GreyNoise

https://docs.greynoise.io/docs
Admin
GreyNoise is a cybersecurity platform that collects and analyzes Internet-wide scan and attack...
Tokens:86,631
Snippets:442
Trust Score:10
Update:11 months ago
Show doc for...
Tokens:
Raw
### Clone and Build GreyNoise MCP Server

Source: https://docs.greynoise.io/docs/mcp-server

Instructions for cloning the GreyNoise MCP Server repository from GitHub and installing dependencies.

```bash
git clone https://github.com/greynoise-labs/greynoise-mcp-server
cd greynoise-mcp-server
npm install && npm run build
```

--------------------------------

### Setup Redis Connection

Source: https://docs.greynoise.io/docs/integration-overview-cribl

Establishes a connection to a Redis instance. It uses environment variables for host, port, and password. The function tests the connection by setting a key with an expiration. If the connection fails, it logs an error and exits the application.

```python
import redis
import sys

# Assuming REDIS_HOST, REDIS_PORT, REDIS_PASSWORD, REDIS_KEY_EXPIRATION_SECONDS are set as environment variables
# LOGGER is already defined from logging.basicConfig

def setup_redis_connection():
    LOGGER.info("Creating redis connection")
    try:
        r = redis.Redis(
            host=REDIS_HOST,
            port=REDIS_PORT,
            password=REDIS_PASSWORD,
        )
        # test connection to ensure redis is accessible, exit if not
        r.set(
            "127.0.0.1",
            "testing",
            ex=int(REDIS_KEY_EXPIRATION_SECONDS),
        )
        LOGGER.info("Redis is connected successfully")
        return r

    except redis.exceptions.ConnectionError as conne:
        LOGGER.error("Unable to connect to redis: %s" % (conne))
        sys.exit(1)
    except Exception as e:
        LOGGER.error(f"Unexpected error connecting to redis: {e}")
        sys.exit(1)
```

--------------------------------

### GNQL Query API Sample

Source: https://docs.greynoise.io/docs/using-the-greynoise-api

This section demonstrates how to use the GreyNoise GNQL API to search the NOISE dataset. It explains the search functionality, pagination, and provides a Python SDK example for retrieving and processing query results.

```APIDOC
## Query (GNQL) API Sample

### Description
The GreyNoise GNQL API endpoint allows search through the GreyNoise NOISE dataset. The endpoint will take in any query in the GNQL format and provide an output of all the NOISE dataset IPs that match the query.

By default, the endpoint will return 1,000 results per page. The `size` parameter can be used to up the page limit to 10,000 results per page. When the total number of results exceeds the page size, a scroll token is provided in response to fetch the next set of results.

### Request Example (Python SDK)
```python
from greynoise.api import GreyNoise, APIConfig

api_config = APIConfig(api_key="<api-key>", integration_name="gnql-sample"
session = GreyNoise(api_config)

query = "last_seen:1d tags:Mirai*"
response = session.query(query, exclude_raw=True, size=10000)
print(f"Total Indicators in Query: {response.get('request_metadata', {}).get('count', 0)}")
data = response["data"]

complete = response.get("request_metadata", {}).get("complete", True)
scroll = response.get("request_metadata", {}).get("scroll", "")
while not complete:
    response = session.query(query, exclude_raw=True, size=10000, scroll=scroll)
    data.extend(response["data"])
    complete = response.get("request_metadata", {}).get("complete", True)   
    scroll = response.get("request_metadata", {}).get("scroll", "")

print(f"Total Indicators in Data Dictionary: {len(data)}")
```

### Response Example (Partial JSON Structure)
```json
{
  "data": [
    {
      "ip": "192.168.1.1",
      "organization": "QUALYS, Inc.",
      "category": "business",
      "rdns": "",
      "os": "",
      "sensor_count": 1,
      "sensor_hits": 2,
      "region": "California",
      "mobile": false,
      "single_destination": true,
      "destination_countries": [
        "Spain"
      ],
      "destination_country_codes": [
        "ES"
      ],
      "destination_asns": [
        "AS174"
      ],
      "destination_cities": [
        "San Sebastián de los Reyes"
      ],
      "carrier": "",
      "datacenter": "",
      "longitude": -121.895,
      "latitude": 37.3394,
      "raw_data": {
        "scan": [],
        "ja3": [],
        "hassh": [],
        "http": {
          "md5": [],
          "cookie_keys": [],
          "request_authorization": [],
          "request_cookies": [],
          "request_header": [],
          "method": [],
          "path": [],
          "request_origin": [],
          "useragent": []
        },
        "source": {
          "bytes": 144
        },
        "tls": {
          "cipher": [],
          "ja4": []
        },
        "ssh": {
          "key": []
        }
      },
      "last_seen_timestamp": "2025-05-25 04:28:29"
    }
  ],
  "request_metadata": {
    "restricted_fields": [],
    "message": "",
    "ips_not_found": [
      "195.72.230.190"
    ],
    "count": 10000,
    "complete": false,
    "scroll": "some_scroll_token"
  }
}
```
```

