Reference

Code

GreyNoise API client and tools.

greynoise.api

GreyNoise API client.

class greynoise.api.APIConfig(api_key: str, api_server: str | None = 'https://api.greynoise.io', timeout: int | None = 60, proxy: str | None = None, offering: str | None = 'enterprise', integration_name: str | None = None, cache_max_size: int | None = 1000000, cache_ttl: int | None = 3600, use_cache: bool | None = True, psychic: bool | None = False, psychic_model: int | None = 1, psychic_cache_dir: str | None = None, psychic_max_age_hours: int | None = 1)[source]: Configuration for API client.

class greynoise.api.BaseAPIClient(config: APIConfig)[source]

Base class for API clients with common functionality.

_process_batch_parallel(items: List[Any], process_func: Callable[[List[Any]], List[Any] | Dict[str, Any]], batch_size: int = 1000, max_workers: int = 10) → List[Any] | Dict[str, List[Any]][source]

Process items in parallel batches.

Args:: items: List of items to process process_func: Function to process each batch batch_size: Size of each batch max_workers: Maximum number of parallel workers
Returns:: Accumulated list or dict with values grouped by key.

Handle API requests with proper error handling and logging.

extra_headers are merged on top of the default User-Agent and key headers so callers (e.g. GreyNoise.request()) can add or override values such as Accept without reimplementing auth.

_setup_cache() → None[source]: Initialize cache with configured parameters.

_setup_session() → Session[source]

Set up a session with retry logic and connection pooling.

urllib3 retries transient 5xx responses only. 429 Too Many Requests is intentionally excluded.

close() → None[source]

Close the HTTP session and release the connection pool.

Parallel batch work (_process_batch_parallel()) uses short-lived thread pools internally; this method tears down the long-lived requests.Session. Safe to call multiple times.

class greynoise.api.GreyNoise(config: APIConfig)[source]

GreyNoise API client.

Parameters:

api_key (str) – Key use to access the API.
timeout (int) – API requests timeout in seconds.
proxy (str) – Add URL for proxy to redirect lookups

ANALYZE_MAX_POLL_ATTEMPTS = 360: Max status polls after upload (inclusive of re-checking the upload response as poll 0).

ANALYZE_POLL_INTERVAL_SECONDS = 5: Seconds to wait between analyze job status polls.

static _callback_filter_payload(*, is_stage_1: bool | None = None, is_stage_2: bool | None = None, first_seen_after: str | None = None, first_seen_before: str | None = None, last_seen_after: str | None = None, last_seen_before: str | None = None, has_files: bool | None = None, file_type: str | None = None, file_name: str | None = None, file_hash: str | None = None, scanner_ips: List[str] | None = None, ips: List[str] | None = None) → Dict[str, Any][source]: Build JSON body fields shared by callback list and export endpoints.

static _coerce_bulk_ip_post_response(api_result: Any) → Dict[str, List[Any]][source]

Normalize POST /v3/ip (multi / quick) JSON for batch merging.

Ensures each worker returns a dict whose values are lists so _process_batch_parallel() can merge chunks without corrupting results when the API returns an error object, wrong types, or omits keys.

_get_psychic_for_download(model: int | None = None)[source]: Return a Psychic client for download operations, creating one if needed.

static _ip_lookup_response_cacheable(response: Any) → bool[source]

Whether a raw IP lookup JSON body should be stored in ip_context_cache.

Error and not-found payloads (for example HTTP 404 bodies) often carry a top-level message and should not be cached: the address might later appear in the dataset and a stale cached error would hide fresh data.

analyze(text)[source]

Aggregate stats related to IP addresses from a given text.

Parameters:: text (file-like | str) – Text input
Returns:: Aggregated stats for all the IP addresses found.
Return type:: dict

Export callback IPs as newline-delimited text (POST .../export-ips).

Accepts the same filter fields as callback_list() (not pagination). On success the API returns text/plain; the client returns that body as a string (one IP per line).

