> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GreyNoise

> Reference for the Tracecat GreyNoise integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Get IP timeline

Action ID: `tools.greynoise.get_ip_timeline`

Get an IP timeline field summary. Calls GET /v3/noise/ips/\{ip}/timeline directly.

Reference: [https://docs.greynoise.io/reference/getiptimelinefieldsummary](https://docs.greynoise.io/reference/getiptimelinefieldsummary)

### Secrets

Required secrets:

* `greynoise`: required values `GREYNOISE_API_KEY`.

### Input fields

<ParamField path="ip" type="string" required>
  IPv4 address to lookup.
</ParamField>

<ParamField path="base_url" type="string | null">
  GreyNoise API base URL.

  Default: `null`.
</ParamField>

<ParamField path="days" type="string | null">
  Number of days to show data for. source\_asn\_subnet is limited to 90 days. GreyNoise defaults to 1.

  Default: `null`.
</ParamField>

<ParamField path="field" type="string">
  Field over which to show activity breakdown. Supported values are destination\_port, http\_path, http\_user\_agent, source\_asn, source\_asn\_subnet, source\_org, source\_rdns, tag\_ids and classification.

  Default: `"classification"`.
</ParamField>

<ParamField path="granularity" type="string | null">
  Granularity of activity date ranges. This can be in hours (e.g. Xh) or days (Xd). Valid hours are between 1 and 24. Valid days are between 1 and 90. source\_asn\_subnet supports daily granularity only (1d or 24h). GreyNoise defaults to 1d.

  Default: `null`.
</ParamField>

<ParamField path="workspace_labels" type="string | null">
  Comma-separated list of dataset scopes to include in the query. When omitted, only the default GreyNoise global dataset is queried. Allowed values are greynoise (GreyNoise's global dataset), community (aggregated community-contributed data), and personal (the authenticated caller's own workspace data).

  Default: `null`.
</ParamField>

## GNQL stats

Action ID: `tools.greynoise.gnql_stats`

Get GNQL statistics. Calls GET /v3/gnql/stats directly.

Reference: [https://docs.greynoise.io/reference/gnqlv3stats](https://docs.greynoise.io/reference/gnqlv3stats)

### Secrets

Required secrets:

* `greynoise`: required values `GREYNOISE_API_KEY`.

### Input fields

<ParamField path="query" type="string" required>
  GNQL query string.
</ParamField>

<ParamField path="base_url" type="string | null">
  GreyNoise API base URL.

  Default: `null`.
</ParamField>

<ParamField path="count" type="integer | null">
  Number of top aggregates to grab. Minimum 1, maximum 10000. GreyNoise defaults to 1000.

  Default: `null`.
</ParamField>

## Lookup IP context

Action ID: `tools.greynoise.lookup_ip_context`

Get full context for an IP address. Calls GET /v3/ip/\{ip} directly.

Reference: [https://docs.greynoise.io/reference/v3ip](https://docs.greynoise.io/reference/v3ip)

### Secrets

Required secrets:

* `greynoise`: required values `GREYNOISE_API_KEY`.

### Input fields

<ParamField path="ip" type="string" required>
  IPv4 address to lookup.
</ParamField>

<ParamField path="base_url" type="string | null">
  GreyNoise API base URL.

  Default: `null`.
</ParamField>

<ParamField path="workspace_labels" type="string | null">
  Comma-separated list of dataset scopes to include in the query. When omitted, only the default GreyNoise global dataset is queried. Allowed values are greynoise (GreyNoise's global dataset), community (aggregated community-contributed data), and personal (the authenticated caller's own workspace data).

  Default: `null`.
</ParamField>

## Lookup IPs context

Action ID: `tools.greynoise.lookup_ips_context`

Get full context for multiple IP addresses. Calls POST /v3/ip directly.

Reference: [https://docs.greynoise.io/reference/v3multiip](https://docs.greynoise.io/reference/v3multiip)

### Secrets

Required secrets:

* `greynoise`: required values `GREYNOISE_API_KEY`.

### Input fields

<ParamField path="ips" type="array[string]" required>
  IPv4 addresses to lookup. GreyNoise supports up to 10000 per request.
</ParamField>

<ParamField path="base_url" type="string | null">
  GreyNoise API base URL.

  Default: `null`.
</ParamField>

<ParamField path="workspace_labels" type="string | null">
  Comma-separated list of dataset scopes to include in the query. When omitted, only the default GreyNoise global dataset is queried. Allowed values are greynoise (GreyNoise's global dataset), community (aggregated community-contributed data), and personal (the authenticated caller's own workspace data).