--------------------------------

### Run MISP Feed Fetch Command

Source: https://docs.greynoise.io/docs/integration-overview-misp

This command-line instruction is used to manually trigger the fetching of a specific feed into MISP. It requires the feed ID and the number of days to fetch. Ensure the MISP console application path is correct for your installation.

```bash
/var/www/MISP/app/Console/cake Server fetchFeed 1 74
```

--------------------------------

### Install GreyNoise Python Module

Source: https://docs.greynoise.io/docs/integration-overview-misp

Installs the necessary GreyNoise Python module using pip3. Ensure you have Python 3 installed on your system.

```shell
pip3 install greynoise
```

--------------------------------

### Community API Response Example

Source: https://docs.greynoise.io/docs/riot-data

This is an example response from the Community API, indicating if an IP is known to GreyNoise and associated with RIOT.

```APIDOC
## Community API Response

### Description
Provides basic information from the Community API, indicating if an IP is known to GreyNoise and part of the RIOT dataset.

### Method
GET (Assumed)

### Endpoint
`/api/v1/community/{ip}` (Assumed)

### Parameters
#### Path Parameters
- **ip** (string) - Required - The IP address to query.

### Response
#### Success Response (200)
- **ip** (string) - The IP address.
- **noise** (boolean) - Indicates if the IP is part of the Internet Scanner (Noise) dataset.
- **riot** (boolean) - Indicates if the IP is part of the RIOT dataset.
- **classification** (string) - The classification of the IP (e.g., "unknown").
- **link** (string) - A link to the IP's visualization page.
- **last_seen** (string) - The last time the IP was seen.
- **message** (string) - A status message.

#### Response Example
```json
{
    "ip": "8.8.8.8",
    "noise": true,
    "riot": true,
    "classification": "unknown",
    "link": "https://viz.greynoise.io/ip/8.8.8.8",
    "last_seen": "2024-08-12",
    "message": "Success"
}
```
```

--------------------------------

### Enterprise RIOT API Response Example

Source: https://docs.greynoise.io/docs/riot-data

This is an example response from the Enterprise RIOT API, detailing information about a business service IP address.

```APIDOC
## Enterprise RIOT API Response

### Description
Provides detailed information about an IP address associated with a known business service.

### Method
GET (Assumed)

### Endpoint
`/api/v1/riot/{ip}` (Assumed)

### Parameters
#### Path Parameters
- **ip** (string) - Required - The IP address to query.

### Response
#### Success Response (200)
- **ip** (string) - The IP address.
- **riot** (boolean) - Indicates if the IP is part of the RIOT dataset.
- **category** (string) - The category of the business service (e.g., "public_dns").
- **name** (string) - The name of the business service (e.g., "Google Public DNS").
- **description** (string) - A description of the business service.
- **explanation** (string) - An explanation of why this IP might be seen.
- **last_updated** (string) - The timestamp of the last update for this IP's data.
- **reference** (string) - A URL for further reference about the service.
- **trust_level** (string) - The trust level assigned to this IP (e.g., "1").

#### Response Example
```json
{
  "ip": "8.8.8.8",
  "riot": true,
  "category": "public_dns",
  "name": "Google Public DNS",
  "description": "Google's global domain name system (DNS) resolution service.",
  "explanation": "Public DNS services are used as alternatives to ISP's name servers. You may see devices on your network communicating with Google Public DNS over port 53/TCP or 53/UDP to resolve DNS lookups.",
  "last_updated": "2024-12-12T13:11:04Z",
  "reference": "https://developers.google.com/speed/public-dns/docs/isp#alternative",
  "trust_level": "1"
}
```
```

