GreyNoise

GreyNoise#

GreyNoise collects and analyzes the constant, widespread, opportunistic scan and attack traffic that hits every host on the public Internet. Mass scanners (Shodan, Censys), search engines, bots, worms, and crawlers fire indiscriminately at the IPv4 space. GreyNoise gives the operator a way to filter that noise out, so what is left is signal.

GreyNoise CLI#

Install and configure.

$ pip install greynoise
$ python setup.py install
$ greynoise setup --api-key <your-API-key>

Command options.

Command

Description

query

Run a GNQL structured query

account

View account information

alerts

List, create, delete, manage alerts

analyze

Analyze IP addresses (log file, stdin)

feedback

Send feedback to the GreyNoise team

filter

Filter noise from a log file or stdin

help

Show help and exit

interesting

Report one or more IPs as interesting

ip

Query all information on an IP

pcap

Get PCAP for a given IP

quick

Check whether IPs are noise

repl

Start an interactive shell

setup

Configure API key

signature

Submit IDS signature

stats

Aggregate stats from a GNQL query

version

Version and OS of GreyNoise

Filter#

Strip noise IPs from a log file.

$ cat ips.txt | greynoise filter > non-noise-ips.txt

Analyze#

Enrich IPs with ASN, category, classification, country, OS, org, tags.

$ cat ips.txt | greynoise analyze

Stats#

$ greynoise stats "ip:113.88.161.0/24 classification:malicious"

GNQL#

IP data.

$ greynoise query "ip:<IPAddr or CIDR>"
$ greynoise query "ip:113.88.161.215"
$ greynoise query "113.88.161.0/24"

Classification.

$ greynoise query "classification:<type>"
$ greynoise query "classification:malicious"

First seen, last seen, actor, tags.

$ greynoise query "first_seen:<YYYY-MM-DD>"
$ greynoise query "last_seen:<YYYY-MM-DD>"
$ greynoise query "actor:censys"
$ greynoise query "198.108.0.0/16 actor:censys"
$ greynoise query "tags:<tag string>"
$ greynoise query "tags:avtech"

Metadata.

$ greynoise query "metadata.category:ISP"
$ greynoise query "metadata.country:turkey"
$ greynoise query "metadata.country_code:RU"
$ greynoise query "metadata.city:moscow"
$ greynoise query "metadata.organization:Yandex"
$ greynoise query "metadata.rdns:*yandex*"
$ greynoise query "metadata.asn:AS17974"
$ greynoise query "metadata.tor:true"

Raw data.

$ greynoise query "raw_data.scan.port:23"
$ greynoise query "raw_data.scan.protocol:udp"
$ greynoise query "raw_data.web.paths:*admin*"
$ greynoise query "raw_data.web.useragents:*baidu*"
$ greynoise query "raw_data.ja3.fingerprint:<JA3 hash>"

GreyNoise UI#

The web UI at https://viz.greynoise.io/ accepts the same query fields directly (ip, classification, first_seen, actor, tags, metadata.*, raw_data.*).

References#

Contents