Return type:: str | dict

callback_ip(ip_address=None, source_workspace='all')[source]

Get Recall data for a given query

Parameters:

ip_address (str) – IP address to use in the look-up.
source_workspace (str) – Source workspace to use in the look-up.

List callback IPs (paginated).

Parameters:

is_stage_1 – If true, only IPs where a file was downloaded (stage 1).
is_stage_2 – If true, only IPs suspected C2 from VT/sandbox (stage 2).
first_seen_after – Only IPs first seen after this date (YYYY-MM-DD).
first_seen_before – Only IPs first seen before this date (YYYY-MM-DD).
last_seen_after – Only IPs last seen after this date (YYYY-MM-DD).
last_seen_before – Only IPs last seen before this date (YYYY-MM-DD).
has_files – If true, only IPs with malware files; if false, only without.
file_type – Filter by MIME type (e.g. application/x-executable).
file_name – Filter by file name substring.
file_hash – Filter by file SHA256 hash.
scanner_ips – Only IPs associated with these scanner IPs.
ips – Restrict to this set of callback IPs.
page – Zero-indexed page (default on API: 0).
page_size – Results per page, 1–100 (default on API: 20).

Callback IP aggregate statistics (POST .../overview).

Same optional filters as callback_export_ips() and callback_list() (excluding pagination). Returns JSON (counts by stage, scanners, etc.).

cve(cve_id=None)[source]

Get CVE details by CVE ID

Parameters:: cve_id (str) – ID of CVE

cves(cve_ids: List[str]) → List[Dict[str, Any]] | Dict[str, Any][source]

Look up multiple CVEs in a single request.

Up to 10,000 CVE IDs per call.

Parameters:: cve_ids (list[str]) – CVE identifiers (e.g. CVE-2021-44228).
Returns:: API response: list of CVE records, or a dict with an error message when using the Community offering.
Return type:: list[dict] | dict

filter(text, noise_only=False, riot_only=False)[source]

Filter lines that contain IP addresses from a given text.

Parameters:

text (file-like | str) – Text input
noise_only (bool) – If set, return only lines that contain IP addresses classified as noise, otherwise, return lines that contain IP addresses not classified as noise.
riot_only (bool) – If set, return only lines that contain IP addresses in RIOT, otherwise, return lines that contain IP addresses not in RIOT.

Returns:

Iterator that yields lines in chunks

Return type:

iterable

ip(ip_address)[source]

Get context associated with an IP address.

Parameters:: ip_address (str) – IP address to use in the look-up.
Returns:: Context for the IP address.
Return type:: dict

When caching is enabled, successful-looking responses are cached; error-shaped bodies (typically with a message field) are not.

ip_multi(ip_addresses, include_invalid=False)[source]

Get activity associated with one or more IP addresses.

Parameters:

ip_addresses (str | list) – One or more IP addresses to use in the look-up.
include_invalid (bool) – True or False

Returns:

Bulk status information for IP addresses.

Return type:

dict

metadata()[source]

Get tag metadata (same as tags() with no filters).

Retained for backwards compatibility; calls tags() unfiltered.

not_implemented(subcommand_name)[source]

Send request for a not implemented CLI subcommand.

Parameters:: subcommand_name (str) – Name of the CLI subcommand

persona_details(persona_id=None)[source]

Get persona details by ID

Parameters:: persona_id (str) – ID of Persona

property psychic: Get direct access to the Psychic instance.

psychic_download(date: str, file_format: str, output_path: str | None = None, model: int | None = None) → str[source]

Download a Psychic file and write it to disk.

Parameters:

date – Date in YYYY-MM-DD format
file_format – File format to download (bin, mmdb, or csv)
output_path – Directory or file path for the download (default: current directory)
model – Psychic model to use (1, 2, or 3; default: from config or 1)

Returns:

Path to the written file

Return type:

str

psychic_download_bitmap(date: str, output_path: str | None = None) → str[source]

Download bitmap for a specific date and write it to disk.

