Grey Noise Visualizer Overview with Nick Roy

Summary: GreyNoise's Nick Roy walks through the GreyNoise Visualizer, the web interface for looking up IP addresses and querying its datasets, which include a noise dataset gathered from the company's sensor network and the RIOT (Rule It Out) dataset of roughly 60 million IP addresses tied to common business services such as Office 365, Slack, CDNs and Google DNS at 8.8.8.8. A basic one-day query returned about 230,000 results, and GreyNoise classifies observed hosts as benign when an actor can be assigned, unknown when no actor is known but no malicious traffic is seen, and malicious when traffic shows vulnerability exploitation, credential brute forcing or SSH worm activity.
Key Takeaway: The classification exists to answer one question during an investigation: whether an alerting IP is scanning the internet opportunistically or targeting your organization specifically, and the RIOT list flags addresses like 8.8.8.8 that you probably should not block.

Read the original at GreyNoise Blog ↗