  Default: `null`.
</ParamField>

## Lookup RIOT IP

Action ID: `tools.greynoise.lookup_riot_ip`

Get Business Service Intelligence, formerly RIOT, for an IP address. Calls GET /v3/ip/\{ip} directly.

Reference: [https://docs.greynoise.io/reference/v3ip](https://docs.greynoise.io/reference/v3ip)

### Secrets

Required secrets:

* `greynoise`: required values `GREYNOISE_API_KEY`.

### Input fields

<ParamField path="ip" type="string" required>
  IPv4 address to lookup.
</ParamField>

<ParamField path="base_url" type="string | null">
  GreyNoise API base URL.

  Default: `null`.
</ParamField>

<ParamField path="workspace_labels" type="string | null">
  Comma-separated list of dataset scopes to include in the query. When omitted, only the default GreyNoise global dataset is queried. Allowed values are greynoise (GreyNoise's global dataset), community (aggregated community-contributed data), and personal (the authenticated caller's own workspace data).

  Default: `null`.
</ParamField>

## Query GNQL

Action ID: `tools.greynoise.query_gnql`

Query GNQL. Calls GET /v3/gnql directly.

Reference: [https://docs.greynoise.io/reference/gnqlv3query](https://docs.greynoise.io/reference/gnqlv3query)

### Secrets

Required secrets:

* `greynoise`: required values `GREYNOISE_API_KEY`.

### Input fields

<ParamField path="query" type="string" required>
  GNQL query string.
</ParamField>

<ParamField path="base_url" type="string | null">
  GreyNoise API base URL.

  Default: `null`.
</ParamField>

<ParamField path="exclude" type="string | null">
  Comma-separated list of fields to exclude from the response. Recognized top-level response fields (e.g. tags, cves, vpn, tor, raw\_data, metadata), metadata.\<subfield> paths (e.g. metadata.organization, metadata.source\_country, metadata.destination\_countries), and raw\_data.\<subfield> paths (e.g. raw\_data.ja3, raw\_data.http.useragent) are accepted. The special value tags.details preserves tag identity (id, slug) and strips only the enriched details. Unknown field names return 400.

  Default: `null`.
</ParamField>

<ParamField path="format" type="string | null">
  Specifies the desired format of the results. Must be either csv or json. GreyNoise defaults to json.

  Default: `null`.
</ParamField>

<ParamField path="quick" type="boolean | null">
  If true, the response will only include the IP address and the classification or trust level.

  Default: `null`.
</ParamField>

<ParamField path="scroll" type="string | null">
  Scroll token to paginate through results. Incompatible with format=csv.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The number of results provided per page for paginating through all results of a query. Minimum 1, maximum 10000. GreyNoise defaults to 10000.

  Default: `null`.
</ParamField>

## Quick IP

Action ID: `tools.greynoise.quick_ip`

Get quick context for an IP address. Calls GET /v3/ip/\{ip} directly with quick enabled.

Reference: [https://docs.greynoise.io/reference/v3ip](https://docs.greynoise.io/reference/v3ip)

### Secrets

Required secrets:

* `greynoise`: required values `GREYNOISE_API_KEY`.

### Input fields

<ParamField path="ip" type="string" required>
  IPv4 address to lookup.
</ParamField>

<ParamField path="base_url" type="string | null">
  GreyNoise API base URL.

  Default: `null`.
</ParamField>

<ParamField path="workspace_labels" type="string | null">
  Comma-separated list of dataset scopes to include in the query. When omitted, only the default GreyNoise global dataset is queried. Allowed values are greynoise (GreyNoise's global dataset), community (aggregated community-contributed data), and personal (the authenticated caller's own workspace data).

  Default: `null`.
</ParamField>

## Quick IPs

Action ID: `tools.greynoise.quick_ips`

Get quick context for multiple IP addresses. Calls POST /v3/ip directly with quick enabled.

Reference: [https://docs.greynoise.io/reference/v3multiip](https://docs.greynoise.io/reference/v3multiip)

### Secrets

Required secrets:

* `greynoise`: required values `GREYNOISE_API_KEY`.

### Input fields

<ParamField path="ips" type="array[string]" required>
  IPv4 addresses to lookup. GreyNoise supports up to 10000 per request.
</ParamField>

<ParamField path="base_url" type="string | null">
  GreyNoise API base URL.

  Default: `null`.
</ParamField>

<ParamField path="workspace_labels" type="string | null">
  Comma-separated list of dataset scopes to include in the query. When omitted, only the default GreyNoise global dataset is queried. Allowed values are greynoise (GreyNoise's global dataset), community (aggregated community-contributed data), and personal (the authenticated caller's own workspace data).

  Default: `null`.
</ParamField>