--------------------------------

### Perform Quick IP Lookup with GN SDK (Python)

Source: https://docs.greynoise.io/docs/using-the-greynoise-api

This snippet shows how to use the GreyNoise Python SDK to perform a quick IP lookup for a list of IP addresses. It initializes the SDK with API credentials and sends a list of IPs to the `quick` method. The response, containing basic IP information, is then printed.

```python
from greynoise.api import GreyNoise, APIConfig

api_config = APIConfig(api_key="api-key", integration_name="sdk-sample")
session = GreyNoise(api_config)
ips = ['64.39.104.22', '195.72.230.190']

quick_response = session.quick(ips)

print(quick_response)
```

--------------------------------

### JSON Examples for GreyNoise Data Fields

Source: https://docs.greynoise.io/docs/intelligence-module-hunt

Illustrates sample JSON data for TLS cipher suites, JA4 hashes, and tag objects. These examples showcase the structure and content of these fields.

```json
[
	"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
	"TLS_AES_128_GCM_SHA256",
	"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
]
```

```json
[
  "t12i060100_eca7c5d91837_338aad02a631",
  "t13i871000_72303a6ce03a_24695f2957a7"
]
```

```json
[
{
"category": "activity",
"created": "2020-04-07",
"cves": [],
"description": "IP addresses with this tag have been observed scanning the Internet for CGI scripts.",
"id": "feb92353-4264-44ce-8f7d-8ddae93719da",
"intention": "malicious",
"name": "CGI Script Scanner",
"recommend_block": false,
"references": [
"[https://en.wikipedia.org/wiki/Common_Gateway_Interface]"
],
"slug": "cgi-script-scanner",
"updated_at": "2025-05-14T04:12:40.778197Z"
}
]
```

```json
["CVE-1992-2342"]
```

--------------------------------

### Python: Configure Logging and Initialize GreyNoise Session

Source: https://docs.greynoise.io/docs/integration-overview-misp

Sets up basic logging for the script and initializes a GreyNoise API session. It requires the GN_API_KEY environment variable for authentication and includes error handling for session initialization. Dependencies include the 'greynoise' library.

```python
import logging
import os
from typing import Optional
from greynoise import GreyNoise, APIConfig

logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(threadName)s - %(levelname)s - %(message)s'
)
logger = logging.getLogger(__name__)

def get_greynoise_session() -> Optional[GreyNoise]:
    """Initialize and return a GreyNoise session with error handling."""
    try:
        GN_API_KEY = os.environ.get("GN_API_KEY")
        if not GN_API_KEY:
            logger.error("GN_API_KEY environment variable not set")
            return None
        
        api_config = APIConfig(api_key=GN_API_KEY, integration_name="misp-feed-script-v2.0")
        session = GreyNoise(api_config)
        return session
    except Exception as e:
        logger.error(f"Failed to initialize GreyNoise session: {e}")
        return None
```

--------------------------------

### JSON Example: Metadata Object

Source: https://docs.greynoise.io/docs/intelligence-module-investigate

Provides an example of the 'metadata' field, which is an object containing detailed information about the IP address. This includes Autonomous System Number (ASN), category, destination ASNs, and associated cities.

```json
{
  "asn": "AS51747",
  "category": "hosting",
  "destination_asns": [
    "AS20473",
    "AS44477"
  ],
  "destination_cities": [
    "Hong Kong",
    "Elk Grove Village",
    "Haarlem"
  ]
}
```

--------------------------------

### API Reference Documentation

Source: https://docs.greynoise.io/docs/api-and-cli-training-modules

This section provides links to the comprehensive API Reference documentation for GreyNoise.

```APIDOC
## API Reference

### Description
Access the full GreyNoise API Reference documentation for detailed information on all available endpoints.

### Endpoint
[Link to API Reference](https://docs.greynoise.io/reference)
```

--------------------------------

### Metadata Object Example - JSON

Source: https://docs.greynoise.io/docs/intelligence-module-triage

An example of the metadata object structure, which provides additional details about an IP address. This includes ASN, category, geographic information, and source details. Items not included in the Triage module will be empty.

```json
{
  "asn": "AS6142",
  "category": "hosting",
  "destination_asns": [],
  "destination_cities": [],
  "destination_countries": [
    "Brazil"
  ],
  "destination_country_codes": [
    "BR"
  ],
  "domain": "oracle.com",
  "latitude": 0,
  "longitude": 0,
  "mobile": false,
  "organization": "Oracle Corporation",
  "os": "",
  "rdns": "",
  "rdns_parent": "",
  "region": "Arizona",
  "sensor_count": 0,
  "sensor_hits": 0,
  "single_destination": true,
  "source_city": "Phoenix",
  "source_country": "United States",
  "source_country_code": "US"
}
```

