Attackers move fast. Their infrastructure changes by the hour—IP addresses spin up, burn out, and shift constantly. Defenders, meanwhile, require controls that strike a balance without overblocking or disrupting legitimate traffic.
That’s why we’re excited to announce that starting today, customers can turn any GreyNoise query directly into a real-time blocklist for their firewall, SOAR, or other enforcement points.
Real-Time, Dynamic, and Completely Configurable
Traditional static blocklists quickly age out, creating blind spots or false positives. GreyNoise blocklists are different. They’re:
- Real-Time: Continuously refreshed with the latest IP intelligence collected by GreyNoise’s global sensor network.
- Dynamic: As attacker infrastructure changes, your blocklists automatically update—no manual uploads or scripts required.
- Configurable: You control what’s blocked. Build blocklists tuned precisely to your organization’s risk tolerance and threat model.
With our query-based blocklists, you can automatically block the activity that matters to you—whether that’s opportunistic scanning, specific exploit campaigns, or known attacker infrastructure—without interrupting legitimate traffic.
Build Blocklists from Any GreyNoise Query
GreyNoise Query Language (GNQL) gives customers a powerful way to explore and segment global internet noise. Now, that same query power drives automated blocking and enforcement.
Each query you create can become a live, continuously updated feed for perimeter defense. As GreyNoise observes new IPs that match your query criteria, they’re added instantly to your blocklist.
When we first launched GreyNoise Block as a standalone product, it provided a simple and effective way to create real-time dynamic blocklists. To optimize for simplicity and speed, Block users could build lists from a set of common metadata about each IP. Block also offers useful templates as starting points for building blocklists.
With the new platform-integrated query-based blocklists,
- You can now build blocklists using the full depth of GreyNoise metadata—every field, tag, and attribute you have access to in the platform. This gives you complete control to shape and refine your blocklists exactly the way you want.
- These blocklists are tightly woven into your existing GNQL workflows. There’s no need to build queries specifically for blocking—any query you’ve already built can instantly become a live blocklist with a single click.
- The result is a seamless experience: research, query, and enforcement—all in one place.
While the standalone Block product offered a fast on-ramp to real-time blocking, the platform-integrated query-based blocklists give you total flexibility and control on the nuance of your blocklist, directly inside the GreyNoise platform.
Available Now
Query-Based Blocklists are available today to all GreyNoise platform customers.
If you already use the GreyNoise Visualizer, you can start creating your first blocklist immediately—no new integration or license required.
For a walkthrough, visit the GreyNoise documentation or reach out to your GreyNoise account team.
.png)
