Grey Noise Block

Summary: GreyNoise Block turns its Global Observation Grid data into firewall blocklists that provision in minutes and refresh every hour, with templates covering CVE exploit attempts, attacks on vendors including Cisco, Citrix, F5, Fortinet, Ivanti, Palo Alto and SonicWall, Mirai behavior, and source geographies. The product deploys as standard External Dynamic Lists over HTTPS, offers a drag-and-drop Advanced builder with a NOT toggle per block, and is sold both as a standalone self-service product with up to 10 blocklists and as Platform Blocklists built into the GreyNoise Platform for enterprise subscribers.
Bottom line: GreyNoise's own framing is that patching a new vulnerability takes days while blocking the IPs actively firing exploits takes minutes - so the gap between disclosure and patch is time your perimeter either buys back or doesn't. The other stake is overblocking: one swept-up business partner undermines trust in the entire list, which is why the NOT toggle and the malicious/suspicious/benign/unknown classification exist.

Read the original at GreyNoise Blog ↗