Daily GreyNoise threat brief for your security team

Every weekday at 7am, build an emerging-internet-threat brief from GreyNoise and email it to our security team. The goal is to turn GreyNoise's GNQL dataset into a short, prioritized digest of what changed across internet scanning in the last 24 hours, so nobody has to dig through the GreyNoise Visualizer by hand. This is the 'track emerging threats' use case teams otherwise do manually.

Gather the data with GreyNoise. Use GNQL Query to search the full dataset for recent malicious scanning (for example a query like classification:malicious last_seen:1d, plus per-tag variants), and use GNQL Stats on the same queries to get aggregated counts broken down by tag, actor, organization, ASN, and source country. To find the biggest jumps rather than just the biggest absolute numbers, also pull the same aggregates for a comparable baseline window (for example the previous 24 hours, or a 7-day average) and compare the two, so you can flag the tags and actors whose activity spiked. Use GNQL Metadata Query when you only need the lighter metadata payload, and prefer aggregated GNQL Stats calls over pulling every raw IP.

What to surface: the malicious tags with the biggest jump in activity versus baseline; newly active scanning actors (actors showing up now that were quiet before); and the top attacking organizations, ASNs, and source countries.

Write the brief. Produce a short written threat brief of three to six bullets. Each bullet should say what changed and why it matters in one or two sentences, not just dump numbers. Keep it skimmable and lead with anything that looks like a new mass-exploitation campaign (a sharp spike on a specific exploit or CVE tag, or a newly active actor scanning aggressively) rather than routine background scanning. If the last 24 hours were quiet, say so plainly in a sentence or two instead of padding the brief with filler.

Deliver it with Gmail Send a Message. Email the brief to the security team. Use a dated subject line that leads with the headline, for example 'GreyNoise threat brief, [date]: [the biggest thing that changed]', and put the bullets in the body. Send the email even on quiet days, with a brief 'nothing notable' note, so the team knows the check ran. Set the recipient to your security team's address or distribution list.