Definition

GreyNoise is a cybersecurity intelligence platform that collects and analyzes internet background noise -- the constant barrage of automated scanning, crawling, and probing that constitutes the internet's "weather." Founded by Andrew Morris in 2017, GreyNoise operates a globally distributed network of passive sensors that observe and categorize unsolicited internet traffic. By cataloging which IP addresses are mass-scanning the internet and determining whether their activity is benign (security researchers, search engines, legitimate scanners) or malicious (botnets, worms, exploit scanners), GreyNoise helps analysts distinguish targeted attacks from opportunistic background noise.

The fundamental insight behind GreyNoise is that a significant portion of the alerts generated by security tools are triggered by non-targeted, automated internet scanning rather than actual threat activity. Studies have shown that up to 30-40% of firewall and IDS alerts are caused by benign internet background noise. By identifying and filtering this noise, GreyNoise dramatically reduces the volume of false positives that security teams must investigate, allowing analysts to focus on genuine threats.

GreyNoise categorizes every observed IP address into one of three classifications: benign (known legitimate scanners such as Shodan, Censys, academic researchers, and CDN probes), malicious (known botnets, exploit scanners, and command-and-control infrastructure), or unknown (observed scanning but without sufficient context for classification). This tripartite classification, combined with rich contextual metadata about each scanner's behavior, makes GreyNoise an invaluable complement to active scanning tools like Shodan and Censys.

Core Capabilities

GreyNoise provides several interconnected capabilities for internet noise intelligence:

Capability	Description	Security Value
Noise Classification	Categorize IPs as benign, malicious, or unknown	Reduce alert fatigue, prioritize real threats
RIOT Dataset	Rule It Out -- known benign services database	Immediate false positive elimination
IP Context	Detailed metadata on scanning behavior	Understand scanner intent and methodology
Tag System	Behavioral tags describing scanner activity	Rapid categorization (e.g., "Mirai-like", "SSH Bruteforcer")
CVE Correlation	Map scanning to specific vulnerability exploits	Track active exploitation campaigns
Timeline Analysis	Historical scanning behavior over time	Detect changes in scanner behavior or intent
Mass Assignment Detection	Identify IPs scanning large portions of the internet	Distinguish targeted from opportunistic scanning

IP Classification Model

GreyNoise's classification system provides a nuanced view of internet scanning activity:

Classification	Definition	Examples	Alert Action
Benign	Known legitimate, non-malicious scanning	Shodan, Censys, Google, Cloudflare, University researchers	Suppress alerts
Malicious	Known harmful scanning or exploitation	Botnets (Mirai, Hajime), exploit scanners, C2 infrastructure	Escalate and investigate
Unknown	Observed scanning, insufficient classification data	Unidentified mass scanners, VPN exit nodes, newly observed IPs	Context-dependent triage

The classification is supported by rich metadata:

{
  "ip": "198.51.100.42",
  "seen": true,
  "classification": "benign",
  "first_seen": "2024-01-15",
  "last_seen": "2026-02-14",
  "actor": "Censys",
  "tags": ["censys-scanner", "tls-scanner", "http-crawler"],
  "cve": [],
  "metadata": {
    "asn": "AS395954",
    "city": "Ann Arbor",
    "country": "United States",
    "country_code": "US",
    "organization": "Censys, Inc.",
    "os": "Linux",
    "rdns": "scanner-42.censys.io"
  },
  "raw_data": {
    "scan": [
      {"port": 443, "protocol": "TCP"},
      {"port": 80, "protocol": "TCP"}
    ],
    "web": {
      "useragents": ["Mozilla/5.0 zgrab/0.x"]
    }
  }
}

RIOT Dataset

The RIOT (Rule It Out) dataset is a curated database of IP addresses belonging to known benign services. Unlike the main classification system which observes scanning behavior, RIOT identifies IPs based on their organizational ownership:

RIOT Category	Examples	Purpose
CDN Providers	Cloudflare, Akamai, Fastly, AWS CloudFront	Filter CDN health checks and edge probes
Search Engines	Googlebot, Bingbot, Yandex, Baidu Spider	Filter crawler traffic
Cloud Providers	AWS, GCP, Azure health checks	Filter infrastructure monitoring
Security Scanners	Shodan, Censys, Qualys, Rapid7	Filter known-benign security scanning
DNS Providers	Google DNS, Cloudflare DNS, OpenDNS	Filter DNS resolution traffic
Monitoring Services	Pingdom, UptimeRobot, StatusCake	Filter uptime monitoring probes

The RIOT dataset enables instant false positive elimination: if an alert-triggering IP is in the RIOT database, the alert can be safely suppressed without further analysis. This "rule it out" approach is significantly faster than behavioral analysis.

