Early warning

Early Warning of Upcoming CVE Disclosures

Get ahead of new CVEs on the systems you care about.

Get a Demo

Overview

GreyNoise research shows that spikes in traffic targeting older CVEs often precede new CVE disclosures for that same vendor within weeks. These early warnings give organizations time to harden systems, patch, monitor, or block probing IPs.

By detecting shifts in attacker reconnaissance prior to CVE disclosure, GreyNoise provides a critical window of opportunity to prepare before a threat materializes.

How GreyNoise Helps You
Prepare for New CVEs

Provides Time to Prepare

When a new CVE hits critical perimeter systems, it can trigger emergency response and disruption. Early warnings from GreyNoise let teams prepare in advance and minimize impact

Aligns Risk Assessments to Real-World Threat Activity

GreyNoise shows which vendors and technologies are seeing abnormal reconnaissance levels, keeping risk assessments aligned with real-world signals.

Improves Resource Allocation

Defenders can focus investments, patching, and monitoring on upcoming threats most likely to impact them.

‍

Enables Proactive Blocking

Use GreyNoise query-based, dynamic blocklists to stop attacks as your organization patches exposed systems.

‍

Explore Available Fields

Filter by category & search available IP fields and their uses with GreyNoise.
Categories
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
NAME
Description & Use
ASN Count
Count of IPs grouped by ASN. Supports ASN-level threat analysis.
Protocol
Protocol (e.g., TCP/UDP) used in scanning activity. Adds layer-4 context.
Port
Port observed in scanning activity. Useful for identifying targeted services.
Destination ASNs
List of ASNs targeted by the IP. Helps show which networks are being scanned.
Sensor Hits
Total number of events GreyNoise sensors recorded from this IP. Indicates activity volume.
Source Latitude
Latitude of IP’s registered location. Useful for geo-mapping.
Destination Cities
List of cities where scanning traffic was observed. Useful for geo-targeting analysis.
Sensor Count
Number of distinct sensors that saw the IP. Higher values indicates wider scanning footprint.
First Seen
Date the IP was first observed by GreyNoise. Indicates activity lifetime.
VPN Service
Name of the VPN service associated with the IP. Useful for attribution and filtering.
VPN
Flags if the IP belongs to a VPN provider. Suggests identity masking or evasive behavior.
Updated At
Date/time when the tag was last updated.
Slug
Short identifier for the tag. Useful in queries and API lookups.
References
References (e.g., CVE pages, docs) supporting the tag. Provides analyst enrichment sources.
Recommended Block
Indicates whether IPs with this tag should be blocked. Supports automated policy decisions.
Name
Display name of the tag. Analyst-facing label for quick recognition.
Source Country
Country where the IP is registered. Provides attacker infrastructure location context.
Organization
Organization responsible for the IP. Adds enrichment for attribution.
Single Destination
True if the IP only scanned one country. Suggests targeted reconnaissance.
Region
State/province where the IP is registered. Adds sub-country geolocation context.
RDNS
Reverse DNS value for the IP. May reveal hostnames tied to services or campaigns.
RDNS Parent
Parent domain of the reverse DNS. Useful for clustering infrastructure.
Mobile
Indicates if the IP belongs to a mobile/cellular network.
Domain
Domain tied to the ASN owner. Provides higher-level ownership context.
Destination Country Codes
ISO codes for countries targeted by scanning. Supports correlation with geo-based IOCs.
Destination Countries
Countries where GreyNoise sensors saw this IP scanning. Indicates target geography.
City
Registered city of the IP. Useful for geolocation context and pivoting.
Category
High-level network type (e.g., hosting, ISP, enterprise).
ASN
Autonomous System Number routing the IP. Helps group malicious infrastructure.
Last Seen Timestamp
Exact date and time the IP was last observed. Enables timeline reconstruction in investigations.
Actor
Known or attributed owner/operator of the IP (e.g., research org, ISP, hosting provider). Useful for attribution.
Classification
GreyNoise’s judgment of the IP’s intent: benign, malicious, suspicious, or unknown. Most useful filter for triage.

Don't wait until it's a CVE

Get a demo
Search for free
Products
Partners
Resources
Company
© 2025 GreyNoise, Inc. All rights reserved.
YouTube logoJoin us on Slack!Discord logoTikTok logo