Beyond the Noise: Why Grey Noise Malicious Feed is a Must-Have for Anomali Users

Summary: GreyNoise built a new Premium Feed for Anomali ThreatStream that lets Anomali customers pull in all malicious IPs GreyNoise has seen hitting its sensors in the past 24 hours, on a daily basis. GreyNoise positions the feed for opportunistic attack activity that should be automatically blocked rather than added to an analyst's triage queue, and offers a 14-day trial through the Anomali Marketplace using a GreyNoise API key.
Bottom line: GreyNoise's own guidance is that these observables are IPs blasting large swaths of the internet and likely not indicative of a targeted attack worth an analyst's time - so routing them into triage spends analyst hours on noise, while its RIOT data flags IPs tied to common business services where blocking may break something for your users.

Read the original at GreyNoise Blog ↗