Actions8
- Community Actions
- Enterprise Actions
Enterprise → GNQL Query
AI-generatedOverview
The GreyNoise node's Enterprise GNQL Query operation allows users to search the NOISE dataset using the GreyNoise Query Language (GNQL). This operation is useful for security analysts and threat intelligence professionals who want to query and analyze network noise data to identify malicious activity or patterns. For example, a user can input a GNQL query string to find IPs classified as malicious with specific tags, helping to filter and investigate potential threats.
Use Case Examples
- Searching for IPs classified as malicious with the tag 'mirai' using a GNQL query string like 'classification:malicious tags:mirai'.
- Limiting the number of results returned by specifying a maximum size, such as 50 results.
Properties
| Name | Meaning |
|---|---|
| Query | The GNQL query string used to search the NOISE dataset. It is required and allows users to specify search criteria such as classifications and tags. |
| Limit | The maximum number of results to return from the GNQL query. It defaults to 50 and can be set between 1 and 10,000. |
| Request Options | Additional request settings including batching (to throttle requests), ignoring SSL certificate validation issues, setting an HTTP proxy, and request timeout in milliseconds. |
Output
JSON
data- The main data returned from the GNQL query, containing the search results from the NOISE dataset.
Dependencies
- Requires an API key credential for GreyNoise Enterprise API access.
Troubleshooting
- Common errors include unauthorized or forbidden errors indicating invalid or missing API keys or insufficient permissions. Verify the API key and permissions if such errors occur.
- HTTP errors with status codes 400 or above indicate request failures; check the query syntax and request parameters.
- SSL certificate validation issues can be bypassed by enabling the 'Ignore SSL Issues' option, but this should be used cautiously.