Overview

The GreyNoise node's Enterprise Multi-IP Lookup operation allows users to perform bulk IP address lookups against the GreyNoise threat intelligence database. It supports querying up to 10,000 IP addresses at once, returning enrichment data such as metadata, tags, and activity related to each IP. This operation is useful for security analysts and network administrators who need to quickly assess multiple IPs for potential threats or suspicious activity in a single request, improving efficiency over individual lookups.

Use Case Examples

1. A security analyst inputs a list of suspicious IP addresses observed in network logs to get detailed threat intelligence on each IP in bulk.
2. A network administrator uses the node to enrich a large dataset of IP addresses with GreyNoise metadata to identify benign versus malicious traffic sources.

Properties

Output

JSON

• data - Array of IP lookup results, each containing enrichment data such as metadata, tags, and activity for the queried IPs.

Dependencies

• Requires an API key credential for GreyNoise Enterprise API access.

Troubleshooting

• Common errors include unauthorized or forbidden responses indicating invalid or missing API credentials. Verify the API key and permissions.
• HTTP errors with status codes 400 and above indicate request failures; check the request parameters and network connectivity.
• If SSL certificate validation fails and the request is blocked, enable the 'Ignore SSL Issues' option if appropriate for your environment.

Links

• GreyNoise Enterprise API Documentation - Official documentation for the GreyNoise Enterprise API, including details on IP lookup endpoints and parameters.