API Integration

GreyNoise provides both Community (free) and Enterprise APIs for programmatic access:

# GreyNoise API client for Prismatic EASM
defmodule PrismaticPerimeter.Sources.GreyNoise do
  @moduledoc "GreyNoise API integration for noise filtering and IP context"

  @base_url "https://api.greynoise.io/v3"

  @type ip_context :: %{
    ip: String.t(),
    seen: boolean(),
    classification: :benign | :malicious | :unknown,
    actor: String.t() | nil,
    tags: [String.t()],
    cve: [String.t()],
    first_seen: Date.t() | nil,
    last_seen: Date.t() | nil,
    metadata: map()
  }

  @doc "Get full context for a specific IP address"
  @spec ip_context(String.t()) :: {:ok, ip_context()} | {:error, term()}
  def ip_context(ip) do
    case authenticated_request(:get, "/community/#{ip}") do
      {:ok, %{status: 200, body: body}} ->
        {:ok, parse_context(body)}

      {:ok, %{status: 404}} ->
        {:ok, %{ip: ip, seen: false, classification: :unknown}}

      {:error, reason} ->
        {:error, reason}
    end
  end

  @doc "Quick check if IP is noise (benign scanner)"
  @spec is_noise?(String.t()) :: {:ok, boolean()} | {:error, term()}
  def is_noise?(ip) do
    case ip_context(ip) do
      {:ok, %{classification: :benign}} -> {:ok, true}
      {:ok, _} -> {:ok, false}
      {:error, reason} -> {:error, reason}
    end
  end

  @doc "Check if IP is in RIOT dataset (known benign service)"
  @spec riot_check(String.t()) :: {:ok, map()} | {:error, term()}
  def riot_check(ip) do
    case authenticated_request(:get, "/riot/#{ip}") do
      {:ok, %{status: 200, body: body}} -> {:ok, body}
      {:ok, %{status: 404}} -> {:ok, %{riot: false, ip: ip}}
      {:error, reason} -> {:error, reason}
    end
  end

  @doc "Bulk context lookup for multiple IPs"
  @spec bulk_context([String.t()]) :: {:ok, [ip_context()]} | {:error, term()}
  def bulk_context(ips) when is_list(ips) do
    body = %{ips: ips}

    case authenticated_request(:post, "/noise/multi/quick", body) do
      {:ok, %{status: 200, body: results}} ->
        {:ok, Enum.map(results, &parse_context/1)}

      {:error, reason} ->
        {:error, reason}
    end
  end

  @doc "Lookup context for IPs associated with a domain's attack surface"
  @spec context_lookup(String.t()) :: {:ok, [ip_context()]} | {:error, term()}
  def context_lookup(domain) do
    # GreyNoise does not search by domain directly;
    # this is called after Shodan/Censys resolve IPs for a domain
    {:ok, []}
  end

  defp authenticated_request(method, path, body \\ nil) do
    headers = [
      {"key", api_key()},
      {"Accept", "application/json"}
    ]

    HTTPClient.request(method, "#{@base_url}#{path}",
      headers: headers,
      json: body
    )
  end

  defp api_key, do: Application.get_env(:prismatic_perimeter, :greynoise_api_key)
end

Context in Prismatic

The Prismatic Platform integrates GreyNoise in the Perimeter module to contextualize findings from Shodan and Censys. When the EASM discovery pipeline identifies exposed services, GreyNoise data determines whether incoming traffic to those services represents targeted threat activity or benign background noise. This context significantly improves security rating accuracy by preventing benign scanner activity from inflating risk scores.

