GreyNoise

GreyNoise is a cybersecurity platform that helps security teams filter out "internet noise" — background internet scanning activity that's not necessarily targeted or malicious. It collects, analyzes, and labels massive amounts of data from internet-wide scans, typically originating from bots, security researchers, or compromised systems.

Customers must have access to the Enterprise API to fetch data from GreyNoise. You can verify your API key access here.

Elastic Managed integrations are only supported on Elastic Cloud Serverless and Elastic Cloud Hosted deployments. An Elastic Managed integration lets you ingest data from a cloud source while avoiding the orchestration, management, and maintenance associated with standard ingest infrastructure. Elastic runs the collector for you, so you can focus on your data instead of the infrastructure that collects it.

For more information, refer to Elastic Managed integrations and the Elastic Managed integrations FAQ.

Elastic Agent must be installed. For more details, check the Elastic Agent installation instructions.

1. After logging in to GreyNoise, navigate to your account page.
2. Click "View API Key" to display and copy your unique API key.

1. In Kibana, go to Management > Integrations.
2. In the "Search for integrations" search bar, type GreyNoise.
3. Click the GreyNoise integration from the search results.
4. Click the Add GreyNoise button to add the integration.
5. While adding the integration, provide the following details to collect logs via REST API:
   • API Key
   • Interval
   • (Optional) Query for custom query filtering
6. Click Save and Continue to save the integration.

To keep the collected data up to date, Transforms are used.

You can view transforms by navigating to Management > Stack Management > Transforms.

Here, you can see continuously running transforms and view the latest transformed GreyNoise data in the Discover section.

The labels.is_transform_source field indicates log origin:

• False for transformed index
• True for source index

Currently, one transform is running for the IP datastream:

For example:

• The query event.module: ti_greynoise and labels.is_transform_source: true shows logs from the source index
• The query event.module: ti_greynoise and labels.is_transform_source: false shows logs from the transformed index

A retention policy removes data older than the default retention period. For more details, refer to the Retention Policy Documentation.

In this integration, the IP data stream has a default retention period of 7 days.

Detection Rules match your Elastic environment data with GreyNoise data, generating an alert when a match is found.

Follow Steps to Create Detection Rule below to create indicator match detection rule in Elastic.

1. Navigate to Security > Rules > Detection Rules and click Create New Rule.
2. Select Indicator Match as the rule type and do following changes.
3. In Define Rule section:
   • Index Pattern: Add the index pattern relevant to your data. Keeping this specific ensures optimal performance.
   • Custom Query: Must include NOT event.module : "ti_greynoise" to exclude GreyNoise events.
   • Indicator index patterns: Use logs-ti_greynoise_latest.ip*.
   • Indicator index query: Refine indcator index with something like @timestamp >= "now-7d/d".
   • Indicator Mapping:
     • Field: Map to the field in your Elastic environment containing IPs.
     • Indicator Index Field: threat.indicator.ip
   • Required fields (Optional): Add threat.indicator.ip.
   • Related integrations (Optional): Add GreyNoise.
4. In About Rule section:
   • Name: e.g GreyNoise Custom IP IOC Correlation.
   • Description: e.g This rule is triggered when IP Address IOC's collected from the GreyNoise Integration have a match against IP Address that were found in the customer environment..
   • Default Severity: e.g critical.
   • Tags: Add GreyNoise (used for filter Alerts generated by this rule by rule transforms).
   • Max alerts per run: Default is 100; configurable up to 1000.
   • Indicator prefix override: Set to greynoise.ip to enrich alerts with GreyNoise data.
5. In Schedule Rules section:
   • Set Runs Every - Defines how frequently the rule runs.
   • Additional Lookback Time - Specifies how far back to check for matches.

NOT greynoise.ip.internet_scanner_intelligence.classification : "benign"

You can also use the plus (+) filter button in Kibana to refine the GreyNoise threat intel dataset before matching it against your source index.

Once the rule is saved and enabled, alerts will appear in the Security > Alerts section when matches are detected.

