Internet Noise Search School with the Grey Noise Product Team - Searching for Words | Grey Noise Blog
Summary: GreyNoise's product team explains that its Viz search bar runs free-text searches across all its data, so a term like "banana" returns IPs that scanned for a "/banana/" directory as well as IPs with "banana" in their user agent. The post recommends GNQL field selectors such as raw_data.web.paths, raw_data.web.useragents and metadata.organization for precise queries, and notes that GreyNoise does not perform attribution to threat groups.
Key Takeaway: A free-text search for a threat term can mix unrelated IPs into your results, and GreyNoise states it does not attribute activity to threat groups - so identifying a specific actor still depends on the IoCs you bring from other research.
Read the original at GreyNoise Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026