low
GreyNoise outlines four SIEM detection use cases to cut SOC alert noise and flag malicious inbound and outbound traffic
1 fonte(s)
·
1 atualização(ões)
·
publicado 03/06/2026 21:00
·
coletado há 1 dia
GreyNoise published a vendor blog post describing four ways SOC teams can use its internet-wide scan and attack classification to improve SIEM detection. The use cases separate opportunistic mass-scanning noise from activity that may be targeted at an organization. The post is product-oriented guidance and does not describe a specific incident, vulnerability or threat actor.
Technical Details
- Reduce alert volume: filter firewall and WAF logs to inbound internet traffic, exclude source IPs that GreyNoise identifies as known mass scanners, and prioritize the remainder by source-IP volume to surface potentially targeted reconnaissance.
- Allowed inbound traffic from malicious hosts: correlate firewall and WAF allow logs with GreyNoise to find malicious or suspicious sources that were permitted through, which flags both sessions to investigate and rules to re-evaluate.
- Authentication from flagged hosts: correlate VPN and identity-provider logs with GreyNoise, keeping only non-spoofable matches. A successful authentication from a flagged IP is a high-priority alert, and failed attempts may indicate targeting of identity infrastructure.
- Outbound connections to threat infrastructure: match destination IPs in outbound network and EDR logs against GreyNoise-classified malicious infrastructure. Matches may indicate C2 beaconing, data exfiltration or botnet participation, and warrant immediate investigation of the internal host.
Remediation
- Integrate GreyNoise context into the SIEM alongside existing firewall, WAF, identity provider and EDR tooling.
- Re-evaluate firewall and WAF rules that allowed traffic from known-malicious IPs.
- Investigate internal hosts that make successful connections to malicious infrastructure for indicators of compromise.
Linha do tempo
-
GreyNoise outlines four SIEM detection use cases to cut SOC alert noise and flag malicious inbound and outbound traffic
ler a análise desta fonte ocultar
GreyNoise published a vendor blog post describing four ways SOC teams can use its internet-wide scan and attack classification to improve SIEM detection. The use cases separate opportunistic mass-scanning noise from activity that may be targeted at an organization. The post is product-oriented guidance and does not describe a specific incident, vulnerability or threat actor.
Technical Details
- Reduce alert volume: filter firewall and WAF logs to inbound internet traffic, exclude source IPs that GreyNoise identifies as known mass scanners, and prioritize the remainder by source-IP volume to surface potentially targeted reconnaissance.
- Allowed inbound traffic from malicious hosts: correlate firewall and WAF allow logs with GreyNoise to find malicious or suspicious sources that were permitted through, which flags both sessions to investigate and rules to re-evaluate.
- Authentication from flagged hosts: correlate VPN and identity-provider logs with GreyNoise, keeping only non-spoofable matches. A successful authentication from a flagged IP is a high-priority alert, and failed attempts may indicate targeting of identity infrastructure.
- Outbound connections to threat infrastructure: match destination IPs in outbound network and EDR logs against GreyNoise-classified malicious infrastructure. Matches may indicate C2 beaconing, data exfiltration or botnet participation, and warrant immediate investigation of the internal host.
Remediation
- Integrate GreyNoise context into the SIEM alongside existing firewall, WAF, identity provider and EDR tooling.
- Re-evaluate firewall and WAF rules that allowed traffic from known-malicious IPs.
- Investigate internal hosts that make successful connections to malicious infrastructure for indicators of compromise.