GreyNoise releases updated Google Security Operations integration with dashboards, YARA-L rules, webhooks and playbooks
GreyNoise announced an updated integration with Google Security Operations that brings its internet-scanner classification data into the SIEM/SOAR platform. The aim is to separate mass-scanning noise from activity targeting the customer's own environment. GreyNoise says it observes over 800,000 unique IPs daily across 5,000+ sensors in 80+ countries, classifying each as malicious, suspicious, benign or unknown with 3,000+ behavioral tags. The integration is available to joint customers with a GreyNoise API key at no additional licensing cost. This is product news with no direct threat or vulnerability.
Technical Details
- Ingestion: a script in the Google Security Operations ingestion-scripts repository, deployed as a Google Cloud function, pulls IP reputation data and GNQL query results from the GreyNoise API. It ingests them through the Google Security Operations API. The default query covers malicious IPs seen in the last 24 hours and can be customized.
- Dashboards: an Indicator Dashboard (15+ panels) and a Correlation Dashboard showing IOC matches against environment events.
- YARA-L rules: IP Match (1-hour window), Inbound Network Traffic with ASN Context (permitted inbound connections from flagged malicious IPs), and Brute Force Attack Detection (5+ blocked logins from flagged IPs within 15 minutes).
- Saved UDM searches: IP Risk & Vulnerability Details, Indicator Context Summary, High Risk Indicators and All Indicator Lookup.
- Response: response actions updated to v7.0, three webhook types (Alert, IP Change, CVE/Tag) and pre-built playbooks that enrich flagged IPs and deprioritize mass scanners.
Remediation
No remediation is required. Teams using Google Security Operations can deploy the ingestion script, rules and playbooks with a GreyNoise API key.
Linha do tempo
-
GreyNoise releases updated Google Security Operations integration with dashboards, YARA-L rules, webhooks and playbooks
ler a análise desta fonte ocultar
GreyNoise announced an updated integration with Google Security Operations that brings its internet-scanner classification data into the SIEM/SOAR platform. The aim is to separate mass-scanning noise from activity targeting the customer's own environment. GreyNoise says it observes over 800,000 unique IPs daily across 5,000+ sensors in 80+ countries, classifying each as malicious, suspicious, benign or unknown with 3,000+ behavioral tags. The integration is available to joint customers with a GreyNoise API key at no additional licensing cost. This is product news with no direct threat or vulnerability.
Technical Details
- Ingestion: a script in the Google Security Operations ingestion-scripts repository, deployed as a Google Cloud function, pulls IP reputation data and GNQL query results from the GreyNoise API. It ingests them through the Google Security Operations API. The default query covers malicious IPs seen in the last 24 hours and can be customized.
- Dashboards: an Indicator Dashboard (15+ panels) and a Correlation Dashboard showing IOC matches against environment events.
- YARA-L rules: IP Match (1-hour window), Inbound Network Traffic with ASN Context (permitted inbound connections from flagged malicious IPs), and Brute Force Attack Detection (5+ blocked logins from flagged IPs within 15 minutes).
- Saved UDM searches: IP Risk & Vulnerability Details, Indicator Context Summary, High Risk Indicators and All Indicator Lookup.
- Response: response actions updated to v7.0, three webhook types (Alert, IP Change, CVE/Tag) and pre-built playbooks that enrich flagged IPs and deprioritize mass scanners.
Remediation
No remediation is required. Teams using Google Security Operations can deploy the ingestion script, rules and playbooks with a GreyNoise API key.