GreyNoise for SOC Analysts: A Practical Threat Hunting Playbook

·

Introduction

Every SOC analyst knows the pain. Your SIEM fires off hundreds of alerts. You triage an IP, spend 20 minutes pivoting through VirusTotal, Shodan, and threat intel feeds — and it turns out it's just a Censys scanner doing routine internet-wide recon. Time wasted. Threat missed elsewhere.

GreyNoise solves that exact problem. It is a mass internet noise intelligence platform that tells you whether an IP is scanning the whole internet opportunistically — or specifically targeting you. If an IP is "noisy" (mass scanner, botnet, benign crawler), you can deprioritise it immediately. If it's not in GreyNoise at all — that's your signal to dig deeper, because it may be a targeted, targeted attack actor.

This guide is a practical SOC analyst playbook — not a product demo. You'll get real GNQL queries, workflow steps, and integration patterns you can implement in your SOC today.

Background / Overview: What Is GreyNoise?

GreyNoise operates a global network of passive sensors distributed across the internet. These sensors act as passive honeypots — they don't belong to any organisation, have no legitimate traffic, and exist only to capture unsolicited inbound traffic. Every IP that hits these sensors gets collected, analysed, and tagged.

What GreyNoise Tags Tell You

| Classification | Meaning | SOC Action |

|---|---|---|

| Benign | Known good scanners (Shodan, Censys, Google) | Deprioritise / whitelist |

| Malicious | Confirmed bad actor scanning activity | Escalate immediately |

| Unknown | Seen scanning but not yet classified | Investigate further |

| Not in GreyNoise | No mass scanning observed | HIGH PRIORITY — possibly targeted |

> 🔑 SOC Rule of Thumb: If an attacker IP is not in GreyNoise, it means it's not doing mass internet scanning. It may be operating quietly, targeting just your organisation — and that makes it far more dangerous.

Core GreyNoise Capabilities

- IP Lookup — Single or bulk IP enrichment

- GNQL (GreyNoise Query Language) — Advanced threat hunting queries

- CVE Tracking — Real-time exploitation intelligence

- RIOT (Rules of Internet Observations) — Identifies legitimate services (Slack, Office 365, AWS) that generate false positives

- Recall — Time-series historical analysis for retrospective investigations

- API & Integrations — Splunk, Microsoft Sentinel, Cortex XSOAR, ThreatConnect, and more

