OSINT Intelligence: GreyNoise Internet Noise Reduction

Overview#

GreyNoise collects, analyses, and labels mass internet scanning activity to separate background internet noise from targeted threat activity. Where Shodan indexes what is running on the internet, GreyNoise focuses on who is probing it -- tracking which IPs are conducting opportunistic scanning, botnets, mass exploitation attempts, and research probing. Argus integrates GreyNoise to filter known benign scanners out of IDS alert queues and to classify unknown sources of probing activity as noise or targeted threat.

Key Features#

IP Noise Classification#

Query GreyNoise for a given IP address via

syncGreynoiseIntel

and retrieve its classification:

benign

(confirmed legitimate scanners like Shodan, Censys, security research orgs),

malicious

(confirmed exploit bots, spray-and-pray attack infrastructure), or

unknown

(activity GreyNoise has observed but not yet classified). Classification confidence, last seen date, tags, and associated CVEs are persisted per record.

Tag-Based Context#

GreyNoise tags identify the nature of the scanning activity:

scanner

exploit

worm

botnet

brute-force

tor-exit

vpn

cdn

, etc. These tags surface directly on Argus records, allowing analysts to immediately understand why a source IP appeared in Suricata alerts or network logs without running a separate enrichment step.

Suricata Alert Noise Reduction#

Cross-referencing Suricata alert source IPs against GreyNoise classifications automatically identifies alerts from known mass scanners, allowing SOC teams to suppress known-noise alerts and focus analyst time on unknown or malicious sources. The combination of Suricata + GreyNoise dramatically reduces false positive volume in high-traffic monitoring environments.

Clearance-Filtered Records#

In intelligence environments, GreyNoise data enriched with classified network context carries

secrecy_level

tags restricting access to cleared personnel.

Use Cases#

Alert Triage Acceleration: Automatically mark Suricata alerts from GreyNoise-classified benign scanners as low priority, reducing daily triage volume by 30-60% in internet-facing environments.
Targeted Attack Identification: IPs that appear in IDS alerts but are not in GreyNoise (i.e., unknown background noise) warrant immediate investigation as they are more likely to be targeted activity.
IOC Vetting: Before publishing an IP indicator to a MISP feed, verify it is not a known legitimate scanner -- GreyNoise prevents false positives from polluting shared threat intel feeds.
Botnet Mapping: GreyNoise's botnet tracking tags can seed MISP events identifying active botnet C2 infrastructure, contributing to community-level threat intelligence.

Integration#

Available via GraphQL:

greynoiseintItems

greynoiseintStats

(queries);

syncGreynoiseIntel

(mutation). All operations require authentication and organisation scoping.

Compatible with GreyNoise Enterprise API v3. Works alongside Shodan (exposure detail), Suricata (alert enrichment), MISP (IOC vetting before community sharing), and SpiderFoot (comprehensive OSINT pipelines).

Last Reviewed: 2026-03-18

Modulemetadata

Gerenderde documentatie