Grey Noise Use Cases: SOC Efficiency, Compromised Devices, Emerging Vulnerabilities | Cybersecurity Blog | Grey Noise
Summary: GreyNoise CEO Andrew Morris described three use cases for the service in a tweetstorm: looking up an alerting IP to see whether it is a known benign scanner like Shodan or Censys, a malicious but opportunistic source, or an IP GreyNoise has never seen, which may mean a targeted attack. He also described dumping log files into the analysis page, where an SSH auth.log came back 97.22% noise, filtering known-benign services such as Zoom, GitHub, Office365 and Cloudflare through GreyNoise RIOT, and using GNQL queries to find compromised devices and check whether a CVE is being exploited at scale. Morris said just about every GreyNoise customer sees at least a 20% alert contextualization or reduction rate, and that the Community API is free and unauthenticated but rate limited to a few thousand lookups per day.
Key Takeaway: A 20% alert reduction is a fifth of your SOC's queue that was never an attack, and the case Morris singles out for real investigation is the IP GreyNoise has never seen at all.
Read the original at GreyNoise Blog ↗