GreyNoise — Internet Scanner Intelligence

GreyNoise — Internet Scanner Intelligence

GreyNoise collects and analyses internet-wide scan traffic. It tells you whether an IP hitting your firewall is a known mass-scanner (benign research tool or malicious crawler) versus a targeted attacker — helping SOC teams filter out internet noise from real threats.

Community tier: The /v3/community/{ip} endpoint works with limited volume even without a key. Set GREYNOISE_API_KEY for higher rate limits.

When to Use

• An IP triggers a firewall rule and you want to know if it is just background internet noise
• SOC triage: is this alert a known scanner or a targeted attack?
• Filter false positives from SIEM before escalating an alert
• User asks "is this IP a scanner?", "is this noisy traffic?", "is IP X benign?"

How to Use

Check if an IP is a known internet scanner

$ip      = "71.6.135.131"
$headers = @{}
if ($env:GREYNOISE_API_KEY) { $headers['key'] = $env:GREYNOISE_API_KEY }

$result = Invoke-RestMethod -Uri "https://api.greynoise.io/v3/community/$ip" -Headers $headers
Write-Host "IP:             $($result.ip)"
Write-Host "Noise:          $($result.noise)"        # true = mass-scanner
Write-Host "RIOT:           $($result.riot)"         # true = trusted benign service
Write-Host "Classification: $($result.classification)"  # benign | malicious | unknown
Write-Host "Name:           $($result.name)"
Write-Host "Last seen:      $($result.last_seen)"
Write-Host "Link:           $($result.link)"
Write-Host "Message:        $($result.message)"

Triage a batch of IPs from a firewall log

$ips = @("1.1.1.1", "8.8.8.8", "71.6.135.131", "45.83.66.42")
$headers = @{}
if ($env:GREYNOISE_API_KEY) { $headers['key'] = $env:GREYNOISE_API_KEY }