploys a sensor.

Accessing the Community Dataset

Both the IP Lookup and GNQL API endpoints accept a workspace_labelparameter/query value, which determines which dataset a request pulls from:

Using the Community Dataset in the GNQL API

To query the Community Dataset on its own, add workspace_label:community to your GNQL query:

tags:Mirai AND workspace_label:community

This returns only community-sourced results, for example, all IPs tagged Mirai that were observed by Project Swarm sensors rather than GreyNoise's own sensor grid.

Sample request using the GreyNoise SDK:

from greynoise.api import GreyNoise, APIConfig

api_config = APIConfig(api_key="<api-key>", integration_name="community-dataset-sample")
session = GreyNoise(api_config)

query = "last_seen:1d AND workspace_label:community"
response = session.query(query, exclude_raw=True, size=10000)

print(f"Total community IPs: {response.get('request_metadata', {}).get('count', 0)}")

Using the Community Dataset in the IP API

The v3 IP Lookup endpoints provide an additional parameter called workspace_labels to indicate which dataset to check for the IP in. To check for an IP in the Community dataset append workspace_labels=communityto the API request:

import requests

headers = {"key": "<api-key>", "Accept": "application/json"}

ip_address = "64.39.104.22"
url = url = f"https://api.greynoise.io/v3/ip/{ip_address}?workspace_labels=community"
response = requests.get(url, headers=headers)

data = response.json()
print(data)

Aggregating Community and GreyNoise data together

Because the Community Dataset and the core GreyNoise dataset are both queryable through the same endpoints, you can combine them in a single request rather than treating them as two separate lookups.

In GNQL

Use a boolean OR across workspace_label values to pull results from multiple datasets in one query. For example, to get all malicious IPs seen in the last day from both the GreyNoise dataset and the Community Dataset:

last_seen_malicious:1d AND classification:malicious AND (workspace_label:greynoise OR workspace_label:community)

This returns a single, deduplicated result set spanning both sources, which is useful when you want the broadest possible view of malicious activity without caring which sensor network first observed it.

Questions?

If you have any questions or issues accessing the dataset, please reach out to [email protected].