Tracking Internet “Noise” to Reduce Alerts and Predict Attacks
Summary: GreyNoise describes internet noise as unsolicited communications from tens of thousands of IP addresses hitting every internet-connected machine daily, generating thousands of events for SOC teams to analyze even though much of the traffic is harmless opportunistic scanning or common business services. In a webcast aired Thursday, August 5, 2021, founder and CEO Andrew Morris and SANS moderator Robert M. Lee discussed using GreyNoise's internet-wide sensor network to reduce alert fatigue, identify compromised devices, and predict malicious activity, with customers reported to be cutting alert loads by 25% or more.
Bottom line: SOC teams absorb thousands of events a day from traffic that is mostly harmless scanning, and the vendor's own figure for relief is a 25% or greater reduction in alert load - which sets the bar for how much of your analysts' time is currently going to noise rather than real threats.
Read the original at GreyNoise Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026