lib/tasks/search_greynoise.rb
#search greynoise for malicious IPs and context
search greynoise for malicious IPs and context
search greynoise for malicious IPs and context
def search_greynoise entity_name,headers
    begin
      response = http_get_body("https://api.greynoise.io/v2/noise/context/#{entity_name}",nil, headers)
      result = JSON.parse(response)
      if result["seen"] == true
        if result["classification"] == "malicious"
          _create_linked_issue("suspicious_activity_detected",{
             status: "confirmed",
             classification: result["classification"],
             details: result
          })
      end
    end
    rescue JSON::ParserError => e
      _log_error "Unable to parse JSON: #{e}"
    end
  end
def search_greynoise entity_name , headers begin response = http_get_body ( "https://api.greynoise.io/v2/noise/context/#{entity_name}" , nil , headers ) result = JSON . parse ( response ) if result [ "seen" ] == true if result [ "classification" ] == "malicious" _create_linked_issue ( "suspicious_activity_detected" , { status : "confirmed" , classification : result [ "classification" ] , details : result } ) end end rescue JSON :: ParserError => e _log_error "Unable to parse JSON: #{e}" end end
search greynoise for malicious IPs and context
search greynoise for malicious IPs and context
#check if the ip exist in greynoise database or not
entity_name
headers