Parameters:

date (str) – Date to download bitmap for
output_path (str) – Directory to write the bitmap file (default: current directory)

Returns:

Path to the written bitmap file

Return type:

str

psychic_download_csv(date: str, output_path: str | None = None) → str[source]

Download psychic MMDB data for a date and export it to CSV.

Parameters:

date (str) – Date to download data for
output_path (str) – Directory or file path for the CSV (default: current directory)

Returns:

Path to the written CSV file

Return type:

str

psychic_download_mmdb(date: str, output_path: str | None = None) → str[source]

Download mmdb for a specific date and write it to disk.

Parameters:

date (str) – Date to download mmdb for
output_path (str) – Directory to write the MMDB file (default: current directory)

Returns:

Path to the written MMDB file

Return type:

str

property psychic_enabled: bool: Check if Psychic is enabled.

psychic_generate(start_date: str, end_date: str, output_path: str | None = None, model: int | None = None) → str[source]

Generate a Psychic bitmap for a date range and write it to disk.

Parameters:

start_date – Start date in YYYY-MM-DD format
end_date – End date in YYYY-MM-DD format
output_path – Directory or file path for the generated file (default: current directory)
model – Psychic model to use (1, 2, or 3; default: from config or 1)

Returns:

Path to the written bitmap file

Return type:

str

psychic_generate_bitmap(start_date: str, end_date: str) → bytes[source]

Generate bitmap for a date range.

Parameters:

start_date (str) – Start date to generate bitmap for
end_date (str) – End date to generate bitmap for

Returns:

Bytes of the bitmap file

Return type:

bytes

psychic_lookup(ip_address: str) → Dict[str, Any][source]

Look up an IP address using Psychic offline bitmaps.

Parameters:: ip_address (str) – IP address to look up
Returns:: Dictionary with IP information from Psychic bitmap
Return type:: dict
Raises:: RuntimeError if psychic is not enabled

psychic_lookup_ips(ips: List[str]) → List[Dict[str, Any]][source]

Look up multiple IP addresses using Psychic offline bitmaps.

Parameters:: ips (List[str]) – List of IP addresses to look up
Returns:: List of dictionaries with IP information from Psychic bitmap
Return type:: List[dict]
Raises:: RuntimeError if psychic is not enabled

psychic_reload() → None[source]

Force reload of Psychic bitmap data.

Raises:: RuntimeError if psychic is not enabled

psychic_stats() → Dict[str, Any][source]

Get statistics about the loaded Psychic bitmap.

Returns:: Dictionary with bitmap statistics
Return type:: dict
Raises:: RuntimeError if psychic is not enabled

query(query, size=None, scroll=None, exclude_raw=False, quick=False, exclude_fields: str | List[str] | None = None) → Dict[str, Any][source]

Run GNQL query.

Parameters:

query (str) – GNQL query
size (int) – Max number of results to return
scroll (str) – Scroll token for pagination
exclude_raw (bool) – Whether to exclude raw results
quick (bool) – Whether to use quick lookup
exclude_fields (str or list[str]) – Field names to exclude; comma-separated string or list of strings (sent to the API as the exclude query parameter).

quick(ip_addresses: str | List[str], include_invalid: bool = False) → List[Dict[str, Any]][source]

Get activity associated with one or more IP addresses.

Args:: ip_addresses: One or more IP addresses to look up include_invalid: Whether to include invalid IPs in results
Returns:: List of results for each IP address

recall(query=None, start=None, end=None, format='json', limit=None, offset=None)[source]

Get Recall data for a given query

Parameters:

query (str) – Query to use in the look-up.
start (str or datetime or None) – Start of the time range (RFC 3339 after normalization).
end (str or datetime or None) – End of the time range (RFC 3339 after normalization).
format (str) – Format to return the data in.
limit (int) – Limit the number of results returned.
offset – Offset the results returned.

recall_stats(query=None, start=None, end=None, format='json', interval='hour')[source]

Get Recall data for a given query

Parameters:

query (str) – Query to use in the look-up.
interval (str) – Interval to group the data by.

Make a request to the GreyNoise API.

