Quickly Triaging HTTP Traffic From Grey Noise’s New Hosted Sensors

Summary: GreyNoise's new hosted sensor fleet is producing PCAPs for participants in the first round of its Early Access Program, letting users dedicate an internet-facing IPv4 address that is wired to a chosen device persona, from a Cisco device to a camera. A PCAP analyzer feature is listed as coming soon to the GN Visualizer and API, and the company says a human pass over HTTP paths, headers, and POST bodies led to its recent security.txt and robots.txt scanner tags.
Key Takeaway: GreyNoise attributes new detection tags to manual review of HTTP traffic its automated tagging missed, which suggests the attack and activity rules a security team relies on can have gaps that only human inspection of raw request paths, headers, and POST bodies surfaces.

Read the original at GreyNoise Blog ↗