Lion Cipher Lab
Triage scan noise with GreyNoise
- Threat Intel Analyst
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Point any machine at the public internet and within minutes strangers start knocking: SSH login attempts, probes for old web bugs, scans for exposed databases. A beginner reads a firewall or auth.log full of these and feels attacked. Most of the time they are not the target of anything — they are just one of the four billion addresses that opportunistic scanners, botnets, and research projects sweep continuously. The single most valuable triage skill in a SOC is telling that internet-wide BACKGROUND NOISE apart from traffic that is actually aimed at your organization, because chasing every…
What you'll learn
- separating internet background noise from targeted activity
- reading a GreyNoise verdict (noise / RIOT / classification)
- using the GreyNoise web visualizer without an account
- querying the free GreyNoise Community API with curl
- enriching an IP indicator to cut alert fatigue
- writing a defensive enrichment script that handles rate limits and unknowns
- knowing the limits: never auto-block on one source, and 'not noise' is not 'safe'
Steps in this lab
- First, why most IPs in your logs are not attacking you
- What GreyNoise actually is — the model in plain terms
- The no-account path: look up an IP in the web visualizer
- Get a free Community API key
- Query the Community API with curl — and confirm the endpoint
- A defensive script: sort a list of IPs into 'deprioritize' vs 'investigate'
- Why THIS tool, not that one — GreyNoise vs VirusTotal vs Shodan
- When NOT to lean on this — the caveats that keep you safe
- The way a pro does it: enrichment wired into the pipeline