How Hurricane Labs Reduces Noisy Alerts in Splunk and Phantom | Cybersecurity Blog | Grey Noise
Summary: Hurricane Labs, a managed services provider focused on Splunk and Phantom, used GreyNoise Intelligence data to filter noisy alerts, reducing alert volume by 25% and saving the equivalent of one to one and a half analysts per day out of 22 total analysts during its trial. The company applies GreyNoise in Splunk to exclude alerts matching known scanners and internet background noise before they reach analysts, and uses it in Phantom to enrich alerts, with about two-thirds of customers now comfortable ignoring IPs GreyNoise classifies as scanners.
What you should know: Hurricane Labs' director notes that a product eliminating even 8 alerts per day across 40 customers equals 320 alerts, and that advantage compounds with each new customer in a way hiring an analyst cannot.
Read the original at GreyNoise Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026