Threat Hunting

Needle in the haystack. Found

Quickly identify anomalous behavior and catch targeted threats

Get a Demo

Overview

Effective threat hunting isn't just about finding more data, it’s about finding the right data. GreyNoise empowers your hunt team to adopt the PEAK Framework by correlating your internal traffic against our real-time map of internet-wide mass scanning.

By using GreyNoise to filter out opportunistic probes, benign scanners, and botnet noise, you reveal the statistically significant anomalies that represent targeted attacks. Stop chasing false positives and focus on the signals that actually threaten your perimeter.

How GreyNoise
Helps You Hunt Smarter

Focus effort on highest risks

Eliminate time-consuming research of benign and opportunistic scanning, allowing hunters to focus on infrastructure actually used by threat actors.

Supports threat research and hypothesis development

Hunters can use GreyNoise to conduct threat research, validate assumptions, and explore attack vectors in order to develop hypotheses.

Correlate isolated incidents

GreyNoise helps threat hunters link isolated incidents to larger campaigns by mapping attacker infrastructure and patterns, connecting logged IPs to those exploiting relevant vulnerabilities.

How GreyNoise Maps to the PEAK Hunting Framework

Explore Available Fields

Filter by category & search available IP fields and their uses with GreyNoise.
Categories
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
NAME
Description & Use
ASN
Autonomous System Number routing the IP. Helps group malicious infrastructure.
ASN Count
Count of IPs grouped by ASN. Supports ASN-level threat analysis.
Actor
Known or attributed owner/operator of the IP (e.g., research org, ISP, hosting provider). Useful for attribution.
Actor Count
Aggregated count of IPs per actor. Supports statistical analysis of actors.
Bot
Flags whether the IP is part of known botnet activity. Helps detect automated scanning or malware distribution.
CVE
List of CVEs the IP has scanned for or attempted to exploit. Critical for vulnerability triage.
CVEs
CVEs tied to the tag behavior. Critical for identifying exploitation of known vulnerabilities.
Category
High-level network type (e.g., hosting, ISP, enterprise).
Category Count
Aggregated count of IPs per category (hosting, ISP, etc.). Highlights infrastructure trends.
City
Registered city of the IP. Useful for geolocation context and pivoting.
Classification
GreyNoise’s judgment of the IP’s intent: benign, malicious, suspicious, or unknown. Most useful filter for triage.
Classification Count
Aggregated count of IPs per classification. Useful for threat landscape analysis.
Created At
Date the tag was first added. Indicates when this behavior was first observed.
Description
Human-readable explanation of what the tag represents. Adds analyst context.
Destination ASNs
List of ASNs targeted by the IP. Helps show which networks are being scanned.
Destination Cities
List of cities where scanning traffic was observed. Useful for geo-targeting analysis.
Slug
Short identifier for the tag. Useful in queries and API lookups.
Source Bytes
Number of bytes sent from source IP. Useful for traffic analysis.
Source Country
Country where the IP is registered. Provides attacker infrastructure location context.
Source Country Code
ISO country code for the IP’s registration country.
Source Country Count
Count of IPs originating from each country. Useful for geo-distribution of attacks.
Source Latitude
Latitude of IP’s registered location. Useful for geo-mapping.
Source Longitude
Longitude of IP’s registered location. Useful for geo-mapping.
Spoofable
Shows whether the IP completed a valid TCP handshake. If false, traffic may be spoofed or fake.
Spoofable Count
Count of spoofable vs. non-spoofable IPs. Highlights volume of potentially fake traffic.
TLS Cipher
TLS cipher suites used. Adds context for attacker SSL/TLS configurations.
TLS JA4
JA4 TLS fingerprint values. Useful for higher-fidelity TLS fingerprinting.
Tags Count
Count of IPs associated with specific tags. Helps identify common behaviors at scale.
Timeline
Key timeline details about when the CVE was published, updated, and added to CISA (https://www.cisa.gov/known-exploited-vulnerabilities-catalog). Useful for understanding how long the issue has been known.
Timeline CISA KEV Date Added
Date the vulnerability was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Vulnerabilities in KEV should be prioritized for remediation per federal guidance.
Timeline CVE Last Updated Date
The last date the CVE entry was updated in the database. Useful for tracking changes in severity, affected products, or exploit status.
Timeline CVE Published Date
The date the CVE was first published. Helps determine how long attackers have potentially been aware of the vulnerability.

Find your needle.

Get a demo
Search for free
Products
Partners
Resources
Company
© 2025 GreyNoise, Inc. All rights reserved.
YouTube logoJoin us on Slack!Discord logoTikTok logo