Args:

endpoint: API endpoint to request method: HTTP method to use params: URL parameters to include json: JSON data to include files: Files to include headers: Extra headers merged after defaults (User-Agent, key).

If omitted, Accept: application/json is set for typical API use.

proxy: Proxy URL to use for the request

Returns:

Parsed JSON (dict), or raw response body (str) for non-JSON responses.

riot(ip_address)[source]

Check if IP is in RIOT data set

Parameters:: ip_address (str) – IP address to use in the look-up.
Returns:: Context for the IP address.
Return type:: dict

sensor_activity(workspace_id, file_format=None, start_time=None, end_time=None, persona_id=None, source_ip=None, size=None, scroll=None, include_headers=False)[source]: Get session data from sensors

sensor_activity_ips(workspace_id, file_format=None, start_time=None, end_time=None, persona_id=None, source_ip=None, size=None, scroll=None)[source]: Collect distinct source_ip values from sensor activity rows.

sensor_list(workspace_id=None)[source]

Get list of current sensors for Workspace

Parameters:: workspace_id (str) – ID of Workspace

similar(ip_address, limit=None, min_score=None)[source]

Query IP on the IP Similarity API

Parameters:

ip_address (str) – IP address to use in the look-up.
limit (str) – Limit the number of matches returned by the endpoint
limit – Limit the number of matches returned by the endpoint

Returns:

Context for the IP address.

Return type:

dict

stats(query, count=None)[source]: Run GNQL stats query.

tags(name: str | None = None, slug: str | None = None, cve: str | None = None) → Dict[str, Any][source]

List tags and tag metadata (GET /v3/tags).

Optional query filters match the API: partial name, exact slug, and cve (CVE ID associated with a tag).

Parameters:

name – Filter by tag name (partial match).
slug – Filter by slug (exact match).
cve – Filter by associated CVE ID.

Returns:

API JSON body, or a dict with message for Community offering.

test_connection()[source]: Test the API connection and API key.

timeline(ip_address, field='classification', days=None, granularity=None)[source]

Query IP on the IP TimeSeries API

Parameters:

ip_address (str) – IP address to use in the look-up.
field (str) – field name to use to retrieve timeline information
days (int) – Number of days to show data for
granularity (str) – Granularity of activity date ranges

Returns:

Context for the IP address.

Return type:

dict

timelinedaily(ip_address, days=30)[source]

Query IP on the IP TimeSeries API

Parameters:

ip_address (str) – IP address to use in the look-up.
cursor (str) – The cursor is a pointer from which to start returning results up to the limit
days (int) – Number of days to show data for
limit (str) – The total number of events to return in the response

Returns:

Context for the IP address.

Return type:

dict

timelinehourly(ip_address, days=None, cursor=None, limit=100)[source]

Query IP on the IP TimeSeries API

Parameters:

ip_address (str) – IP address to use in the look-up.
cursor (str) – The cursor is a pointer from which to start returning results up to the limit
days (int) – Number of days to show data for
limit (str) – The total number of events to return in the response

Returns:

Context for the IP address.

Return type:

dict

greynoise.api._api_request_url(api_server: str | None, endpoint: str) → str[source]: Build an absolute request URL from api_server and path endpoint.

greynoise.api.initialize_cache(cache_max_size, cache_ttl)[source]: A function to initialize cache

greynoise.cli

GreyNoise command line Interface.

greynoise.cli.formatter

Output formatters.

greynoise.cli.formatter._normalize_recall_payload(result)[source]: Recall endpoints may return a bare list; wrap for templates.

greynoise.cli.formatter.analyze_formatter(result, verbose)[source]: Conver analyze result into human-readable text.

greynoise.cli.formatter.callback_ip_formatter(result, verbose)[source]: Format Callback IP lookup for the terminal.

greynoise.cli.formatter.colored_output(function)[source]

Decorator that converts ansi markup into ansi escape sequences.

