GreyNoise integrates IP classification into CrowdStrike Falcon Next-Gen SIEM, Fusion SOAR and Charlotte AI
GreyNoise announced that its internet-scanning IP classification data is now available across the CrowdStrike Falcon platform through the GreyNoise Foundry App, listed on the CrowdStrike Marketplace. This is a product and integration announcement with no direct threat or incident. The integration is meant to help SOC teams separate benign scanners from malicious or exploiting IPs and reduce alert noise. GreyNoise says its network has more than 5,000 sensors in 80 countries, analyzes up to one billion sessions per day and tracks over 50 million IPs.
Technical Details
- Falcon Next-Gen SIEM: the Foundry App imports a daily GreyNoise indicator lookup file covering benign scanners, malicious actors, CVE-targeting sources and tagged threat infrastructure. Analysts query it with the
match()function, and classification, observed activity and exploited CVE columns appear next to event data. - Falcon Fusion SOAR: native enrichment supports playbooks that alert on malicious IPs, prioritize vulnerability response using CVE exploitation data, start threat hunts on coordinated scanning, and automate blocking or containment.
- Charlotte AI: CrowdStrike names GreyNoise among the trusted ecosystem participants in Charlotte AI's Agentic Response Collaboration capability, alongside Corelight, ExtraHop, Proofpoint, Google, Abnormal AI and Zscaler. GreyNoise states that Charlotte AI's use of ecosystem data is still maturing.
- Availability: the app is offered to Falcon Next-Gen SIEM and Falcon Insight XDR customers.
Remediation
No remediation applies. Falcon Next-Gen SIEM and Falcon Insight XDR customers can install the GreyNoise Foundry App from the CrowdStrike Marketplace to add IP context to triage and SOAR workflows.
Linha do tempo
-
GreyNoise integrates IP classification into CrowdStrike Falcon Next-Gen SIEM, Fusion SOAR and Charlotte AI
ler a análise desta fonte ocultar
GreyNoise announced that its internet-scanning IP classification data is now available across the CrowdStrike Falcon platform through the GreyNoise Foundry App, listed on the CrowdStrike Marketplace. This is a product and integration announcement with no direct threat or incident. The integration is meant to help SOC teams separate benign scanners from malicious or exploiting IPs and reduce alert noise. GreyNoise says its network has more than 5,000 sensors in 80 countries, analyzes up to one billion sessions per day and tracks over 50 million IPs.
Technical Details
- Falcon Next-Gen SIEM: the Foundry App imports a daily GreyNoise indicator lookup file covering benign scanners, malicious actors, CVE-targeting sources and tagged threat infrastructure. Analysts query it with the
match()function, and classification, observed activity and exploited CVE columns appear next to event data. - Falcon Fusion SOAR: native enrichment supports playbooks that alert on malicious IPs, prioritize vulnerability response using CVE exploitation data, start threat hunts on coordinated scanning, and automate blocking or containment.
- Charlotte AI: CrowdStrike names GreyNoise among the trusted ecosystem participants in Charlotte AI's Agentic Response Collaboration capability, alongside Corelight, ExtraHop, Proofpoint, Google, Abnormal AI and Zscaler. GreyNoise states that Charlotte AI's use of ecosystem data is still maturing.
- Availability: the app is offered to Falcon Next-Gen SIEM and Falcon Insight XDR customers.
Remediation
No remediation applies. Falcon Next-Gen SIEM and Falcon Insight XDR customers can install the GreyNoise Foundry App from the CrowdStrike Marketplace to add IP context to triage and SOAR workflows.
- Falcon Next-Gen SIEM: the Foundry App imports a daily GreyNoise indicator lookup file covering benign scanners, malicious actors, CVE-targeting sources and tagged threat infrastructure. Analysts query it with the