--------------------------------

### Install Greynoise Feed Connector with Docker

Source: https://docs.greynoise.io/docs/tip-integration-overview-opencti

This Dockerfile snippet configures the Greynoise Feed Connector for OpenCTI. It specifies the image to use and essential environment variables for connection, authentication, and feed settings. Ensure to replace placeholder values like 'ChangeMe' with your actual credentials and identifiers.

```dockerfile
connector-greynoise-feed:
    image: opencti/connector-greynoise-feed:latest
    environment:
      - OPENCTI_URL=http://opencti:8080
      - OPENCTI_TOKEN=ChangeMe
      - CONNECTOR_ID=ChangeMe # Valid UUIDv4
      - CONNECTOR_TYPE=EXTERNAL_IMPORT
      - CONNECTOR_NAME=GreyNoiseFeed
      - CONNECTOR_SCOPE=greynoisefeed
      - CONNECTOR_LOG_LEVEL=error
      - GREYNOISE_API_KEY=ChangeMe
      - GREYNOISE_FEED_TYPE=malicious
      - GREYNOISE_LIMIT=250000
    restart: always
```

--------------------------------

### Initialize GreyNoise Session

Source: https://docs.greynoise.io/docs/integration-overview-cribl

Initializes and returns a GreyNoise API session. It requires the GREYNOISE_API_KEY environment variable to be set. The function configures the API key and integration name, creating a GreyNoise client instance. Error handling is included for cases where the API key is missing or session initialization fails.

```python
from greynoise import GreyNoise
from greynoise.api import APIConfig

# Assuming GREYNOISE_API_KEY is set as an environment variable
# LOGGER is already defined from logging.basicConfig

def setup_greynoise_session():
    """Initialize and return a GreyNoise session with error handling."""
    try:
        if not GREYNOISE_API_KEY:
            LOGGER.error("GREYNOISE_API_KEY environment variable not set")
            exit(1)

        api_config = APIConfig(
            api_key=GREYNOISE_API_KEY,
            integration_name="greynoise-to-redis-v2.0"
        )
        session = GreyNoise(api_config)
        return session
    except Exception as e:
        LOGGER.error(f"Failed to initialize GreyNoise session: {e}")
        exit(1)
```

