GreyNoise launches Intelligence Dashboard for persistent, customizable views of internet scan and attacker activity
GreyNoise announced the availability of the Intelligence Dashboard in its Visualizer platform. It lets users pin CVEs, tags, countries, IPs and GNQL queries into a persistent, always-current view of scan and attacker traffic observed by its global sensor network. This is a product announcement and does not describe a threat, vulnerability or incident. Its relevance to defenders is as a tool for monitoring internet-wide and workspace-specific malicious activity.
Technical Details
- On first open, the Dashboard tab builds a Daily Intelligence Dashboard populated with currently notable activity. Users can edit it, save their own version, or let it regenerate the next day.
- Dashboards consist of panels, each combining one of five panel types with one of five focus options. The GNQL focus turns any saved query, such as
tags:mirai classification:malicious, into a live panel. - Header controls apply to all panels: time range (past 24 hours or 10 days) and data source (GreyNoise global network, Community sensors, My Workspace sensors, or a combination).
- The Activity Map color-codes countries as source, destination or both. It shows the IPs and owning organizations involved, and can be filtered by source or destination country.
- Limits: up to 50 saved dashboards per user, with up to 24 panels each. Dashboards are personal to the user within a workspace, and changes are not saved automatically.
- Community and My Workspace sources require a deployed Swarm sensor, with access granted within about 6 hours.
- Data lookback is at least 10 days for customers and Community users with a business email, and 2 days for Community users with a consumer email.
Linha do tempo
-
GreyNoise launches Intelligence Dashboard for persistent, customizable views of internet scan and attacker activity
ler a análise desta fonte ocultar
GreyNoise announced the availability of the Intelligence Dashboard in its Visualizer platform. It lets users pin CVEs, tags, countries, IPs and GNQL queries into a persistent, always-current view of scan and attacker traffic observed by its global sensor network. This is a product announcement and does not describe a threat, vulnerability or incident. Its relevance to defenders is as a tool for monitoring internet-wide and workspace-specific malicious activity.
Technical Details
- On first open, the Dashboard tab builds a Daily Intelligence Dashboard populated with currently notable activity. Users can edit it, save their own version, or let it regenerate the next day.
- Dashboards consist of panels, each combining one of five panel types with one of five focus options. The GNQL focus turns any saved query, such as
tags:mirai classification:malicious, into a live panel. - Header controls apply to all panels: time range (past 24 hours or 10 days) and data source (GreyNoise global network, Community sensors, My Workspace sensors, or a combination).
- The Activity Map color-codes countries as source, destination or both. It shows the IPs and owning organizations involved, and can be filtered by source or destination country.
- Limits: up to 50 saved dashboards per user, with up to 24 panels each. Dashboards are personal to the user within a workspace, and changes are not saved automatically.
- Community and My Workspace sources require a deployed Swarm sensor, with access granted within about 6 hours.
- Data lookback is at least 10 days for customers and Community users with a business email, and 2 days for Community users with a consumer email.