Making Your SIEM and SOAR More Useful with the Grey Noise Community
Summary: GreyNoise founder and CEO Andrew Morris, in an October 2021 SANS CyberSolutions Fest session, described a SOC overwhelmed by alert volume and an internet so noisy that analysts cannot tell which 'bad' to focus on. He cited Apache CVE-2021-41773, where GreyNoise observed opportunistic vulnerability checks before the CVE was even created, and an experiment running Suricata on roughly 10 hosts with no business value that produced IDS alerts from thousands of IPs over four days.
Key Takeaway: Morris's point is that machine hours are cheap and human analysis hours are expensive, so attackers scale automated scanning while defenders drown - and the gap between a vulnerability's disclosure and its exploitation is shrinking to the point where a patch submitted to git drew probing before the CVE existed.
Read the original at GreyNoise Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026