Incident Investigation | GreyNoise Intelligence

Overview

GreyNoise accelerates investigations by adding context on IPs and CVEs seen in mass scanning and exploitation campaigns. This enrichment speeds triage, reduces manual work, and helps SOC teams more effectively investigate timelines and the scope of incidents.

How GreyNoise Speeds Up Investigations

Enriched Threat Context

GreyNoise shows whether an IP is scanning broadly or targeting specific systems, helping analysts gauge threat levels.

Identify Exploitation Attempts

CVE tags reveal which vulnerabilities are being exploited and which assets are likely targeted.

Map Attack Infrastructure

GreyNoise links IPs, ASNs, and behaviors so analysts can pivot and see the broader campaign.

Strengthen Containment Decisions

Intelligence on attacker infrastructure helps teams decide when to block, monitor, or expand containment.

Speed Up Timeline Construction

Data on first seen, last seen, and behavior give provides evidence for accurate incident timelines.

Better Documentation and Reporting

Enriched incident reports clarify what happened and why it matters.

‍

How it Works

Explore Available Fields

Filter by category & search available IP fields and their uses with GreyNoise.

NAME

Description & Use

Slug

Short identifier for the tag. Useful in queries and API lookups.

Source Bytes

Number of bytes sent from source IP. Useful for traffic analysis.

Source Country

Country where the IP is registered. Provides attacker infrastructure location context.

Source Country Code

ISO country code for the IP’s registration country.

Source Country Count

Count of IPs originating from each country. Useful for geo-distribution of attacks.

Source Latitude

Latitude of IP’s registered location. Useful for geo-mapping.

Source Longitude

Longitude of IP’s registered location. Useful for geo-mapping.

Spoofable

Shows whether the IP completed a valid TCP handshake. If false, traffic may be spoofed or fake.

Spoofable Count

Count of spoofable vs. non-spoofable IPs. Highlights volume of potentially fake traffic.

Tags Count

Count of IPs associated with specific tags. Helps identify common behaviors at scale.

Timeline

Key timeline details about when the CVE was published, updated, and added to CISA (https://www.cisa.gov/known-exploited-vulnerabilities-catalog). Useful for understanding how long the issue has been known.

Timeline CISA KEV Date Added

Date the vulnerability was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Vulnerabilities in KEV should be prioritized for remediation per federal guidance.

Timeline CVE Last Updated Date

The last date the CVE entry was updated in the database. Useful for tracking changes in severity, affected products, or exploit status.

Timeline CVE Published Date

The date the CVE was first published. Helps determine how long attackers have potentially been aware of the vulnerability.

Timeline First Known Published Date

Date when the first exploit associated with the CVE was published.

Tor

Identifies if the IP is a Tor exit node. Tor traffic often indicates obfuscation or anonymization.

Destination Countries Count

Count of IPs targeting specific countries. Supports geo-threat monitoring.

Destination Country Codes

ISO codes for countries targeted by scanning. Supports correlation with geo-based IOCs.

Details

Basic CVE details, including CVSS score (Common Vulnerability Scoring System), associated products & vendors, and NIST CVE recognition status. Provides context on the vulnerability itself.

Details CVE CVSS Score

CVSS score assigned to the CVE. Commonly used in risk scoring but should be weighed alongside exploitation activity.

Details Product

The product affected by the vulnerability (e.g., Apache HTTP Server). Used to match against an organization’s asset inventory for prioritization.

Details Published to NIST NVD

Indicates if the vulnerability is published in the NIST National Vulnerability Database. Confirms official recognition and ensures compatibility with standard risk feeds.

Details Vendor

The vendor or developer responsible for the affected product. Helps map vulnerabilities to vendor patch advisories and SLAs.

Details Vulnerability Description

Summary of what the vulnerability is and how it works. Helps analysts understand potential impact and determine exploitability in their environment.

Details Vulnerability Name

Human-readable name of the vulnerability. Practitioners use this for quick recognition when scanning advisories.

Domain

Domain tied to the ASN owner. Provides higher-level ownership context.

Exploitation Activity

Observed IPs scanning or exploiting the vulnerability today, in the last 10 days, and the last 30 days.

Exploitation Activity Benign IP Count (10d)

Total number of benign IPs GreyNoise observed scanning or exploiting this vulnerability in the last 10 days.

Exploitation Activity Benign IP Count (1d)

Total number of benign IPs GreyNoise observed scanning or exploiting this vulnerability today.

Exploitation Activity Benign IP Count (30d)

Total number of benign IPs GreyNoise observed scanning or exploiting this vulnerability in the last 30 days.

Exploitation Activity Seen

Whether GreyNoise has observed activity related to this CVE.

Exploitation Activity Threat IP Count (10d)

Total number of threat IPs GreyNoise observed scanning or exploiting this vulnerability in the last 10 days.

Speed Up
Incident Investigations

Overview

How GreyNoise Speeds Up Investigations

Enriched Threat Context

Identify Exploitation Attempts

Map Attack Infrastructure

Strengthen Containment Decisions

Speed Up Timeline Construction

Better Documentation and Reporting

How it Works

Explore Available Fields

Cut the Noise. Close the Case.

Speed Up Incident Investigations

Overview

How GreyNoise Speeds Up Investigations

Enriched Threat Context

Identify Exploitation Attempts

Map Attack Infrastructure

Strengthen Containment Decisions

Speed Up Timeline Construction

Better Documentation and Reporting

How it Works

Explore Available Fields

Cut the Noise. Close the Case.

Speed Up
Incident Investigations