The following transform and its associated pipelines are used to filter relevant data from alerts. Follow Steps to enable rule transforms to enable these transforms and populate Threat Intelligence dashboard.

1. Navigate to Stack Management > Transforms in Kibana.
2. Locate the transform you want to enable by searching for its Transform ID.
3. Click the three dots next to the transform, then select Edit.
4. Under the Destination configuration section, set the Ingest Pipeline:
   • Rule transform in the GreyNoise integration has a corresponding ingest pipeline.
   • Refer to the Transforms table above for the appropriate pipeline name associated with transform.
   • Prefix the pipeline name with the integration version. For example:

     {package_version}-ti_greynoise-correlation_detection_rule-pipeline
     

   • Click Update to save the changes.
5. Click the three dots again next to the transform and select Start to activate it.

• When the integration is updated, the rule transform will be stopped.
• After updating integration, you must reconfigure the rule transform by adding the pipeline with the updated integration version.

1. If you experience latency issues during data collection, consider increasing the HTTP Client Timeout configuration parameter.
2. If server-side errors occur, consider reducing the Page Size configuration parameter. Note: Avoid setting the Page Size too low, as this may increase the number of API requests, potentially causing processing issues.
3. If events are not appearing in the transformed index, check if transforms are running without errors. For issues, refer to Troubleshooting transforms.
4. If detection rules take longer to run, ensure you have specified index patterns and applied queries to make your source events more specific. Note: More events in index patterns means more time needed for detection rules to run.
5. Ensure that relevant fields are correctly mapped in the Indicator Mapping section. Verify that fields in the specified index pattern are properly mapped, and ensure entity-specific fields (e.g., IP fields to IP fields) are accurately configured.
6. If any transform is not in a Healthy state, try resetting it:
   • Click the three dots next to the transform, then select Reset.
   • After resetting, restart the transform.
7. If dashboards are not updating after an integration upgrade, verify that the rule transform is running with the correct ingest pipeline.
   • Reconfigure the rule transform to use the updated pipeline name, including the integration version. For example:

     {updated_package_version}-ti_greynoise-correlation_detection_rule-pipeline
     

This is the IP dataset. It uses the GNQL Endpoint to fetch data from GreyNoise with "last_seen:1d". It uses version v3 of the API to collect indicators. Currently, the Triage and Business Services Intelligence Modules are being collected through this data stream.

