Lookup greynoise

Skill Liberty91LTD/cti-skills/skills/lookup-greynoise

Use when you need to classify an IP as internet scanner noise vs. targeted activity. Returns noise/riot flags, classification (benign/malicious/unknown), actor name if known. IP-only. Commonly invoked by /ip-investigation to filter out mass-scanning noise. Retrieval only.From its SKILL.md

Install

npx -y skills add Liberty91LTD/cti-skills --skill lookup-greynoise

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

16 stars16 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

5.6 KB, ~1.3k tokens by cl100k_base, as published. Nobody here has run it

lookup-greynoise

Queries GreyNoise to classify whether an IP is internet background noise (opportunistic scanners, search engines, etc.) or targeted. IP-only. Retrieval only.

When to invoke

User asks if an IP is scanner noise or targeted
Investigation skill wants to filter out mass-scanning IPs from indicator lists
Deciding if an IP hitting your perimeter is worth investigating

How to invoke

Two CLIs are provided. Pick by capability needed:

Basic noise check — Node CLI (zero deps)

node tools/clis/greynoise.js ip <ip>

Hits the /v3/community/{ip} endpoint (free, 50/day). Best for fast retrieval inside an investigation chain.

Full surface — Python CLI (uses official pygreynoise SDK)

python3 tools/clis/greynoise.py community <ip>          # FREE (50/day)
python3 tools/clis/greynoise.py context <ip>            # Enterprise
python3 tools/clis/greynoise.py riot <ip>               # Enterprise
python3 tools/clis/greynoise.py quick <ip,ip,...>       # Enterprise (bulk)
python3 tools/clis/greynoise.py similarity <ip>         # Enterprise
python3 tools/clis/greynoise.py timeline <ip> [--days N]  # Enterprise
python3 tools/clis/greynoise.py query "<gnql>"          # Enterprise
python3 tools/clis/greynoise.py stats "<gnql>"          # Enterprise
python3 tools/clis/greynoise.py metadata

Self-bootstraps a private venv at tools/clis/.venv-greynoise/ on first run.

Capabilities the Node CLI doesn't have (Enterprise tier required for most):

Context — full per-IP telemetry: every port/protocol/payload combination GreyNoise has observed, broken down by date.
GNQL search (query) — find every IP matching a query: classification:malicious tags:Mirai metadata.country:RU. The killer pivot — discover scanner clusters by characteristic.
GNQL stats — bucket counts (countries, ASNs, tags, categories) for a query without pulling individual results.
Similarity — given an IP, find behaviorally similar scanners (often used to expand a single observation into a cluster).
Timeline — daily activity history for an IP — useful for distinguishing a brief campaign from persistent scanning.
Quick (bulk) — classify many IPs in one call (cheaper than N individual lookups).
RIOT — explicit known-benign check (CDNs, search engines, ISPs) without the noise classification.

GNQL examples:

# All malicious scanners hitting port 22 from Russia in the last day
python3 tools/clis/greynoise.py query 'classification:malicious raw_data.scan.port:22 metadata.country:RU last_seen:1d'

# Stats: country distribution of Mirai-tagged IPs
python3 tools/clis/greynoise.py stats 'tags:"Mirai" last_seen:30d'

# Find IPs similar to a known scanner
python3 tools/clis/greynoise.py similarity 185.220.101.45 --limit 50

Both CLIs accept --dry-run.

Tier awareness — this matters

Community endpoint (/v3/community/{ip}) is public and unauthenticated. Both CLIs work without $GREYNOISE_API_KEY for the community subcommand. Rate-limited per source IP (a few per minute is fine; sustained bulk lookups will throttle).
Enterprise endpoints (context, RIOT, GNQL, similarity, timeline, quick) require a paid Enterprise key. As of 2026 GreyNoise no longer offers a free community API key tier — what their portal calls an "API key" gates Enterprise access. The CLIs return a 401 / 402 / "upgrade required" error if your key doesn't have access; fall back to community.
The community endpoint is sufficient for the most common CTI question — "is this IP a known scanner?" — for most investigation use.

Response format

source: greynoise
indicator: <IP>
query_time: <ISO8601>
noise: <boolean>          # seen as internet background noise
riot: <boolean>           # rule-it-out: known-benign common service
classification: benign | malicious | unknown
name: <actor name or unknown>
last_seen: <date>
message: <summary>

Rate limits

Community endpoint: 50 req/day free. Enterprise: much higher.

Source reliability (Admiralty default)

Default rating for downstream /score-source: B2 (usually reliable, probably true). Empirical signal. A noise: true result is strong evidence the IP is not targeted.

Operational notes

IP addresses only. The CLI rejects non-IP inputs.
riot: true is a strong signal the IP is a benign common service (CDN, search engine, etc.) — downgrade severity of any detection against it.
classification: malicious + noise: true = mass-scanning threat actor infrastructure, not a targeted campaign.

Related skills

/lookup-abuseipdb — abuse reports for the same IP
/lookup-virustotal, /lookup-shodan — additional IP context
/ip-investigation — uses GreyNoise to filter noise early in the pipeline

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.