Parameters:: function (callable) – Function that will return text using ansi markup.
Returns:: Wrapped function that converts markup into escape sequences.
Return type:: callable

greynoise.cli.formatter.cvedetails_formatter(results, verbose)[source]: Convert CVE Details to human-readable text.

greynoise.cli.formatter.get_location(metadata)[source]: Get location from ip context metadata.

greynoise.cli.formatter.gnql_query_formatter(results, verbose)[source]: Convert GNQL query result into human-readable text.

greynoise.cli.formatter.gnql_stats_formatter(results, verbose)[source]: Convert GNQL stats result into human-readable text.

greynoise.cli.formatter.ip_context_formatter(results, verbose)[source]: Convert IP context result into human-readable text.

greynoise.cli.formatter.ip_multi_context_formatter(results, verbose)[source]: Convert IP multi context result into human-readable text.

greynoise.cli.formatter.ip_quick_check_formatter(results, verbose)[source]: Convert IP quick check result into human-readable text.

greynoise.cli.formatter.json_formatter(result, _verbose)[source]: Format result as json.

greynoise.cli.formatter.personadetails_formatter(results, verbose)[source]: Convert Persona Details to human-readable text.

greynoise.cli.formatter.recall_stats_formatter(result, verbose)[source]: Format Recall stats API payload for the terminal.

greynoise.cli.formatter.recall_timeseries_formatter(result, verbose)[source]: Format Recall time-series API payload for the terminal.

greynoise.cli.formatter.sensorlist_formatter(results, verbose)[source]: Convert Sensor List to human-readable text.

greynoise.cli.formatter.timeline_formatter(results, verbose)[source]: Convert Timeline to human-readable text.

greynoise.cli.formatter.timelinedaily_formatter(results, verbose)[source]: Convert Timeline hourly/daily to human-readable text.

greynoise.cli.formatter.xml_formatter(result, _verbose)[source]: Format result as xml.

greynoise.cli.parameter

Command line parameter types.

greynoise.cli.parameter.ip_addresses_parameter(_context, _parameter, values)[source]

IPv4 addresses passed from the command line.

Parameters:: values – IPv4 address values
Raises:: click.BadParameter – when any IP address value is invalid

greynoise.cli.subcommand

Command implementation.

greynoise.cli.subcommand._standard_cli_options(function)[source]: Standard API key, offering, I/O, format, verbose (matches GNQL/CVE commands).

greynoise.util

Utility functions.

greynoise.util._format_datetime_rfc3339_utc(dt)[source]: Format a datetime as an RFC 3339 instant in UTC (suffix Z).

greynoise.util._omit_empty_optional_config_options(config_parser)[source]: Remove optional greynoise keys whose value is blank.

greynoise.util.load_config()[source]

Load configuration.

Returns:: Current configuration based on configuration file and environment variables.
Return type:: dict

greynoise.util.load_template(template_name: str) → str[source]

Load a template from the templates directory.

Args:: template_name: Name of the template to load
Returns:: Template content as a string

greynoise.util.normalize_rfc3339_datetime(value)[source]

Parse value into an RFC 3339 / ISO 8601 string in UTC, or return None.

Used for API parameters (e.g. Recall start / end) that require RFC 3339.

Accepts:

None → None
datetime (naive values are treated as UTC)
date → midnight UTC on that date
Unix timestamp as int or float (seconds since epoch, UTC)
Strings: RFC 3339 / ISO 8601 (including Z), YYYY-MM-DD, or YYYY-MM-DD HH:MM:SS (optional fractional seconds; naive → UTC)

Parameters:

value – Raw start/end time from the caller

Returns:

Normalized string or None

Raises:

TypeError – if value has an unsupported type
ValueError – if a string cannot be parsed

greynoise.util.save_config(config)[source]

Save configuration.

Merges into the existing file when present so keys not passed in config (e.g. psychic_model) are preserved.

Parameters:: config (dict) – Data to be written to the configuration file.

greynoise.util.validate_cve_id(cve_id)[source]

Check if provided value is a valid CVE ID

Parameters:: cve_id (str) – field value to validate.

greynoise.util.validate_ip(ip, strict=True, print_warning=True)[source]

Check if the IPv4 address is valid.

