Most Threat Intelligence feeds just give you “point in time” behavior. But IPs aren’t just ‘malicious’ or ‘benign’ - they can change behavior over time. When investigating an IP address involving a suspicious event from a week ago, you might need to ask: was this IP observed acting suspiciously at this point in time?
GreyNoise’s IP timeline capability helps you investigate, hunt, and perform incident response confidently, giving you up to 90 days of history for IPs we observe scanning and exploiting the internet.
See when a particular IP was first observed as part of a botnet or other scan-and-exploit infrastructure. Understand changes in tools, techniques and procedures used by actors.
Compare our IP timeline with events in your logs and alerts to validate hypotheses like: “This IP doesn’t seem to be acting suspicious right now, but it was attempting to scan and exploit us two weeks ago”
Our GreyNoise research team stays on top of emerging vulnerabilities and exploits that result in internet-wide exploitation so that our users don’t miss an emerging threat. With our Trends feature, you can follow these emerging trends, and take action such as block malicious activity from your environment from our Tags page. We also publish regular reports that give customers insight into exploitation activity and threats.
It’s very easy! GreyNoise provides out-of-the-box integrations with many leading SIEM, SOAR, TIP, and other security solutions (view them here) . Customers can also use our comprehensive API to build custom integrations for their use cases. We also provide daily feeds of malicious or benign activity that can be used for bulk analysis integrations.
GreyNoise is constantly updating its databases in real-time. We have thousands of sensors across the world that monitor for internet-wide exploitation, and as soon as our sensors see activity, the behavior is tagged and visible to our customers. Our research team actively stays on top of emerging vulnerabilities to make sure GreyNoise’s NOISE database has the latest threats tagged. Our RIOT database, which labels common business services, is also refreshed regularly and updated with changes.