Technical Breakdown: Step-by-Step SOC Workflows

🔷 Step 1: Set Up Your GreyNoise Account and API Key

1. Go to [https://www.greynoise.io](https://www.greynoise.io) and register — a Community (Free) tier is available

2. Navigate to your Account Settings → API Key

3. Copy your API key

4. Install the GreyNoise CLI for terminal-based hunting:

```bash

pip install greynoise

greynoise setup --api-key YOUR_API_KEY

  1. Test with a quick IP lookup:

greynoise ip 198.20.70.114

This returns classification, tags, ASN, country, and behaviour metadata — in seconds.

🔷 Step 2: Alert Triage — Is This IP Internet Noise or a Real Threat?

This is the most common daily workflow for Tier 1 and Tier 2 analysts.

Scenario: Your SIEM triggers an alert — an external IP 185.220.101.47 is hammering your SSH port.

GreyNoise CLI Quick Triage:

greynoise ip 185.220.101.47

What to look for in the output:

  • classification: malicious → Escalate immediately

  • classification: benign + tags: Tor Exit Node → Known Tor relay, low targeted risk

  • seen: false → Not in GreyNoise dataset → Treat as potentially targeted — high priority

Bulk IP Triage from SIEM logs:

# Export suspicious IPs from SIEM to a file, then bulk query
cat suspicious_ips.txt | greynoise bulk -f json

This cuts triage time from hours to minutes across dozens of alerts.

🔷 Step 3: Use GNQL for Proactive Threat Hunting

The GreyNoise Query Language (GNQL) lets you search across GreyNoise's entire sensor dataset using filters like tags, CVEs, ASNs, ports, countries, and time ranges.

Access it at: https://viz.greynoise.io (GreyNoise Visualizer) or via CLI.

Hunt 1 — Find Active Exploitation of a Specific CVE

cve:CVE-2024-3400

This shows every IP GreyNoise observed exploiting the Palo Alto PAN-OS command injection vulnerability (CVE-2024-3400) in real time.

Hunt 2 — Find Non-Benign RDP Scanners (Excluding Common Noise)

tags:"RDP Alternative Port Crawler" NOT classification:benign NOT raw_data.scan.port:3389 NOT (metadata.asn:AS14061 OR metadata.organization:"Linode, LLC")

By removing known benign providers and standard port 3389, you surface suspicious non-standard RDP scanning activity.

Hunt 3 — Find Malicious IPs in a Specific Country

classification:malicious metadata.country:Russia

Useful for geo-targeted threat intel reporting or firewall policy reviews.

Hunt 4 — Find Hosts Running Exploitation Payloads

base64 OR fromcharcode OR powershell OR "sh "

This surfaces IPs sending encoded payloads — often command execution attempts via exploits or misconfigurations. Excellent for finding C2 callback URLs and second-stage payload hosts.

Hunt 5 — Discover All CVEs Being Exploited Across a Wildcard

cve:"CVE-2024-*"

Returns every GreyNoise-observed IP exploiting any 2024 CVE — critical for vulnerability prioritisation during patch cycles.

Hunt 6 — JA3 TLS Fingerprint Hunting

raw_data.ja3.fingerprint:795bc7ce13f60d61e9ac03611dd36d90

JA3 fingerprints identify the exact TLS tooling or malware family an attacker is using. This allows you to pivot from one known malicious IP to an entire campaign infrastructure.

🔷 Step 4: Investigate a Suspicious IP in the Visualizer

The GreyNoise Visualizer at viz.greynoise.io provides a GUI-based investigation workflow.

  1. Enter the IP in the search bar

  2. Review the metadata panel — country, ASN, organisation, first seen / last seen

  3. Check tags — GreyNoise labels behaviour e.g., "Mirai Bot", "CVE Scanner", "Tor Exit Node", "Cobalt Strike"

  4. Open the Raw Data tab — inspect the actual HTTP requests, user agents, paths, and payloads the IP sent to GreyNoise sensors

  5. Check the Timeline / Activity History — has this IP been active for 6 months or did it appear yesterday? New IPs with aggressive scanning = elevated suspicion

  6. Use the "Similar IPs" feature to pivot to campaign infrastructure

💡 Analyst Tip: An IP with first_seen: yesterday + classification: malicious + no RIOT entry is a strong signal of freshly spun-up attack infrastructure — often used in targeted campaigns before being widely flagged.

🔷 Step 5: CVE Exploitation Tracking — Real-Time Vulnerability Intelligence

GreyNoise's CVE tab is one of its most powerful features for threat intelligence analysts.

Workflow for CVE-Based Hunting:

  1. Log into the GreyNoise Visualizer

  2. Navigate to the CVEs Tab

  3. Paste CVE IDs from your vulnerability scanner (e.g., Tenable, Qualys exports)

  4. GreyNoise returns: How many IPs are actively exploiting it, from which countries, and since when

  5. Cross-reference with CISA KEV — GreyNoise has detected exploitation activity on CVEs not yet listed in KEV, giving you early warning days before official advisories

Real-World Example (February 2025):

GreyNoise detected active exploitation of 23 out of 62 CVEs referenced in Black Basta ransomware group's leaked chat logs — including CVE-2024-3400 (Palo Alto PAN-OS), CVE-2024-27198 (JetBrains TeamCity), and CVE-2021-44228 (Log4Shell). CVE-2023-6875 was actively exploited despite not being in CISA's KEV catalog at the time.

CLI query to track active CVE exploitation:

greynoise query 'cve:CVE-2024-27198' -f json | jq '.ip, .classification, .tags'

🔷 Step 6: Use Recall for Retrospective / Incident Investigation

GreyNoise Recall is a time-series feature that lets you query historical sensor data across a specific date range — critical for incident response timelines.

Scenario: You're investigating a breach and found an attacker IP 91.92.248.xxx. You need to know: Was this IP scanning the internet before the breach, or was it targeted activity post-breach?

How to use Recall:

  1. In the Visualizer, search the IP

  2. Click the "Recall" tab

  3. Set your date range (e.g., 30 days before incident date)

  4. Review whether the IP appears in mass-scanning data prior to the breach window

