Introducing Query-Based Blocklists: Fully Configurable, Real-Time Threat Blocking in the Grey Noise Platform

Summary: GreyNoise now lets customers turn any GreyNoise Query Language query into a live, continuously updated blocklist for firewalls, SOAR, and other enforcement points, with new matching IPs added instantly as GreyNoise observes them. The company says static blocklists age out and cause blind spots or false positives, and the query-based feature is available today to all platform customers with no new integration or license required.
Bottom line: The pitch rests on attacker infrastructure that changes by the hour, so a blocklist built from a one-time snapshot is stale almost immediately - the question is whether your enforcement points can consume a feed that updates as new matching IPs appear.

Read the original at GreyNoise Blog ↗