Demo - Cortex XSOAR / Grey Noise Integration

Summary: GreyNoise released a Cortex XSOAR integration pack that enriches XSOAR alerts with GreyNoise data to filter false positives, identify compromised devices, and track emerging threats. The pack installs from the XSOAR marketplace with an API key, adds GreyNoise data to the IP reputation command, and includes separate ingress and egress playbooks that adjust indicator and incident severity based on GreyNoise classification, RIOT, CVE, and actor data.
Bottom line: GreyNoise's own demo shows a single CVE query returning many scanning IP addresses, likely tied to EternalBlue, which is the volume of internet background noise a team has to triage before it can find a real incident.

Read the original at GreyNoise Blog ↗

Topics: Detection & Response
Related: YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026
Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026
Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026