GreyNoise Response Integration via API

Purpose

This guide explains how to connect GreyNoise to Logsign as a Response (Action) integration and use it from within an Incident or Alarm to enrich IP addresses. GreyNoise is a threat intelligence service that tells you whether an IP address is internet background noise, meaning a mass internet scanner, benign research crawler, or opportunistic bot, rather than an actor specifically targeting your organization. It also maintains a separate dataset of IPs belonging to known business services (search engines, CDNs, cloud providers, SaaS platforms) so you can quickly tell a legitimate service from a threat.

Unlike a log collection poller, this integration does not pull data into Logsign on a schedule. It is invoked on demand, typically from a playbook or manual action attached to an Incident or Alarm, to look up one or more IP addresses that appear in that alarm and return GreyNoise's assessment of them. This is useful for cutting down alert fatigue: an alarm whose source IP turns out to be a well-known scanner or a Google crawler can be triaged and closed much faster than one from an IP GreyNoise has never seen before.

Prerequisites

You need an active GreyNoise API key with Enterprise-level access, not the free Community tier. GreyNoise publishes a separate free Community API that exposes a single limited lookup endpoint with restricted results and a low weekly search allowance. Every method this Logsign integration calls (IP context, quick check, multi-IP lookups, RIOT business service lookup, and GNQL search) belongs to GreyNoise's paid Enterprise API surface, based on GreyNoise's own public feature comparison of Community versus Enterprise API access. A Community-tier key will not work with this integration; you need either a paid Enterprise subscription or an active Enterprise trial. This has not been independently verified with a live test call, since no test key was available during this research, so treat it as GreyNoise's documented tier boundary rather than a confirmed test result.

Use least privilege where possible. GreyNoise issues API keys at the account level and its published documentation does not describe a way to scope a key to a subset of endpoints or to read-only access; the key that unlocks IP context and GNQL search is the same key for the whole account. No scoped or role-based key option was found during this research (not independently verified against a live GreyNoise account, since the console UI was not tested). Until this is confirmed, generate the key under a GreyNoise user you control specifically for this integration rather than a shared account login, so it can be traced and revoked independently, and ask your GreyNoise account contact whether scoped keys are available on your plan.

Step 1: Obtain a GreyNoise API key

Sign in to the GreyNoise Visualizer at viz.greynoise.io with an account on an Enterprise subscription or Enterprise trial, and open your account or API settings page to copy your API key. GreyNoise does not publish the exact menu path for this screen in a way that was independently confirmed during this research, so if you cannot locate the key, your GreyNoise account manager or support contact can point you to it or issue a new one.

One point worth flagging before you configure Logsign: the code behind this integration calls GreyNoise's v2 API paths (https://api.greynoise.io/v2/...). GreyNoise's current public documentation is built around a newer v3 API and publishes a v2-to-v3 endpoint migration table, which suggests v2 may eventually be phased out. Whether the specific v2 paths this integration uses are still fully supported for your account was not independently verified. If every method in this integration starts failing at once with an authentication or not-found style error even though the key itself is confirmed valid, ask GreyNoise support whether v2 API access has been deprecated for your subscription.

Step 2: Configure the integration in Logsign

In Logsign, go to Settings > Integrations > Responses, search for Greynoise, click Configure, and then +Device to add a new configuration. You will be asked for:

There is no field to enter a base URL or region. GreyNoise is called at a single fixed address (https://api.greynoise.io); GreyNoise does not appear to operate separate regional API endpoints the way some vendors do, based on its public documentation, so this is not a configuration gap, just a fixed value with nothing for you to set. This has not been independently verified beyond what GreyNoise's own documentation shows.

Once saved, this configuration becomes available as a Device inside Logsign's Incident and Alarm response actions, where you pick one of the methods below and supply its parameters (typically an IP address pulled from the alarm itself).

Available Methods

IP Context Lookup (ip_context_lookup)

Looks up a single IP address and returns GreyNoise's full internet-scanner profile for it: first seen and last seen dates, whether it has been observed scanning, its classification (benign, malicious, or unknown), any associated threat actor name, tags describing observed behavior, related CVEs, bot and VPN flags, and metadata such as ASN, organization, country, city, and reverse DNS. It also includes raw observation data such as scanned ports and protocols, HTTP paths and user agents, and JA3/HASSH fingerprints where available.