Parameters:

ip_address (str) – IPv4 address value to validate.
strict (bool) – Whether to raise exception if validation fails.

Raises:

ValueError – When validation fails and strict is set to True.
ValueError – By default, otherwise returns nothing

greynoise.util.validate_similar_min_score(min_score)[source]

Check if the Similarity min_score value is valid.

Parameters:: min_score (str) – field value to validate.

greynoise.util.validate_timeline_days(days)[source]

Check if the Timeline Days value is valid.

Parameters:: days (str) – field value to validate.

greynoise.util.validate_timeline_field_value(field)[source]

Check if the Timeline Field value is valid.

Parameters:: field (str) – field value to validate.

greynoise.util.validate_timeline_granularity(granularity)[source]

Check if the Timeline granularity value is valid.

Parameters:: granularity (str) – field value to validate.

CLI

greynoise

GreyNoise CLI.

Usage

greynoise [OPTIONS] COMMAND [ARGS]...

analyze

Analyze the IP addresses in a log file, stdin, etc.

Usage

greynoise analyze [OPTIONS]

Options

-k, --api-key <api_key>: Key to include in API requests

-i, --input <input_file>: Input file

-o, --output <output_file>: Output file

-f, --format <output_format>

Output format

Options:: json | txt | xml

-v, --verbose: Verbose output

callback

GreyNoise Callback — scanner callback intelligence (Enterprise).

Usage

greynoise callback [OPTIONS] COMMAND [ARGS]...

ip

Look up Callback intelligence for one IP.

Usage

greynoise callback ip [OPTIONS] IP_ADDRESS

Options

--source-workspace <source_workspace>

Filter results to this source workspace (or ‘all’)

Default:: 'all'

-k, --api-key <api_key>: Key to include in API requests

-O, --offering <offering>: Which API offering to use, enterprise or community, defaults to enterprise

-i, --input <input_file>: Input file

-o, --output <output_file>: Output file

-f, --format <output_format>

Output format

Options:: json | txt | xml

-v, --verbose: Verbose output

Arguments

IP_ADDRESS: Required argument

cve

Retrieve Details of a CVE.

Usage

greynoise cve [OPTIONS] CVE_ID

Options

-k, --api-key <api_key>: Key to include in API requests

-O, --offering <offering>: Which API offering to use, enterprise or community, defaults to enterprise

-i, --input <input_file>: Input file

-o, --output <output_file>: Output file

-f, --format <output_format>

Output format

Options:: json | txt | xml

-v, --verbose: Verbose output

Arguments

CVE_ID: Required argument

filter

Filter the noise from a log file, stdin, etc.

Usage

greynoise filter [OPTIONS]

Options

-k, --api-key <api_key>: Key to include in API requests

-i, --input <input_file>: Input file

-o, --output <output_file>: Output file

--noise-only: Select lines containing noisy addresses

--riot-only: Select lines containing RIOT addresses

help

Show this message and exit.

Usage

greynoise help [OPTIONS]

ip

Query GreyNoise for all information on a given IP.

Usage

greynoise ip [OPTIONS] [IP_ADDRESS]...

Options

-k, --api-key <api_key>: Key to include in API requests

-O, --offering <offering>: Which API offering to use, enterprise or community, defaults to enterprise

-i, --input <input_file>: Input file

-o, --output <output_file>: Output file

-f, --format <output_format>

Output format

Options:: json | txt | xml

-v, --verbose: Verbose output

-p, --psychic: Use Psychic to get more information

Arguments

IP_ADDRESS: Optional argument(s)

ip-multi

Perform Context lookup for multiple IPs at once.

Example: greynoise ip-multi 1.1.1.1 2.2.2.2 3.3.3.3

Example: greynoise ip-multi 1.1.1.1,2.2.2.2,3.3.3.3

Example: greynoise ip-multi -i <filename>

Usage

greynoise ip-multi [OPTIONS] [IP_ADDRESS]...