{
    "@timestamp": "2025-08-25T12:04:07.311Z",
    "agent": {
        "ephemeral_id": "df2440cf-2988-4c8e-a9d8-732bf683e75d",
        "id": "4fa94654-7250-428e-af26-eb9bea157680",
        "name": "elastic-agent-47174",
        "type": "filebeat",
        "version": "8.17.0"
    },
    "data_stream": {
        "dataset": "ti_greynoise.ip",
        "namespace": "68551",
        "type": "logs"
    },
    "ecs": {
        "version": "8.17.0"
    },
    "elastic_agent": {
        "id": "4fa94654-7250-428e-af26-eb9bea157680",
        "snapshot": false,
        "version": "8.17.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "threat"
        ],
        "dataset": "ti_greynoise.ip",
        "ingested": "2025-08-25T12:04:10Z",
        "kind": "enrichment",
        "original": "{\"business_service_intelligence\":{\"category\":\"public_dns\",\"description\":\"Google's global domain name system (DNS) resolution service.\",\"explanation\":\"Public DNS services are used as alternatives to ISP's name servers. You may see devices on your network communicating with Google Public DNS over port 53/TCP or 53/UDP to resolve DNS lookups.\",\"found\":true,\"last_updated\":\"2021-11-24T11:42:37Z\",\"name\":\"Google Public DNS\",\"reference\":\"https://developers.google.com/speed/public-dns/docs/isp#alternative\",\"trust_level\":\"1\"},\"internet_scanner_intelligence\":{\"actor\":\"unknown\",\"bot\":false,\"classification\":\"malicious\",\"cves\":[],\"first_seen\":\"\",\"found\":true,\"last_seen\":\"2025-04-22\",\"metadata\":{\"asn\":\"AS269415\",\"carrier\":\"\",\"category\":\"isp\",\"datacenter\":\"\",\"destination_asns\":[],\"destination_cities\":[],\"destination_countries\":[\"Iran\",\"Kazakhstan\"],\"destination_country_codes\":[\"IR\",\"KZ\"],\"domain\":\"clicknetfibra.net.br\",\"latitude\":0,\"longitude\":0,\"mobile\":false,\"organization\":\"CLICKNET FIBRA LTDA\",\"os\":\"\",\"rdns\":\"speedtest.clicknetfibra.net.br\",\"rdns_parent\":\"clicknetfibra.net.br\",\"rdns_validated\":false,\"region\":\"Mato Grosso do Sul\",\"sensor_count\":0,\"sensor_hits\":0,\"single_destination\":false,\"source_city\":\"Dourados\",\"source_country\":\"Brazil\",\"source_country_code\":\"BR\"},\"source\":{\"bytes\":0},\"spoofable\":true,\"ssh\":{\"key\":[]},\"tags\":[],\"tls\":{\"cipher\":[],\"ja4\":[]},\"tor\":false,\"vpn\":false,\"vpn_service\":\"\"},\"ip\":\"1.128.0.0\",\"last_seen_timestamp\":\"2025-04-22 00:26:29\"}",
        "type": [
            "indicator"
        ]
    },
    "greynoise": {
        "ip": {
            "business_service_intelligence": {
                "category": "public_dns",
                "description": "Google's global domain name system (DNS) resolution service.",
                "explanation": "Public DNS services are used as alternatives to ISP's name servers. You may see devices on your network communicating with Google Public DNS over port 53/TCP or 53/UDP to resolve DNS lookups.",
                "found": true,
                "last_updated": "2021-11-24T11:42:37.000Z",
                "name": "Google Public DNS",
                "reference": "https://developers.google.com/speed/public-dns/docs/isp#alternative",
                "trust_level": "1"
            },
            "indicator": {
                "ip": "1.128.0.0"
            },
            "internet_scanner_intelligence": {
                "actor": "unknown",
                "bot": false,
                "classification": "malicious",
                "found": true,
                "last_seen": "2025-04-22T00:00:00.000Z",
                "metadata": {
                    "asn": "AS269415",
                    "category": "isp",
                    "mobile": false,
                    "organization": "CLICKNET FIBRA LTDA",
                    "rdns": "speedtest.clicknetfibra.net.br",
                    "region": "Mato Grosso do Sul",
                    "source_city": "Dourados",
                    "source_country": "Brazil",
                    "source_country_code": "BR"
                },
                "spoofable": true,
                "tor": false,
                "vpn": false
            }
        }
    },
    "input": {
        "type": "cel"
    },
    "observer": {
        "product": "Threat Intelligence",
        "vendor": "GreyNoise"
    },
    "organization": {
        "name": "unknown"
    },
    "related": {
        "ip": [
            "1.128.0.0"
        ]
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "greynoise-ip"
    ],
    "threat": {
        "feed": {
            "description": "Threat feed from the GreyNoise cybersecurity platform",
            "name": "GreyNoise IP",
            "reference": "https://docs.greynoise.io/docs/using-greynoise-as-an-indicator-feed"
        },
        "indicator": {
            "as": {
                "number": 269415,
                "organization": {
                    "name": "CLICKNET FIBRA LTDA"
                }
            },
            "description": "1.128.0.0 IP has been observed mass scanning the internet by GreyNoise with a classification of malicious",
            "geo": {
                "city_name": "Dourados",
                "country_iso_code": "BR",
                "country_name": "Brazil",
                "region_name": "Mato Grosso do Sul"
            },
            "ip": "1.128.0.0",
            "name": "1.128.0.0",
            "provider": "GreyNoise",
            "reference": "https://www.greynoise.io/ip/1.128.0.0",
            "type": "ipv4-addr",
            "url": {
                "full": "https://developers.google.com/speed/public-dns/docs/isp#alternative"
            }
        }
    }
}

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.