Using Grey Noise to Reduce Noisy Alerts in XSOAR
Summary: Robert, manager of Cybersecurity Incident Response & Operations at a large hospitality and food service company, leads a team of 4 analysts handling Tier 2+ alerts that were slow to investigate because every IDS/IPS alert was run. The team first used GreyNoise with a homegrown incident response tool to manually filter out alerts that were not targeted attacks, then brought GreyNoise into Cortex XSOAR after a competitive bakeoff to automatically enrich alerts, and now uses it to deprioritize internet background noise, add context, and rule out known legitimate traffic.
Why it matters: A four-analyst Tier 2+ team was spending its time running every IDS/IPS alert, and the fix was filtering out internet background noise rather than adding headcount. The team's next step is to automate the decision process, which puts the judgment about what counts as a true threat into code.
Read the original at GreyNoise Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026