--------------------------------

### IP Timeline API Response Example (JSON)

Source: https://docs.greynoise.io/docs/greynoise-ip-timeline

An example JSON response from the IP Timeline API, showcasing the structure and content of historical network activity data for an IP address. This includes details like timestamp, geolocation, ASN, protocols, and associated tags or fingerprints.

```json
{
    "activity": [
        {
            "timestamp": "2022-11-21T01:00:00Z",
            "country": "Ukraine",
            "country_code": "UA",
            "asn": "AS202580",
            "region": "Kyiv City",
            "city": "Kyiv",
            "category": "hosting",
            "datacenter": "",
            "rdns": "",
            "rdns_parent": "",
            "rdns_validated": false,
            "organization": "Bimeya LTD",
            "vpn": false,
            "vpn_service": "",
            "tor": false,
            "mobile": false,
            "three_way_handshake": false,
            "destinations": [
                {
                    "country": "Australia",
                    "country_code": "AU"
                },
                {
                    "country": "Bahrain",
                    "country_code": "BH"
                },
                {
                    "country": "Brazil",
                    "country_code": "BR"
                },
                {
                    "country": "Canada",
                    "country_code": "CA"
                },
                {
                    "country": "India",
                    "country_code": "IN"
                },
                {
                    "country": "Singapore",
                    "country_code": "SG"
                },
                {
                    "country": "South Africa",
                    "country_code": "ZA"
                },
                {
                    "country": "South Korea",
                    "country_code": "KR"
                },
                {
                    "country": "United States",
                    "country_code": "US"
                }
            ],
            "protocols": [
                {
                    "transport_protocol": "TCP",
                    "port": 10000,
                    "three_way_handshake": false
                }
            ],
            "classification": "malicious",
            "tags": [
                {
                    "id": "b183ced4-fafd-4ce5-8233-19af5f0837d3",
                    "slug": "webmin-rce-attempt",
                    "name": "Webmin RCE CVE-2019-15107",
                    "description": "IP addresses with this tag have been observed attempting to exploit CVE-2019-15107, a remote code execution vulnerability in some versions of Webmin.",
                    "category": "activity",
                    "intention": "malicious"
                },
                {
                    "id": "ac32bdeb-b49d-4079-9e6b-8fbca5e0addf",
                    "slug": "tls-ssl-scanner",
                    "name": "TLS/SSL Crawler",
                    "description": "IP addresses with this tag have been observed attempting to opportunistically crawl the Internet and establish TLS/SSL connections.",
                    "category": "activity",
                    "intention": "unknown"
                },
                {
                    "id": "79f609f0-4d07-455d-b9b1-56ff7c1a77a9",
                    "slug": "carries-http-referer-scanner",
                    "name": "Carries HTTP Referer",
                    "description": "IP addresses with this tag have been observed scanning the internet with an HTTP client that includes the Referer header in their requests.",
                    "category": "activity",
                    "intention": "unknown"
                }
            ],
            "ja3_fingerprints": [
                "42ea9ce86effc99ac3305b3c203cccad"
            ],
            "hassh_fingerprints": [],
            "http_paths": [],
            "http_user_agents": []
        },
        {
            "timestamp": "2022-11-21T02:00:00Z",
            "country": "Ukraine",
            "country_code": "UA",
            "asn": "AS202580",
            "region": "Kyiv City",
            "city": "Kyiv",
            "category": "hosting",
            "datacenter": "",
            "rdns": "",
            "rdns_parent": "",
            "rdns_validated": false,
            "organization": "Bimeya LTD",
            "vpn": false,
            "vpn_service": "",
            "tor": false,
            "mobile": false,
            "three_way_handshake": false,
            "destinations": [
                {
                    "country": "Brazil",
                    "country_code": "BR"
                },
                {
                    "country": "India",
                    "country_code": "IN"
                },
                {
                    "country": "United States",
                    "country_code": "US"
                }
            ],
            "protocols": [
                {
                    "transport_protocol": "TCP",
                    "port": 10000,

