Get IP timeline
Action ID:tools.greynoise.get_ip_timeline
Get an IP timeline field summary. Calls GET /v3/noise/ips/{ip}/timeline directly.
Reference: https://docs.greynoise.io/reference/getiptimelinefieldsummary
Secrets
Required secrets:greynoise: required valuesGREYNOISE_API_KEY.
Input fields
string
required
IPv4 address to lookup.
string | null
GreyNoise API base URL.Default:
null.string | null
Number of days to show data for. source_asn_subnet is limited to 90 days. GreyNoise defaults to 1.Default:
null.string
Field over which to show activity breakdown. Supported values are destination_port, http_path, http_user_agent, source_asn, source_asn_subnet, source_org, source_rdns, tag_ids and classification.Default:
"classification".string | null
Granularity of activity date ranges. This can be in hours (e.g. Xh) or days (Xd). Valid hours are between 1 and 24. Valid days are between 1 and 90. source_asn_subnet supports daily granularity only (1d or 24h). GreyNoise defaults to 1d.Default:
null.string | null
Comma-separated list of dataset scopes to include in the query. When omitted, only the default GreyNoise global dataset is queried. Allowed values are greynoise (GreyNoise’s global dataset), community (aggregated community-contributed data), and personal (the authenticated caller’s own workspace data).Default:
null.GNQL stats
Action ID:tools.greynoise.gnql_stats
Get GNQL statistics. Calls GET /v3/gnql/stats directly.
Reference: https://docs.greynoise.io/reference/gnqlv3stats
Secrets
Required secrets:greynoise: required valuesGREYNOISE_API_KEY.
Input fields
string
required
GNQL query string.
string | null
GreyNoise API base URL.Default:
null.integer | null
Number of top aggregates to grab. Minimum 1, maximum 10000. GreyNoise defaults to 1000.Default:
null.Lookup IP context
Action ID:tools.greynoise.lookup_ip_context
Get full context for an IP address. Calls GET /v3/ip/{ip} directly.
Reference: https://docs.greynoise.io/reference/v3ip
Secrets
Required secrets:greynoise: required valuesGREYNOISE_API_KEY.
Input fields
string
required
IPv4 address to lookup.
string | null
GreyNoise API base URL.Default:
null.string | null
Comma-separated list of dataset scopes to include in the query. When omitted, only the default GreyNoise global dataset is queried. Allowed values are greynoise (GreyNoise’s global dataset), community (aggregated community-contributed data), and personal (the authenticated caller’s own workspace data).Default:
null.Lookup IPs context
Action ID:tools.greynoise.lookup_ips_context
Get full context for multiple IP addresses. Calls POST /v3/ip directly.
Reference: https://docs.greynoise.io/reference/v3multiip
Secrets
Required secrets:greynoise: required valuesGREYNOISE_API_KEY.
Input fields
array[string]
required
IPv4 addresses to lookup. GreyNoise supports up to 10000 per request.
string | null
GreyNoise API base URL.Default:
null.string | null
Comma-separated list of dataset scopes to include in the query. When omitted, only the default GreyNoise global dataset is queried. Allowed values are greynoise (GreyNoise’s global dataset), community (aggregated community-contributed data), and personal (the authenticated caller’s own workspace data).Default:
null.Lookup RIOT IP
Action ID:tools.greynoise.lookup_riot_ip
Get Business Service Intelligence, formerly RIOT, for an IP address. Calls GET /v3/ip/{ip} directly.
Reference: https://docs.greynoise.io/reference/v3ip
Secrets
Required secrets:greynoise: required valuesGREYNOISE_API_KEY.
Input fields
string
required
IPv4 address to lookup.
string | null
GreyNoise API base URL.Default:
null.string | null
Comma-separated list of dataset scopes to include in the query. When omitted, only the default GreyNoise global dataset is queried. Allowed values are greynoise (GreyNoise’s global dataset), community (aggregated community-contributed data), and personal (the authenticated caller’s own workspace data).Default:
null.Query GNQL
Action ID:tools.greynoise.query_gnql
Query GNQL. Calls GET /v3/gnql directly.
Reference: https://docs.greynoise.io/reference/gnqlv3query
Secrets
Required secrets:greynoise: required valuesGREYNOISE_API_KEY.
Input fields
string
required
GNQL query string.
string | null
GreyNoise API base URL.Default:
null.string | null
Comma-separated list of fields to exclude from the response. Recognized top-level response fields (e.g. tags, cves, vpn, tor, raw_data, metadata), metadata.<subfield> paths (e.g. metadata.organization, metadata.source_country, metadata.destination_countries), and raw_data.<subfield> paths (e.g. raw_data.ja3, raw_data.http.useragent) are accepted. The special value tags.details preserves tag identity (id, slug) and strips only the enriched details. Unknown field names return 400.Default:
null.string | null
Specifies the desired format of the results. Must be either csv or json. GreyNoise defaults to json.Default:
null.boolean | null
If true, the response will only include the IP address and the classification or trust level.Default:
null.string | null
Scroll token to paginate through results. Incompatible with format=csv.Default:
null.integer | null
The number of results provided per page for paginating through all results of a query. Minimum 1, maximum 10000. GreyNoise defaults to 10000.Default:
null.Quick IP
Action ID:tools.greynoise.quick_ip
Get quick context for an IP address. Calls GET /v3/ip/{ip} directly with quick enabled.
Reference: https://docs.greynoise.io/reference/v3ip
Secrets
Required secrets:greynoise: required valuesGREYNOISE_API_KEY.
Input fields
string
required
IPv4 address to lookup.
string | null
GreyNoise API base URL.Default:
null.string | null
Comma-separated list of dataset scopes to include in the query. When omitted, only the default GreyNoise global dataset is queried. Allowed values are greynoise (GreyNoise’s global dataset), community (aggregated community-contributed data), and personal (the authenticated caller’s own workspace data).Default:
null.Quick IPs
Action ID:tools.greynoise.quick_ips
Get quick context for multiple IP addresses. Calls POST /v3/ip directly with quick enabled.
Reference: https://docs.greynoise.io/reference/v3multiip
Secrets
Required secrets:greynoise: required valuesGREYNOISE_API_KEY.
Input fields
array[string]
required
IPv4 addresses to lookup. GreyNoise supports up to 10000 per request.
string | null
GreyNoise API base URL.Default:
null.string | null
Comma-separated list of dataset scopes to include in the query. When omitted, only the default GreyNoise global dataset is queried. Allowed values are greynoise (GreyNoise’s global dataset), community (aggregated community-contributed data), and personal (the authenticated caller’s own workspace data).Default:
null.