Grey Noise Maltego Integration with Brad Chiappetta

Summary: GreyNoise released Maltego Transforms in two sets: a Community version that performs a simple IP lookup against the GreyNoise community API, and an Enterprise version requiring a paid Maltego license and a full GreyNoise API key that adds noise context, RIOT, and query endpoints. In the walkthrough, Brad Chiappetta shows lookups returning IP classification, RIOT status, ASN, location, tags, scanned ports, and CVEs, plus pivots from a tag or CVE to other IPs observed scanning for it, filtered by time window, port, or actor.
Key Takeaway: The pivot is the point: from one IP, an analyst can pull every other address GreyNoise has seen scanning for the same CVE or tag today, turning a single alert into a correlated set of ASNs, locations, and actors - and RIOT lookups flag common business services like Google Public DNS as trust level 1, meaning activity there can reasonably be ignored.

Read the original at GreyNoise Blog ↗