GreyNoise icon

GreyNoise

Query IPs against GreyNoise threat intelligence

Actions8

Enterprise → GNQL Stats

AI-generated

Overview

This node operation performs an aggregate statistical query on the GreyNoise NOISE dataset using the GreyNoise Query Language (GNQL). It is useful for security analysts and threat intelligence professionals who want to obtain summarized statistics about network activity or threat data matching specific query criteria. For example, a user can query for the top malicious classifications or tags within the dataset to understand prevalent threats or trends.

Use Case Examples

  1. A security analyst queries for the top 50 aggregates of malicious classifications tagged as 'mirai' to identify common attack patterns.
  2. A threat intelligence team uses the node to get aggregate statistics on IPs flagged with certain threat tags to prioritize investigation efforts.

Properties

Name Meaning
Query The GNQL query string used to filter and search the NOISE dataset for relevant data.
Count The number of top aggregate results to return from the query, controlling the size of the statistical summary.
Request Options Additional request settings such as batching, SSL certificate validation, proxy configuration, and timeout settings to control how the API request is made.

Output

JSON

  • data - The aggregate statistical results returned from the GNQL query, containing summarized threat intelligence data.

Dependencies

  • Requires an API key credential for GreyNoise Enterprise API access.

Troubleshooting

  • Common errors include unauthorized or forbidden responses indicating invalid or missing API credentials. Verify the API key and permissions.
  • HTTP errors with status codes 400 or above indicate request failures; check query syntax and network connectivity.
  • SSL certificate validation errors can be bypassed by enabling the 'Ignore SSL Issues' option, but this reduces security.

Links

Discussion