It’s hard to remember to check on specific GreyNoise queries that you’re interested in Every.Single.Day. That’s why we created GreyNoise Alerts: a quick and easy way to set up automated queries and send you a daily report if there are results.

Use cases

Flexible alerting that supports GNQL

You can use our alerts to monitor a CIDR range (example:, or define complex alerts with GNQL syntax such as:

  • Activity related to a CVE or GreyNoise tag
  • Monitor by ASN or organization name
  • Track scans for unique web paths, JA3 fingerprints, or any IP attribute in GreyNoise

Using GreyNoise Alerts

Creating an alert is simple!  From the Alerts page , just type the query as you would in the search bar, add any emails you want to receive the report, give it a name and click “Save”. 

A screenshot of the form to create an alert in the GreyNoise visualizer.

When an alert is triggered we'll send an email summary with IPs matched to your query.


Documentation guides

Featured content