Splunk and Grey Noise Integration: Discovering Hidden Insights through Feeds and Dashboards

Summary: GreyNoise released version 2.2.0 of its Splunk app, which keeps the last 24 hours of GreyNoise data local to a Splunk instance through feeds so analysts can filter opportunistic and benign IPs without API lookups. The app also supports custom commands that separate traffic classified as benign or from the RIOT dataset - roughly 50 million IP addresses tied to common business services - from IPs GreyNoise has not seen and those it classifies as unknown.
Bottom line: The IPs left after filtering are the ones GreyNoise has not seen or marks unknown, and the source ties those to more targeted attacks - the traffic a security team most needs to examine rather than the bulk of opportunistic scanning.

Read the original at GreyNoise Blog ↗