Example use case: an alarm fires on repeated failed logins from an external IP. Run IP Context Lookup on that source IP to see whether GreyNoise has already classified it as a known scanning host, what ports and paths it has been seen probing elsewhere, and whether it is tied to a named actor, before deciding whether to escalate.

Multi IP Context Lookup (multi_ip_context_lookup)

Same data as IP Context Lookup above, but for a list of IP addresses in one call instead of one IP at a time.

Example use case: an Incident groups several related alarms with different source IPs. Instead of running IP Context Lookup once per IP, pass the whole list of source IPs from the incident to Multi IP Context Lookup and review the results together.

IP Quick Check (ip_quick_check)

A lighter version of the context lookup for a single IP. Instead of the full profile, it returns two booleans, noise (has this IP been seen scanning the internet) and riot (is this a known business service IP), plus a short classification code describing what GreyNoise currently knows about the IP, for example whether it has never been observed, has been directly seen scanning, or is commonly spoofed in scan traffic.

Example use case: as a fast first step in a playbook, run Quick Check on an alarm's source IP before deciding whether the slower, more detailed Context Lookup is worth calling.

Multi IP Quick Check (multi_ip_quick_check)

The bulk version of IP Quick Check, returning the same noise/riot/code fields for a list of IPs in one call.

Example use case: a playbook that processes a batch of firewall-blocked IPs each day can run one Multi IP Quick Check call to flag which of them are known scanners, rather than reviewing each one manually.

RIOT IP Lookup (riot_ip_lookup)

Checks GreyNoise's RIOT (Rule It Out) dataset, which tracks IP ranges belonging to common, legitimate business services such as major search engines, cloud providers, CDNs, and SaaS platforms. The response indicates whether the IP belongs to a known service, along with the service's name, category, and a short description.

Example use case: an alarm flags unusual outbound traffic to an external IP. Before treating it as suspicious, run RIOT IP Lookup to rule out that it is simply traffic to a known SaaS provider such as a cloud storage or collaboration service.

GNQL Query (gnql_query)

Runs a search written in GreyNoise Query Language (GNQL) against GreyNoise's full internet-scanner dataset and returns matching IP records. Unlike the lookup methods above, which take a specific IP you already have, this is a search across GreyNoise's whole dataset, useful for hunting rather than looking up a single known IP.

Example use case: an alarm references a specific CVE being exploited. Use GNQL Query to search GreyNoise for all IPs currently observed exploiting that CVE, to see whether the same activity is showing up elsewhere on the internet.

GNQL Stats (gnql_stats)

Runs the same kind of GNQL search as GNQL Query, but instead of returning the matching IP records themselves, it returns aggregate counts broken down by classification, organization, country, tag, operating system, category, and ASN.

Example use case: instead of pulling every IP matching a broad GNQL query, use GNQL Stats to get a quick summary, such as which countries or ASNs the matching activity is coming from, without retrieving the full IP list.

Notes and Limits

• All seven methods require an Enterprise-tier GreyNoise API key, as described under Prerequisites. A Community (free) key will not authenticate against any of them.
• GreyNoise's exact request-per-minute or per-day rate limit for Enterprise API keys is not published with a specific number in its public documentation and was not independently verified during this research. If you run into repeated 429 responses, prefer the Multi IP Context Lookup and Multi IP Quick Check methods over looping single-IP lookups, since a single batched call counts far less against your quota than the same number of individual calls, and confirm your plan's exact quota with your GreyNoise account contact.
• The integration does not automatically retry a failed or rate-limited call. If a method returns an error, the error text from GreyNoise's response is passed through to Logsign as-is and the action is not retried within the same run.
• Only IPv4 addresses were confirmed against the code and manifest for this integration. Whether GreyNoise's underlying API or this integration supports IPv6 lookups was not tested and is not verified.
• The Insecure Skip Verify option defaults to enabled in the current integration, which disables TLS certificate validation on the connection to GreyNoise. Review and disable it after configuration unless you specifically need it for an inspecting proxy.
• This integration is a Response (Action) integration for on-demand IP enrichment during Incident/Alarm handling. It does not collect or ingest GreyNoise data as a log source on a schedule; there is no separate poller for GreyNoise.

Troubleshooting