New! AI Cyber Index: Benchmarking AI Models on Defensive Capabilities
Participate in Project Swarm by deploying your own sensors, and get complimentary access to GreyNoise data for your classes, your research, and your security team. At no cost.
Project Swarm is a GreyNoise research initiative that opens our deception platform to the broader security community. Trusted partners contribute sensors, device profiles, and detection rules.
The goal is to transform GreyNoise from a proprietary sensor network into a collective intelligence platform, where participating organizations contribute to and benefit from a broader view of threat activity.
Both are available to your institution, and you are welcome to pursue either one or both together.
Project Swarm workspace for classes, with unmetered data for coursework and research.
Access to sensor data via Project Swarm and GreyNoise Block, dynamic blocklists.
How it works
01
Professors provide class information. Start and end dates for each class, and roughly how many students.
02
Students register. A free account at viz.greynoise.io using their student email address.
03
Workspace access granted. Students are added to their class's Swarm Workspace once registered.
04
Sensors deployed. Each class maintains at least one sensor for students to work with.
For students
✓
Every student's data is unique
Students can stand up their own sensor and investigate what it observes. Rather than a prepared dataset built for a class, students work with live observations from a sensor of their own.
✓
Evidence within minutes
Full packet captures arrive within minutes of an interaction: payloads, JA4 fingerprints, and post-compromise activity mapped to MITRE ATT&CK.
✓
Honeypot work without the risk
The deception software runs in the GreyNoise cloud, not on the sensor. Nothing exploitable is ever installed on campus infrastructure.
✓
Experience that transfers to the job
Triaging sessions, pivoting across related infrastructure, and reporting findings is the daily work of SOC analysts, threat hunters, CTI analysts, and detection engineers.
For professors
✓
No shortage of data to teach with
Enough depth to run through an entire course rather than a single late-semester chapter, from sensor deployment through analysis and reporting.
✓
Shared curriculum
We collaborate with professors across participating institutions on teaching material, and credit the schools behind it.
✓
Real research
Nothing here is synthetic. Session data and full packet captures come from real activity observed on the internet, at a depth most departments cannot resource on their own, and extended API lookback makes longitudinal work possible.
✓
Quick start
No license, no purchase order, no renewal. Provide class dates and student email addresses and the workspace is set up for you.
Edge devices cannot run agents and rarely emit useful telemetry, so activity against them stays largely invisible, and deception is the practical way to observe it.
01
You deploy
The sensors can be configured to look like the institution's real production systems, minus any sensitive data. This produces intelligence no paid feed can provide: direct, actionable, and useful across the entire security org.
What each sensor needs
A dedicated host. Ubuntu 22.04, Ubuntu 24.04, or Debian 13 (kernel 5.6 or later), 1 vCPU, 512 MB RAM, 8 GB storage, root access during installation, ports 80 and 443 available.
One public IP per sensor, on institution-owned address space.
02
You get
Real-time blocklists built from observed attack traffic rather than static third-party feeds. Lists are defined with GreyNoise Query Language (GNQL), so the team blocks exactly what it chooses, by CVE, by tag, by geography, or by how recently the activity was seen.
Learn more about GreyNoise Block
$10,000
Annual value
01
Stop active threats at the perimeter
Use intelligence observed directly by GreyNoise sensors instead of stale third-party reputation feeds.
02
Custom blocklists with GNQL
Target specific CVEs, tags, geographies, classifications, and known actors.
03
Refresh automatically
Use the latest IPs that match your query, drawn from billions of events observed daily.
Merit Network is an independent nonprofit governed by Michigan's public universities, and operates America's longest-running regional research and education network. Its security team deployed more than 250 GreyNoise deception sensors, then wired GreyNoise Block lists into its firewalls and alerting pipeline.
Read the full case studyUp to 25%
fewer alerts
500 million
fewer events each month
8 hours
saved each week
250+
GreyNoise deception sensors
Dynamic blocklists wired into the detection pipeline
Deployment took minutes, and firewall hits dropped immediately. The same lists then filtered scanning traffic before it generated alerts.
A sensor network shaped like Merit
Sensors configured to match member equipment profiles show what is actually probing Merit's own network, not only the internet at large.
Faster threat hunts and instant indicator context
When an IP or an entire ASN resolves to a known common scanner, analysts deprioritize it in seconds instead of researching it from scratch.
“Having our own sensor network has provided insights that global threat intel data alone couldn't provide, because of our unique customer base and the industry verticals we serve. We can see who and what is actually targeting our infrastructure, and pull indicators that are more directly relevant to our environment.”
Security Operations Team, Merit Network
A dedicated host. Ubuntu 22.04, Ubuntu 24.04, or Debian 13 (kernel 5.6 or later), 1 vCPU, 512 MB RAM, 8 GB storage, root access during installation, ports 80 and 443 available.
One static public IP per sensor, on institution-owned address space.
Three to five minutes, one command.
GreyNoise records each session in full fidelity, including raw PCAPs, payloads, HTTP headers, TLS metadata, and other behavioral artifacts.
Participants can access and analyze this session data, and bulk PCAP download is included at no additional cost.
Yes. The Session Explorer supports 250+ traffic fields with packet-level inspection.
Yes, public APIs are available for sensor data:
No. There are no rate limits on accessing or querying your own Project Swarm sensor, session, and packet data through the API.
The sensor itself cannot be compromised in the way people typically assume because nothing exploitable runs locally on it. Its only function is to receive inbound internet traffic and forward that traffic through an encrypted WireGuard tunnel to GreyNoise’s cloud infrastructure.
The sensor does not process traffic, emulate services, or run device profiles locally. Any interaction with or exploitation of a device profile occurs on GreyNoise-controlled cloud infrastructure, not on the physical sensor machine or within your network.
Any exploitation occurs within GreyNoise’s cloud infrastructure, not within the network where the sensor is deployed. As documented, the sensor architecture is designed for “zero lateral movement risk” to the host network.
If a vulnerable profile is successfully exploited, the compromise is contained within GreyNoise’s cloud environment rather than the customer’s network.
Our Academic Partnerships team can walk you through both paths and get your institution started
