Grey Noise App for Splunk with Nick Roy

Summary: GreyNoise's Splunk app installs from Splunkbase and, once an API key is entered, scans configured indexes for IP addresses and matches them against GreyNoise's noise and RIOT datasets. In the demo, Nick Roy's main index holds 9,300 IP addresses, 92% of which appear in the noise dataset of observed internet scanners and 3% in the RIOT dataset of common business services.
What's compelling: With 92% of the IP addresses in one index traced to internet-wide scanning, the analyst time spent triaging that traffic is the stake - and the app's GN filter command exists to drop those noise events from searches and alerts.

Read the original at GreyNoise Blog ↗