Options

-k, --api-key <api_key>: Key to include in API requests

-O, --offering <offering>: Which API offering to use, enterprise or community, defaults to enterprise

-i, --input <input_file>: Input file

-o, --output <output_file>: Output file

-f, --format <output_format>

Output format

Options:: json | txt | xml

Arguments

IP_ADDRESS: Optional argument(s)

persona-details

Retrieve Details of a Sensor Persona.

Usage

greynoise persona-details [OPTIONS] PERSONA_ID

Options

-k, --api-key <api_key>: Key to include in API requests

-O, --offering <offering>: Which API offering to use, enterprise or community, defaults to enterprise

-i, --input <input_file>: Input file

-o, --output <output_file>: Output file

-f, --format <output_format>

Output format

Options:: json | txt | xml

-v, --verbose: Verbose output

Arguments

PERSONA_ID: Required argument

psychic-download

Download a Psychic bitmap (.bin), MMDB, or CSV file to the current directory.

Usage

greynoise psychic-download [OPTIONS]

Options

-f, --format <file_format>

Required Psychic file format to download (default: bin)

Options:: bin | mmdb | csv

-d, --date <date>: Date in YYYY-MM-DD format (default: today)

-m, --model <model>

Psychic model to use (default: from config or 1)

Options:: 1 | 2 | 3

-k, --api-key <api_key>: Key to include in API requests

-O, --offering <offering>: Which API offering to use, enterprise or community, defaults to enterprise

psychic-generate

Generate a Psychic bitmap (.bin) for a date range and write it to the current directory.

Usage

greynoise psychic-generate [OPTIONS]

Options

-s, --start-date <start_date>: Required Start date in YYYY-MM-DD format

-e, --end-date <end_date>: Required End date in YYYY-MM-DD format

-m, --model <model>

Psychic model to use (default: from config or 1)

Options:: 1 | 2 | 3

-k, --api-key <api_key>: Key to include in API requests

-O, --offering <offering>: Which API offering to use, enterprise or community, defaults to enterprise

query

Run a GNQL (GreyNoise Query Language) query.

Usage

greynoise query [OPTIONS] [QUERY]

Options

--size <size>: Max number of results to return

--scroll <scroll>: Scroll token for pagination

-k, --api-key <api_key>: Key to include in API requests

-O, --offering <offering>: Which API offering to use, enterprise or community, defaults to enterprise

-i, --input <input_file>: Input file

-o, --output <output_file>: Output file

-f, --format <output_format>

Output format

Options:: json | txt | xml

-v, --verbose: Verbose output

--exclude <exclude_fields>: Comma-separated fields to omit from GNQL results (API exclude param).

Arguments

QUERY: Optional argument

quick

Quickly check whether or not one or many IPs are “noise”.

Usage

greynoise quick [OPTIONS] [IP_ADDRESS]...

Options

-k, --api-key <api_key>: Key to include in API requests

-O, --offering <offering>: Which API offering to use, enterprise or community, defaults to enterprise

-i, --input <input_file>: Input file

-o, --output <output_file>: Output file

-f, --format <output_format>

Output format

Options:: json | txt | xml

Arguments

IP_ADDRESS: Optional argument(s)

recall

GreyNoise Recall — GNQL activity over time.

Usage

greynoise recall [OPTIONS] COMMAND [ARGS]...

stats

Return aggregated Recall stats for a GNQL query.

Usage

greynoise recall stats [OPTIONS] QUERY

Options

--start <start>: Range start (RFC 3339 or supported datetime)

--end <end>: Range end (RFC 3339 or supported datetime)

--api-format <api_format>

Recall API format parameter

Default:: 'json'

--interval <interval>

Aggregation interval for recall stats

Default:: 'hour'

-k, --api-key <api_key>: Key to include in API requests

-O, --offering <offering>: Which API offering to use, enterprise or community, defaults to enterprise

-i, --input <input_file>: Input file

-o, --output <output_file>: Output file

-f, --format <output_format>

Output format

Options:: json | txt | xml

-v, --verbose: Verbose output

Arguments

QUERY: Required argument

timeseries

Return Recall time series for a GNQL query.