GreyNoise integration occurs at the enrichment stage of the discovery pipeline:

Discovery (Shodan + Censys): Identify exposed services and their source IPs
Noise Filtering (GreyNoise): Classify IPs interacting with discovered services
Context Enrichment: Attach behavioral tags, classification, and RIOT data to findings
Scoring Adjustment: Modify risk scores based on noise classification

# GreyNoise noise filtering in the EASM pipeline
defmodule PrismaticPerimeter.Enrichment.NoiseFilter do
  alias PrismaticPerimeter.Sources.GreyNoise

  @doc "Filter and contextualize findings with GreyNoise data"
  @spec enrich_findings([finding()]) :: [enriched_finding()]
  def enrich_findings(findings) do
    # Extract unique IPs from findings
    ips = findings |> Enum.map(& &1.source_ip) |> Enum.uniq()

    # Bulk lookup for efficiency
    {:ok, contexts} = GreyNoise.bulk_context(ips)
    context_map = Map.new(contexts, &{&1.ip, &1})

    # Enrich each finding
    Enum.map(findings, fn finding ->
      context = Map.get(context_map, finding.source_ip, %{classification: :unknown})

      %{finding |
        noise_classification: context.classification,
        noise_actor: context[:actor],
        noise_tags: context[:tags] || [],
        risk_adjustment: calculate_risk_adjustment(context),
        confidence_modifier: confidence_from_classification(context)
      }
    end)
  end

  defp calculate_risk_adjustment(%{classification: :benign}), do: -0.5
  defp calculate_risk_adjustment(%{classification: :malicious}), do: +0.3
  defp calculate_risk_adjustment(%{classification: :unknown}), do: 0.0

  defp confidence_from_classification(%{classification: :benign}), do: 0.95
  defp confidence_from_classification(%{classification: :malicious}), do: 0.90
  defp confidence_from_classification(_), do: 0.50
end

GreyNoise acts as the third independent signal source for the Signal Plurality axiom. While Shodan and Censys provide asset discovery signals, GreyNoise provides threat context signals, creating a multi-dimensional assessment that satisfies the epistemic requirement for independent corroboration.

False Positive Reduction Impact

The quantitative impact of GreyNoise integration on alert accuracy:

Metric	Without GreyNoise	With GreyNoise	Improvement
Alert volume	100% (baseline)	60-70%	30-40% reduction
False positive rate	30-40%	5-10%	75-80% reduction
Analyst triage time	15-30 min per alert	5-10 min per alert	50-67% reduction
Mean time to respond	Hours	Minutes	Order of magnitude
Risk score accuracy	Moderate	High	Significant improvement

Comparison with Alternatives

Feature	GreyNoise	Shodan	Censys	AbuseIPDB
Primary purpose	Noise classification	Service discovery	Host/cert scanning	Abuse reporting
Data collection	Passive sensors	Active scanning	Active scanning	Community reports
Classification model	Benign/Malicious/Unknown	Service identification	Host enumeration	Abuse categories
RIOT dataset	Yes (curated benign DB)	No	No	No
CVE correlation	Active exploitation tracking	Vulnerability tagging	Limited	No
API speed	Very fast (single IP lookup <100ms)	Moderate	Moderate	Fast
Prismatic role	Noise filtering, threat context	Primary discovery	Certificate corroboration	Not integrated

Shodan - Scanning platform whose findings GreyNoise contextualizes
Censys - Discovery platform complemented by GreyNoise noise filtering
EASM - Attack surface management benefiting from noise reduction
Signal Plurality - Axiom satisfied by GreyNoise as third signal source
Attack Surface - External surface where noise filtering improves accuracy
Risk Score - Grades improved by filtering benign scanner activity
Rate Limiting - API quota management for GreyNoise integration
Contradiction Preservation - Handling conflicting threat assessments
Time Decay - GreyNoise temporal context for aging findings
Confidence Scoring - Classification confidence levels from GreyNoise data

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

GitHub | GitLab | LinkedIn | Contact
Developer Portal | Architecture | Meet the Creator

GreyNoise