```

--------------------------------

### GET /v3/noise/ips/{ip}

Source: https://docs.greynoise.io/docs/greynoise-ip-timeline

Retrieves the daily summary of network activity for a given IP address, including timestamps, geolocation, ASN, and classification details.

```APIDOC
## GET /v3/noise/ips/{ip}

### Description
Retrieves the daily summary of network activity for a given IP address, including timestamps, geolocation, ASN, and classification details. This endpoint is useful for understanding historical network behavior associated with an IP.

### Method
GET

### Endpoint
`/v3/noise/ips/{ip}`

### Parameters
#### Path Parameters
- **ip** (string) - Required - The IP address to query.

#### Query Parameters
- **start_date** (string) - Optional - The start date for the query in `YYYY-MM-DD` format.
- **end_date** (string) - Optional - The end date for the query in `YYYY-MM-DD` format.

### Request Example
```json
{
  "example": "GET /v3/noise/ips/1.1.1.1?start_date=2022-11-20&end_date=2022-11-21"
}
```

### Response
#### Success Response (200)
- **activity** (array) - A list of network activity records for the IP address.
  - **timestamp** (string) - The timestamp of the activity.
  - **country** (string) - The country where the IP is located.
  - **country_code** (string) - The country code.
  - **asn** (string) - The Autonomous System Number.
  - **region** (string) - The region of the IP location.
  - **city** (string) - The city of the IP location.
  - **category** (string) - The category of the IP (e.g., "hosting", "enterprise").
  - **organization** (string) - The organization associated with the IP.
  - **vpn** (boolean) - Indicates if the IP is associated with a VPN.
  - **tor** (boolean) - Indicates if the IP is associated with Tor.
  - **mobile** (boolean) - Indicates if the IP is associated with a mobile network.
  - **classification** (string) - The classification of the IP's activity (e.g., "malicious", "benign").
  - **tags** (array) - A list of tags associated with the IP's activity.
    - **id** (string) - The unique identifier for the tag.
    - **slug** (string) - A URL-friendly identifier for the tag.
    - **name** (string) - The name of the tag.
    - **description** (string) - A description of the tag.
    - **category** (string) - The category of the tag.
    - **intention** (string) - The intention associated with the tag (e.g., "malicious", "unknown").
  - **protocols** (array) - A list of protocols observed for the IP.
    - **transport_protocol** (string) - The transport protocol (e.g., "TCP", "UDP").
    - **port** (integer) - The port number.
    - **three_way_handshake** (boolean) - Indicates if a three-way handshake was observed.
  - **ja3_fingerprints** (array) - List of JA3 fingerprints associated with the IP.
  - **hassh_fingerprints** (array) - List of HASH fingerprints associated with the IP.
  - **http_paths** (array) - List of HTTP paths observed for the IP.
  - **http_user_agents** (array) - List of HTTP User-Agents observed for the IP.

#### Response Example
```json
{
  "activity": [
    {
      "timestamp": "2022-11-21T01:00:00Z",
      "country": "Ukraine",
      "country_code": "UA",
      "asn": "AS202580",
      "region": "Kyiv City",
      "city": "Kyiv",
      "category": "hosting",
      "organization": "Bimeya LTD",
      "vpn": false,
      "tor": false,
      "mobile": false,
      "classification": "malicious",
      "tags": [
        {
          "id": "b183ced4-fafd-4ce5-8233-19af5f0837d3",
          "slug": "webmin-rce-attempt",
          "name": "Webmin RCE CVE-2019-15107",
          "description": "IP addresses with this tag have been observed attempting to exploit CVE-2019-15107, a remote code execution vulnerability in some versions of Webmin.",
          "category": "activity",
          "intention": "malicious"
        }
      ],
      "protocols": [
        {
          "transport_protocol": "TCP",
          "port": 10000,
          "three_way_handshake": false
        }
      ],
      "ja3_fingerprints": [
        "42ea9ce86effc99ac3305b3c203cccad"
      ],
      "hassh_fingerprints": [],
      "http_paths": [],
      "http_user_agents": []
    }
  ]
}
```
```

--------------------------------

### Initialize GreyNoise API Session

Source: https://docs.greynoise.io/docs/other-integrations

Initializes and returns a GreyNoise API session. It checks for the presence of the 'GREYNOISE_API_KEY' environment variable and exits if it's not set. The function creates an API configuration object and then instantiates the GreyNoise client. Error handling is included for potential exceptions during session initialization.

```python
def setup_greynoise_session():
    """Initialize and return a GreyNoise session with error handling."""
    try:
        if not GREYNOISE_API_KEY:
            LOGGER.error("GREYNOISE_API_KEY environment variable not set")
            exit(1)

        api_config = APIConfig(
            api_key=GREYNOISE_API_KEY, integration_name="greynoise-to-redis-v2.0"
        )
        session = GreyNoise(api_config)
        return session
    except Exception as e:
        LOGGER.error(f"Failed to initialize GreyNoise session: {e}")
        exit(1)
```

--------------------------------

### Using Environment Variables for Connector Configuration

Source: https://docs.greynoise.io/docs/tip-integration-overview-opencti

This example demonstrates how to reference environment variables within a Dockerfile for configuring OpenCTI connectors, such as the GreyNoise connectors. This approach is useful for managing sensitive information like API tokens and keys securely and for sharing configurations across multiple connectors.

```dockerfile
- OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
- CONNECTOR_ID=${CONNECTOR_GREYNOISE_ID}
- GREYNOISE_KEY=${CONNECTOR_GREYNOISE_API_KEY}
```

