Grey Noise API Documentation Guide with Brad Chiappetta

Summary: GreyNoise's Brad Chiappetta walks through the company's API documentation at docs.greynoise.io, covering the free Community API for basic IP lookups and the paid Enterprise APIs that return richer context on whether an IP is an internet scanner. He details the ping endpoint for checking an API key's access level and expiration, the POST-only multi-IP context endpoint that filters out any IPs not seen scanning, and the single-IP context lookup.
Key Takeaway: The multi-IP context endpoint silently drops every address GreyNoise has not observed scanning, so an analyst triaging a batch of IPs can mistake an empty result for a clean one - and the free Community tier returns only two booleans and a classification, not the actor and tag data a paid subscription provides.

Read the original at GreyNoise Blog ↗