n8n-nodes-greynoise

This is an n8n community node for GreyNoise threat intelligence. Query IP addresses to identify internet scanners, benign services, and malicious actors.

n8n is a fair-code licensed workflow automation platform.

Installation |
Operations |
Credentials |
Resources

Installation

Install via Settings > Community Nodes in n8n and search for n8n-nodes-greynoise.

See the n8n community nodes documentation for more details.

Operations

Community

• Community IP: Query IPs in the GreyNoise dataset (free, limited rate)

Enterprise

• CVE Lookup: Get vulnerability details for a CVE
• Multi-CVE Lookup: Bulk CVE lookup for up to 10,000 CVEs
• GNQL Query: Search the NOISE dataset using GreyNoise Query Language
• GNQL Stats: Get aggregate statistics for query results (top organizations, actors, tags, ASNs, countries, etc.)
• IP Lookup: Get IP enrichment data including metadata, tags, and activity
  • Optional Quick Mode for faster lookups with minimal response
• Multi-IP Lookup: Bulk IP lookup for up to 10,000 IPs
  • Optional Quick Mode for faster lookups with minimal response
• Tag Metadata: Get a list of all tags and their metadata

Credentials

You can use the GreyNoise Community API without authentication, however you will be limited in the number of requests you can send. For more requests or enterprise functionality, sign up for an account.

• API Key: Your GreyNoise API key

Compatibility

Tested with n8n v1.50+

Resources

• GreyNoise API Documentation
• GNQL Query Language
• GreyNoise Visualizer - Web interface and API key management
• n8n Community Nodes

License

MIT