--------------------------------

### Utility and Community API Endpoints

Source: https://docs.greynoise.io/docs/v2-v3-api-migration-matrix

Documentation for utility and community API endpoints, including tag lookups and unchanged endpoints.

```APIDOC
## Utility and Community API Endpoints

### /v3/tags

#### Description
Provides tag lookups.

### Method
GET

### Endpoint
/v3/tags

### Request Example
```json
{
  "example": "GET /v3/tags"
}
```

### Response
#### Success Response (200)
- **tags** (array) - A list of available tags.

#### Response Example
```json
{
  "example": "{\"tags\": [\"malware\", \"vpn\"]}"
}
```

### /ping

#### Description
Health check endpoint.

### Method
GET

### Endpoint
/ping

### Request Example
```json
{
  "example": "GET /ping"
}
```

### Response
#### Success Response (200)
- **status** (string) - Service status.

#### Response Example
```json
{
  "example": "{\"status\": \"ok\"}"
}
```

### /v3/community/:ip

#### Description
Community API endpoint for IP information.

### Method
GET

### Endpoint
/v3/community/:ip

### Path Parameters
- **ip** (string) - Required - The IP address to query.

### Request Example
```json
{
  "example": "GET /v3/community/8.8.8.8"
}
```

### Response
#### Success Response (200)
- **data** (object) - Community data for the IP address.

#### Response Example
```json
{
  "example": "{\"8.8.8.8\": { ...community data... }}"
}
```
```

--------------------------------

### IP Metadata Retrieval

Source: https://docs.greynoise.io/docs/intelligence-module-hunt

This section details the various metadata fields available for IP addresses, including their types, example values, and descriptions.

```APIDOC
## IP Metadata Details

This documentation outlines the available metadata fields for IP addresses within the GreyNoise dataset.

### Fields

- **metadata.asn** (string) - ASN (Autonomous System Number) associated with the IP address. Example: AS37963
- **metadata.category** (string) - Category of the IP address such as hosting or ISP. Example: hosting
- **metadata.destination_asns** (string list) - List of ASNs associated with sensors that observed scanning traffic from this IP. Example: ["AS20473", "AS44477"]
- **metadata.destination_cities** (string list) - List of cities where sensors that observed scanning traffic from this IP are located. Example: ["Hong Kong", "Elk Grove Village", "Haarlem"]
- **metadata.destination_countries** (string list) - List of countries where sensors that observed scanning traffic from this IP are located. Example: ['Belarus']
- **metadata.destination_country_codes** (string list) - List of country codes where sensors that observed scanning traffic from this IP are located. Example: ['BY']
- **metadata.domain** (string) - Domain associated with the IP ASN owner. Example: lionlink.net
- **metadata.mobile** (boolean) - Defines if the IP is part of a known cellular network. Example: true
- **metadata.organization** (string) - The organization name associated with the IP address. Example: Internet Vikings International AB
- **metadata.os** (string) - Operating system information associated with the IP address. Example: ""
- **metadata.rdns** (string) - Reverse DNS lookup result for the IP address. Example: ""
- **metadata.rdns_parent** (string) - Parent domain from the reverse DNS lookup. Example: ""
- **metadata.region** (string) - Geographic region associated with the IP address. Example: Stockholm
- **metadata.sensor_count** (integer) - The number of GreyNoise sensors that have observed this IP address. Example: 3
- **metadata.sensor_hits** (integer) - The total number of times this IP address has been observed by GreyNoise sensors. Example: 20
- **metadata.single_destination** (boolean) - Indicates if the IP address is associated with a single destination. Example: false
- **metadata.source_city** (string) - The city from which the IP address is originating. Example: Stockholm
- **metadata.source_country** (string) - The country from which the IP address is originating. Example: Sweden
- **metadata.source_country_code** (string) - The country code from which the IP address is originating. Example: SE

```

--------------------------------

### Python SDK: Query and Paginate GNQL Data

Source: https://docs.greynoise.io/docs/using-the-greynoise-api

This Python script demonstrates how to use the GreyNoise SDK to query the NOISE dataset. It includes functionality to set the page size, handle pagination using scroll tokens for large result sets, and aggregate all matching data into a single list. The script requires an API key and specifies a sample GNQL query.

```python
from greynoise.api import GreyNoise, APIConfig

api_config = APIConfig(api_key="<api-key>", integration_name="gnql-sample")
session = GreyNoise(api_config)

query = "last_seen:1d tags:Mirai*"
response = session.query(query, exclude_raw=True, size=10000)
print(f"Total Indicators in Query: {response.get('request_metadata', {}).get('count', 0)}")
data = response["data"]
                   
complete = response.get("request_metadata", {}).get("complete", True)
scroll = response.get("request_metadata", {}).get("scroll", "")
while not complete:
    response = session.query(query, exclude_raw=True, size=10000, scroll=scroll)
    data.extend(response["data"])
    complete = response.get("request_metadata", {}).get("complete", True)   
    scroll = response.get("request_metadata", {}).get("scroll", "")

print(f"Total Indicators in Data Dictionary: {len(data)}")

```
Tokens:
Raw