Grey Noise | How to know if I am being targeted

Summary: GreyNoise collects unsolicited scanning traffic from IPs worldwide, rotating its listening IPs frequently so that all observed traffic is unsolicited, and uses that dataset to give SOC teams context for prioritizing alerts. The company notes that targeted requests to a given organization often fall outside what GreyNoise can see, and that traffic from an IP GreyNoise has not observed is likely targeted at that organization due to business verticals, software vendors in use, or implied value.
What's compelling: An alert from an IP that GreyNoise has never seen is the signal that your organization is being singled out rather than swept up in background scanning, and GreyNoise says those alerts deserve higher priority for investigation. The catch is that the targeted traffic is precisely the traffic outside GreyNoise's view, so the context tool cannot confirm the thing you most need to know.

Read the original at GreyNoise Blog ↗