Classify IP addresses via GreyNoise API into noise, riot, and threat categories.
npx skills add https://github.com/Liberty91LTD/cti-skills --skill greynoise-api
Please help me install this Agent Skill. Skill: greynoise-api Source: https://github.com/Liberty91LTD/cti-skills/tree/main/skills/greynoise-api Command: npx skills add https://github.com/Liberty91LTD/cti-skills --skill greynoise-api
Quickly determine the nature of an IP address by querying GreyNoise to distinguish benign scanners from threats, enabling faster triage and decision-making for security teams.
Query the GreyNoise Community endpoint with an IP to classify its noise, riot status, and classification.
High-intent search queries and answers about installing and using this skill.
GreyNoise IP classification queries Community and Enterprise endpoints to parse noise, riot, and classification values, differentiating benign internet scanners from malicious threats. This contextual data enables security teams to triage incidents accurately and deprioritize scanning-related noise during investigations.
To look up an IP address for incident response, query the GreyNoise Community or Enterprise endpoint by providing the target IP. The API authenticates via headers, parses response fields, and returns a machine-readable summary classifying the IP as benign, malicious, or unknown to guide your workflow.
GreyNoise Community endpoints provide basic IP noise classification, while Enterprise endpoints offer deeper contextual threat intelligence data. Both retrieve riot and classification values, but Enterprise endpoints supply richer contextual interpretation needed for advanced threat hunting and risk assessment scenarios.
Yes, handling API authentication headers is required to use GreyNoise for IP lookups. The Skill satisfies requirements for reading API endpoints and managing authentication headers to successfully retrieve and format contextual noise classification data for your security analysis.
Deprioritize IP noise during threat hunting when the GreyNoise API classification identifies the IP as a benign scanner. If the response indicates the address is malicious or unknown, you should escalate the IP for further investigation rather than treating it as scanning-related noise.
Liberty91LTDClassify IP addresses as noise or targeted activity using GreyNoise.
YukiIto1999Automate firmware malware analysis to identify backdoors and unauthorized modifications.
dandyeIntegrate threat actor profiles and intelligence to locate and report on IoCs and MITRE techniques in real-time network traffic.
mikopbxRetrieve MikoPBX Docker container IPs, ports, and API URLs.