  5. If it does not appear in Recall data → the IP was likely deployed specifically for this attack, not a scanner

This supports accurate incident timeline attribution and helps determine blast radius.

🔷 Step 7: Integrate GreyNoise with Your SIEM

Microsoft Sentinel Integration

  1. In Sentinel, go to Content Hub → Search "GreyNoise"

  2. Install the GreyNoise Threat Intelligence connector

  3. Configure your API key under Data Connectors

  4. GreyNoise will push threat indicators (malicious IPs, tags) directly into your Sentinel TI workspace

  5. Build hunting queries using:

ThreatIntelligenceIndicator
| where Description contains "GreyNoise"
| where Active == true
| join kind=inner (
    CommonSecurityLog
    | where TimeGenerated > ago(24h)
) on $left.NetworkIP == $right.SourceIP
| project TimeGenerated, SourceIP, Description, ThreatType, Tags

Splunk Integration

  1. Install the GreyNoise App for Splunk from Splunkbase

  2. Configure API key under App Settings → GreyNoise Setup

  3. Enable Scan Deployment to auto-enrich all IP fields in your indexed data

  4. Use the built-in Threat Hunting Dashboard — it surfaces unknown/malicious IPs exploiting CVEs directly in your Splunk environment

Detection & Defense

Using GreyNoise as a Detection Layer

  • Filter benign mass-scanners from SIEM alerts: Any IP tagged as benign in GreyNoise can be auto-closed or deprioritised in your SOAR playbook — this alone can reduce false positive alert volume by 40–60% in most environments

  • Monitor for IPs NOT in GreyNoise: Build a SIEM rule or SOAR action to flag external IPs that appear in your firewall/proxy logs but return seen: false from the GreyNoise API — these represent potentially targeted actors

  • CVE exploitation alerts: Set GreyNoise tag watches on CVEs that affect your environment. When scanning volume spikes (e.g., a new CVE hits), GreyNoise notifies you before public PoC exploitation is widespread

  • Track new IPs first seen in last 24–48 hours that are already classified malicious — freshly stood-up infrastructure often indicates active campaign operations

Sample GreyNoise SOAR Enrichment Logic (Pseudo-Playbook)


Trigger: SIEM alert → external IP detected
  ↓
Action 1: Query GreyNoise API → GET /v2/noise/context/{ip}
  ↓
IF classification == "benign" → Auto-close alert → Log enrichment
IF classification == "malicious" → Escalate to Tier 2 → Block at firewall
IF seen == false → Escalate immediately → Treat as targeted threat
IF classification == "unknown" → Enrich further with Shodan/VirusTotal

Remediation & Best Practices

  1. Deploy GreyNoise API enrichment in your SOAR — automate triage enrichment for every external IP-based alert; don't rely on manual lookups

  2. Create a CVE watchlist — track CVEs affecting your production stack in the GreyNoise CVE tab, and get early warning of exploitation trends before patches are mandated

  3. Block GreyNoise-tagged malicious IPs at the perimeter — export daily malicious feeds via the API and push to your firewall, proxy, or EDR blocklist

  4. Use RIOT lookups before blocking — RIOT tells you if an IP belongs to a legitimate service like Office 365 or Slack; blocking these causes self-inflicted outages

  5. Combine GreyNoise with Shodan — for IPs not classified by GreyNoise, pivot to Shodan to identify open services and banners to build a fuller attacker profile

  6. Monitor for new first-seen IPs daily — run the following CLI query every morning as part of your daily threat intel brief:

greynoise query 'classification:malicious first_seen:1d' -f json | jq '.ip, .tags, .metadata.country'

  1. Tag-based threat hunting cadence — build a weekly hunt around GreyNoise tags relevant to your sector (e.g., healthcare: tags:"Citrix Scanner", finance: tags:"ProxyLogon")

Key Takeaways

  • GreyNoise separates internet background noise from targeted threats — the single most valuable use case for alert-fatigued SOC teams

  • An IP not in GreyNoise is MORE suspicious, not less — it indicates quiet, potentially targeted activity

  • GNQL gives you powerful threat hunting capabilities without needing a SIEM — start broad with wildcards, then narrow with boolean filters

  • CVE exploitation tracking in GreyNoise beats static feeds — it gives you real-time, ground-truth data on what's being actively exploited in the wild

  • Recall enables retrospective investigations — critical for proving attacker pre-positioning before an incident

  • Integration with Sentinel and Splunk turns GreyNoise from a lookup tool into an automated detection layer

  • The free Community tier is powerful enough to start — but paid tiers unlock GNQL query history, bulk lookups, CVE monitoring, and full API access

References

  • GreyNoise Threat Hunting Product Page

  • GreyNoise GNQL Documentation

  • GreyNoise 6 Ways to Threat Hunt

  • GreyNoise Black Basta CVE Exploitation Analysis

  • GreyNoise Recall: Time-Series Intelligence

  • GreyNoise Microsoft Sentinel Integration

  • GreyNoise Splunk Integration

🔗 Stay Connected

If you found this guide useful, follow CyberHawk for more real-world threat intelligence, SOC workflows, and cybersecurity deep dives:

  • 🌐 Web App: Sign up FREE → app.cyberhawkthreatintel.com

  • ▶️ YouTube: @cyberhawkconsultancy | @cyberhawkk

  • 🎵 TikTok: @cyberhawkthreatintel

  • 🐦 X (Twitter): @cyberhawkintel

  • 📢 Telegram: @cyberhawkthreatintel

#cyberhawkthreatintel #cyberhawkconsultancy #cyberhawkk #GreyNoise #ThreatHunting #SOCAnalyst #ThreatIntelligence #GNQL #CyberSecurity #IncidentResponse #CVETracking #AlertTriage #SIEM #MicrosoftSentinel #Splunk #SecurityOperations #CyberThreatIntel #SOCTips #InfoSec #RedTeam #BlueTeam #DetectionEngineering #SOAR #PenTest #MalwareAnalysis #NetworkSecurity #CyberDefense #SecurityAnalyst #CTI