Greynoise Api

GreyNoise API

Base URL

• Community: https://api.greynoise.io/v3/community
• Enterprise: https://api.greynoise.io/v3

Authentication

Header: key: $GREYNOISE_API_KEY

Rate Limits

• Community (free): 50 requests/day
• Enterprise: Based on plan

Key Endpoints

Community IP Lookup (Free)

curl -s "https://api.greynoise.io/v3/community/{ip}" \
  -H "key: $GREYNOISE_API_KEY"

Response fields:

• noise — true if IP is a known internet scanner
• riot — true if IP belongs to a known benign service (CDN, DNS, etc.)
• classification — benign|malicious|unknown
• name — actor name if identified
• last_seen — last observation date
• message — human-readable summary

Enterprise Context (Paid)

curl -s "https://api.greynoise.io/v3/noise/context/{ip}" \
  -H "key: $GREYNOISE_API_KEY"

Additional fields: tags, cve, os, ports, raw_data

Classification Meaning

| Classification | Meaning | Action | |---------------|---------|--------| | benign + noise:true | Known benign scanner (Shodan, Censys, etc.) | Likely false positive — deprioritise | | malicious + noise:true | Known malicious scanner | Real threat, but opportunistic, not targeted | | unknown + noise:true | Unclassified scanner | Investigate further | | noise:false + riot:false | Not a known scanner | May be targeted — investigate | | riot:true | Known benign service | Definitely deprioritise |

CTI Value

GreyNoise answers: "Is this IP scanning the whole internet, or is it specifically targeting us?"

• If noise:true → opportunistic, not targeted
• If noise:false → potentially targeted, higher priority

Response Summary Format

ip: 
noise: 
riot: 
classification: benign|malicious|unknown
name: 
last_seen: 
message: 
verdict: benign-scanner|malicious-scanner|not-scanner|benign-service

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Liberty91LTD
• Source: Liberty91LTD/cti-skills
• License: MIT
• Homepage: https://liberty91.com/cti-skills

Install and usage instructions live in the source repository linked above.