# GreyNoise integration

> Internet-scanner and threat-intelligence data source: check whether an IP is opportunistic internet background noise, pull business-service (RIOT) context, run GNQL threat searches, and look up CVE exploitation activity.

- Authentication: apiKey

## Tools (14)

- **Bulk CVE Lookup**: Look up GreyNoise exploitation intelligence for up to 10,000 CVEs in one request.
- **Community Lookup**: Free-tier lookup of whether an IP is internet noise and/or a RIOT business service, with classification.
- **GNQL Metadata Query**: GNQL search that excludes raw scan data for a lighter, metadata-focused payload.
- **GNQL Query**: Search the full GreyNoise dataset with a GNQL query string; returns matching IPs with intelligence.
- **GNQL Recall**: Hourly historical GNQL records over a time range (Recall time series).
- **GNQL Recall Stats**: Count of unique matching IPs per time interval across a range (Recall statistics).
- **GNQL Stats**: Aggregated counts (by classification, org, actor, country, tag, ASN, etc.) for IPs matching a GNQL query.
- **IP Lookup**: Full single-IP intelligence combining noise/context, RIOT business-service, and classification.
- **IP Timeline**: Historical activity breakdown for a single noise IP over time, bucketed by a chosen field.
- **List CVEs**: List CVEs with GreyNoise exploitation metadata, sortable and filterable to exploitable-only.
- **List Tags**: Metadata catalog of every GreyNoise tag (activity/malware labels), filterable by name, slug, or CVE.
- **Multi IP Lookup**: Bulk lookup of up to 10,000 IPs in one request, same intelligence shape as single IP Lookup.
- **Ping**: Validate the API key and read the connected account's plan, expiration, offering, and enabled modules.
- **Retrieve CVE Information**: Full GreyNoise intelligence for a single CVE: details, timeline, and observed exploitation activity.

## Related prompts

- [Daily CVE exploitation alerts for your Slack security channel](https://www.generalinput.com/prompts/daily-cve-exploitation-alerts-for-your-slack-security-channel.md)
- [Instant IP address triage in your Slack security channel](https://www.generalinput.com/prompts/instant-ip-address-triage-in-your-slack-security-channel.md)
- [Daily GreyNoise threat brief for your security team](https://www.generalinput.com/prompts/daily-greynoise-threat-brief-for-your-security-team.md)
- [Daily GreyNoise IP reputation sweep in Google Sheets](https://www.generalinput.com/prompts/daily-greynoise-ip-reputation-sweep-in-google-sheets.md)

Connect GreyNoise in General Input: https://www.generalinput.com/apps/greynoise