Usage

greynoise recall timeseries [OPTIONS] QUERY

Options

--start <start>: Range start (RFC 3339 or supported datetime)

--end <end>: Range end (RFC 3339 or supported datetime)

--api-format <api_format>

Recall API format parameter

Default:: 'json'

--limit <limit>: Max rows to return

--offset <offset>: Pagination offset

-k, --api-key <api_key>: Key to include in API requests

-O, --offering <offering>: Which API offering to use, enterprise or community, defaults to enterprise

-i, --input <input_file>: Input file

-o, --output <output_file>: Output file

-f, --format <output_format>

Output format

Options:: json | txt | xml

-v, --verbose: Verbose output

Arguments

QUERY: Required argument

repl

Start an interactive shell. All subcommands are available in it.

param old_ctx:: The current Click context.
param prompt_kwargs:: Parameters passed to prompt_toolkit.PromptSession().

If stdin is not a TTY, no prompt will be printed, but only commands read from stdin.

Usage

greynoise repl [OPTIONS]

sensor-list

Retrieve list of current Sensors in Workspace.

Usage

greynoise sensor-list [OPTIONS] WORKSPACE_ID

Options

-k, --api-key <api_key>: Key to include in API requests

-O, --offering <offering>: Which API offering to use, enterprise or community, defaults to enterprise

-i, --input <input_file>: Input file

-o, --output <output_file>: Output file

-f, --format <output_format>

Output format

Options:: json | txt | xml

-v, --verbose: Verbose output

Arguments

WORKSPACE_ID: Required argument

setup

Configure API client.

Usage

greynoise setup [OPTIONS]

Options

-k, --api-key <api_key>: Required Key to include in API requests

-O, --offering <offering>: Which API offering to use, enterprise or community, defaults to enterprise

-t, --timeout <timeout>: API client request timeout

-s, --api-server <api_server>: API server

-p, --proxy <proxy>: Proxy URL

--cache-max-size <cache_max_size>: Maximum size of the cache

--cache-ttl <cache_ttl>: Cache time-to-live in seconds

stats

Get aggregate stats from a given GNQL query.

Usage

greynoise stats [OPTIONS] [QUERY]

Options

--size <size>: Max number of results to return

--scroll <scroll>: Scroll token for pagination

-k, --api-key <api_key>: Key to include in API requests

-O, --offering <offering>: Which API offering to use, enterprise or community, defaults to enterprise

-i, --input <input_file>: Input file

-o, --output <output_file>: Output file

-f, --format <output_format>

Output format

Options:: json | txt | xml

-v, --verbose: Verbose output

Arguments

QUERY: Optional argument

timeline

Query GreyNoise IP Timeline for events based on a single field.

Usage

greynoise timeline [OPTIONS] [IP_ADDRESS]...

Options

-k, --api-key <api_key>: Key to include in API requests

-O, --offering <offering>: Which API offering to use, enterprise or community, defaults to enterprise

-i, --input <input_file>: Input file

-o, --output <output_file>: Output file

-f, --format <output_format>

Output format

Options:: json | txt | xml

-v, --verbose: Verbose output

-d, --days <days>: Number of Days to display

-F, --field_name <field_name>: Field name to display data for

Arguments

IP_ADDRESS: Optional argument(s)

timelinedaily

Query GreyNoise IP Timeline to get daily event details.

Usage

greynoise timelinedaily [OPTIONS] [IP_ADDRESS]...

Options

-k, --api-key <api_key>: Key to include in API requests

-O, --offering <offering>: Which API offering to use, enterprise or community, defaults to enterprise

-i, --input <input_file>: Input file

-o, --output <output_file>: Output file

-f, --format <output_format>

Output format

Options:: json | txt | xml

-v, --verbose: Verbose output

-d, --days <days>: Number of Days to display

-F, --field_name <field_name>: Field name to display data for

Arguments

IP_ADDRESS: Optional argument(s)

version

Get version and OS information for your GreyNoise commandline installation.

Usage

greynoise version [OPTIONS]