GreyNoise icon

GreyNoise

Interact with GreyNoise API

Actions6

Overview

This node integrates with the GreyNoise Enterprise API to perform an "IP Quick Check" operation. It allows users to quickly determine whether one or more IP addresses are considered "Internet background noise"—that is, IPs observed scanning or attacking devices across the Internet. This can be useful in cybersecurity workflows to filter out noisy IPs or identify potentially malicious activity.

Practical examples include:

  • Quickly checking a list of suspicious IPs from firewall logs to see if they are known scanners.
  • Automating threat intelligence enrichment by tagging IPs as benign or noisy.
  • Filtering alerts in security monitoring systems based on GreyNoise data.

Properties

Name Meaning
IPs Comma separated list of IP addresses to query for quick check against GreyNoise Enterprise data.

Output

The output JSON contains the response from the GreyNoise Enterprise API's /v2/noise/multi/quick endpoint. This typically includes information about each queried IP address indicating whether it is classified as background noise or has been observed performing scanning or attack activities.

If binary data were involved (not in this operation), it would represent raw data such as port scans or web requests, but here the output is purely JSON metadata about the IPs.

Dependencies

  • Requires access to the GreyNoise Enterprise API.
  • Needs an API authentication token configured in n8n credentials (referred generically as an API key credential).
  • The base URL used is https://api.greynoise.io.
  • The node sends a POST request to /v2/noise/multi/quick with a JSON body containing the array of IPs.

Troubleshooting

  • Empty or malformed IP list: Ensure the "IPs" property is a comma-separated string of valid IP addresses. Invalid formatting may cause API errors.
  • Authentication errors: If the API key credential is missing or invalid, the node will fail to authenticate with GreyNoise. Verify the API key configuration.
  • API rate limits: GreyNoise enforces rate limits; exceeding them may result in HTTP 429 errors. Implement retry logic or reduce request frequency.
  • Network issues: Connectivity problems to api.greynoise.io will cause request failures.
  • Unexpected API responses: If the API changes or returns unexpected data, the node might not parse results correctly.

Links and References

Discussion