Automated GreyNoise IP Reputation Checks in Google Sheets

PromptCreate

Build this as a code workflow. Every day at 6am, run a scheduled sweep that reads a list of IP addresses from a Google Sheets tracking sheet, checks them all against GreyNoise in one bulk lookup, and writes the results back into the same rows.

Start with Google Sheets Get Values to read the IP column from a fixed A1 range on the tracking tab (for example firewall blocklist candidates or recently seen source IPs). Treat the first row as a header and collect the IP addresses from the rows below, remembering which spreadsheet row each IP came from so the results land next to the right IP.

Send every IP address in a single GreyNoise Multi IP Lookup request. Multi IP Lookup accepts up to 10,000 IPs per call and returns the same intelligence shape as the single IP Lookup for each one: internet_scanner_intelligence, business_service_intelligence, and a combined classification.

For each IP, build a row of status columns from the response. Include the classification (benign, malicious, suspicious, or unknown); whether the IP is internet background noise, as yes or no from internet_scanner_intelligence.found; the RIOT business-service name if the IP belongs to one, taken from business_service_intelligence (otherwise record 'none'); the last-seen date from the scanner intelligence; and the timestamp of this check, which is the current run time. When GreyNoise has no record of an IP, meaning it is absent from both the scanner and business-service datasets, write 'no data' in the classification column instead of leaving the row blank.

Write everything back with Google Sheets Update Values, overwriting the status columns for every IP on every run so the sheet always reflects GreyNoise's latest verdict. Update the same fixed set of columns each time (classification, internet background noise, business service, last seen, checked at) over the same range. Do not append new rows or shift the existing IP list.

Note on limits: GreyNoise's free Community tier is limited to roughly 50 lookups per week, so sheets with more than a few dozen IPs need a paid GreyNoise plan to cover the daily sweep.

What does this prompt do?

Reads a list of IP addresses you keep in a Google Sheet, such as firewall blocklist candidates or recently seen source IPs.
Checks every IP against GreyNoise in one bulk lookup to see how it is classified and whether it is harmless internet background noise.
Writes the results back into the same rows, filling columns for classification, background-noise status, known business-service name, last-seen date, and the time of the check.
Runs on its own every morning and overwrites the status columns so the sheet always shows GreyNoise's latest verdict, marking any unknown IPs as 'no data' instead of leaving gaps.

What do I need to use this?

A Google account with the tracking spreadsheet that holds your IP addresses.
A GreyNoise account and API key (GreyNoise issues keys only to accounts registered with a business email address).
A column of IP addresses in the sheet, with room alongside it for the status columns the workflow fills in.
A paid GreyNoise plan if your list is large, since the free Community tier allows only about 50 lookups per week.

How can I customize it?

Change the timing or frequency, for example running hourly during an active incident instead of once a day at 6am.
Point it at a different spreadsheet, tab, or cell range, or grow the list of IPs it watches.
Adjust which result columns get written or the order they appear in.

FAQs

What is internet background noise?

GreyNoise labels IP addresses that constantly scan or probe the whole internet as background noise. These are usually opportunistic and not aimed at you specifically, so you can safely deprioritize them and focus on the IPs that stand out.

Will this work on the free GreyNoise plan?

Yes for small lists, but the free Community tier only allows about 50 lookups per week. If your sheet holds more IPs than that, you will want a paid GreyNoise plan so the daily sweep can check every row.

What happens to IPs GreyNoise has never seen?

Those rows are marked 'no data' so you can tell them apart from IPs that simply have not been checked yet. Nothing is left blank.

Does it overwrite my spreadsheet every run?

It overwrites only the status columns it manages: classification, background noise, business service, last seen, and the check time. Your list of IP addresses stays exactly as you left it.

What is a RIOT business service?

RIOT is GreyNoise's list of common business services such as Google, Microsoft, or Cloudflare. If an IP belongs to one, the workflow records that name so you do not mistake trusted infrastructure for a threat.

Related templates

Call overdue Xero customers with an AI collections agent

Every weekday at 10am, an AI voice agent phones your most overdue Xero accounts, logs what each customer promised, and reports back to finance in Slack.