Instant IP address triage in your Slack security channel
Paste a suspicious IP into your security channel and get an instant, plain-language verdict on whether it's harmless scanner noise or worth investigating.
GreyNoise
Slack BotEngineeringOperationsNotifications & AlertsResearch & MonitoringTrigger this workflow from a Slack message event on our security triage channel, for example #soc-triage. Whenever a new message is posted in that channel, start the workflow and read the full text of the message. If the platform can only trigger on app mentions rather than on every channel message, use an app mention trigger instead, so the workflow fires when an analyst @mentions the bot and includes an IP address. Read and post everything as the Slack bot.
Scan the incoming message text for any IP addresses it contains, covering both IPv4 and IPv6. If the message contains no IP address, stop immediately and do nothing. Do not post any reply in that case, so the channel stays quiet when there is nothing to triage.
For each IP address you find, run a GreyNoise IP Lookup to pull its intelligence. Capture three things: the classification (benign, malicious, suspicious, or unknown), whether the IP is opportunistic internet background noise from mass scanning, and any RIOT business-service context, such as a known Google, AWS, or other common cloud or SaaS service.
Turn the raw GreyNoise data into a short, plain-language verdict for each IP and pick a recommended action an analyst can act on at a glance. For example: 'safe to ignore, this is scanner noise' when the IP is benign internet background noise, 'known business service, likely benign' when RIOT identifies it as a recognized service like Google or AWS, or 'investigate' when it is classified as malicious or suspicious. When GreyNoise has no record of the IP, say it is unknown and lean toward investigate.
Reply in the same thread as the original message using the Slack bot's Send a Message action, with the reply attributed to the bot. Keep it short and skimmable: give one line per IP, leading with the IP address, then the verdict, then the recommended action. If the message mentioned several IP addresses, cover all of them in a single threaded reply.
Example output
Additional information
What does this prompt do?
- Watches your security triage channel and reads every IP address teammates post there.
- Checks each IP against GreyNoise to see if it's harmless internet scanner noise, a known business service, or genuinely suspicious.
- Replies right in the thread with a plain-language verdict and a clear recommended action for each IP.
- Stays quiet when a message has no IP address in it, so the channel never fills up with noise.
What do I need to use this?
- A Slack workspace with a channel your team uses for security triage.
- A GreyNoise account to look up IP reputation.
- Permission to add the bot to your triage channel so it can read messages and reply in threads.
How can I customize it?
- Point it at whichever channel your team uses, or switch to firing only when someone @mentions the bot with an IP.
- Adjust the wording of the verdicts and recommended actions to match how your team talks.
- Choose whether it always replies inside the thread or posts a top-level message in the channel.
Frequently asked questions
What does GreyNoise tell me about an IP address?
Will it reply to every message in the channel?
Can it handle more than one IP in a single message?
Does it make the decision for me?
Where does the answer show up?
Related templates
Cut the false-positive noise from your alerts.
Let your team drop suspicious IPs into Slack and get an instant, trustworthy triage verdict back in the thread.