Package: greynoise
Python GreyNoiseThis is an abstract python library built on top of theGreyNoiseservice. It is preferred that users use this library when implementing integrations or plan to use GreyNoise within their code. The library includes a small client to interact with the API.DocumentationDocumentation is available here:DocumentationQuick StartInstall the library:pip install greynoiseorpython setup.py installSave your configuration:greynoise setup--api-key<your-API-key>VersioningThis python package follows semantic versioning. According to this:We will NEVER push a breaking change without a major version release.We will only add new features and/or bug fixes with minor version releases.We will only do bug fixes for patch version release.As such, we recommend you pin the dependency on this SDK to only allow minor version changes at most:# allow patch version increments
greynoise~=1.4.0

# allow minor version increments
greynoise~=1.4UsageUsage: greynoise [OPTIONS] COMMAND [ARGS]...

  GreyNoise CLI.

Options:
  -h, --help  Show this message and exit.

Commands:
  account         View information about your GreyNoise account.
  alerts          List, create, delete, and manage your GreyNoise alerts.
  analyze         Analyze the IP addresses in a log file, stdin, etc.
  feedback        Send feedback directly to the GreyNoise team.
  filter          Filter the noise from a log file, stdin, etc.
  help            Show this message and exit.
  interesting     Report one or more IP addresses as "interesting".
  ip              Query GreyNoise for all information on a given IP.
  ip-multi        Perform Context lookup for multiple IPs at once.
  query           Run a GNQL (GreyNoise Query Language) query.
  quick           Quickly check whether or not one or many IPs are "noise".
  repl            Start an interactive shell.
  riot            Query GreyNoise IP to see if it is in the RIOT dataset.
  setup           Configure API key.
  signature       Submit an IDS signature to GreyNoise to be deployed to...
  similar         Query GreyNoise IP to identify Similar IPs.
  stats           Get aggregate stats from a given GNQL query.
  timeline        Query GreyNoise IP to identify Similar IPs.
  timelinehourly  Query GreyNoise IP to identify Similar IPs.
  version         Get version and OS information for your GreyNoise...ChangelogVersion2.1.0Date: February 07, 2024API client:NoneCLI:Fixed stats command display to show correct countriesFixed similar command to handle non-noise IP responseDependencies:Updated requests to version 2.31.0Updated cachetools to version 5.3.1Removed ipaddress as a required packageVersion2.0.1Date: April 14, 2023API client:Updated timeline commands to support 90 day lookback periodCLI:Updated timeline commands to support 90 day lookback periodDependencies:Updated ansimarkup to version 1.5.0Updated dict2xml to version 1.7.3Updated itertools to version 9.1.0Updated requests to version 2.28.2Version2.0.0Date: February 15, 2023BREAKING CHANGE:Removed support for python 3.5API client:Addedsimilarcommand to support IP Similarity lookupsAddedtimelinecommand to support IP Time Series Single Attribute lookupsAddedtimelinehourlycommand to support IP Time Series Hourly Summary lookupsAddedtimelinedailycommand to support IP Time Series Daily Summary lookupsAddedexclude_rawparameter to query command to reduce issues with default behavior in integrationsCLI:Addedsimilarcommand to support IP Similarity lookupsAddedtimelinecommand to support IP Time Series Single Attribute lookupsAddedtimelinehourlycommand to support IP Time Series Hourly Summary lookupsAddedtimelinedailycommand to support IP Time Series Hourly Summary lookupsDependencies:Updated dict2xml to version 1.7.2Updated colorama to version 0.4.6Updated cachetools to version 5.3.0Version1.3.0Date: September 07, 2022API client:Rework logging to remove structlog predefined logging to follow best practicesUpdate thequickcommand to use a POST API request instead of a GET API requestFix bug withip_multipreventing lists of more than 1000 entries from returning correct dataFix bug withip_multiwhen cache is disabled not returning correct valuesFix bug withip_multiwhereinclude_invalidparameter was not workingCLI:NoneDependencies:Updated Click to 8.1.3Updated colorama to 0.4.5Updated jinja2 to 3.1.2Updated more-itertools to 8.14.0Update requests to 2.28.1Removed structlogVersion1.2.1Date: June 03, 2022API client:NoneCLI:Add missing HASSH values to output for IP and QUERY commandsRemove unused PCAP commandDependencies:Update jinja to 3.1.0Update dict2xml to 1.7.1Update Click to 8.1.2Update more-itertools to 8.13.0Update cachetools to 5.2.0Version1.2.0Date: September 03, 2021API client:Add ip_multi command to support bulk IP Context lookupsFix issue with “include_invalid” option on quick command failing with “riot” key missingCLI:Add ip-multi command to support bulk IP Context lookupsAdd support for comma separated IP lists for ip-multi and quick commandsAdd size and scroll arguments for query and stats commandUpdate quick command to not error completely when non-routable IP is passed as an input in a listDependencies:Added colorama dependencyUpdate Click to 8.0.3Updated cachetools to 5.0.0Updated jinja to 3.0.3Updated more-itertools to 8.12.0Updated requests to 2.27.1Updated structlog to 21.5.0Version1.1.0Date: June 23, 2021API client:Update filter command to use new quick endpoint with noise/riot updatesUpdate analyze command to use new quick endpoint with noise/riot updatesCLI:Update quick command to handle quick endpoint noise/riot updatesAdd support for RIOT trust_level outputDependencies:Updated Click to 8.0.1Version1.0.0Date: June 02, 2021* Removed Support for Python2 - BREAKING CHANGE *API client:Fixed error handling for botherrorandmessageresponsesImplemented ipaddress package for IP validation to prevent non-routable IP addresses from being
sent for query to the APICLI:Updated warning messages to help identify invalid vs non-routable IPsDependencies:Updated cachetools to 4.2.2Updated six to 1.16.0Updated jinja2 to 3.0.1 for py36 and py37Updated click-repl to 0.2.0Updated more-itertools to 8.8.0Version0.9.1Date: May 05, 2021CLI:#465: Fixed error handling on expired API keyDependencies:Updated cachetools to 4.2.2Version0.9.0Date: April 21, 2021API client:Removed rouge debug statement from analysis commandCLI:Fixed query command to display text output for queries with more than 10k results
* Query now limits results to 10 on the text outputVersion0.8.0Date: March 26, 2021API client:Added support for Community APIAdded information about “integration_name” parameter to docsBREAKING CHANGEUpdated test_connection() to use /ping endpoint and return API response
message and exception instead of string valuesCLI:Added support for Community APIUpdated Analyze command to include RIOTChanged default behavior to no longer usequery.  Invalid commands return error nowDependencies:Updated cachetools to 4.2.1Updated jinja2 to 2.11.3Updated more-itertools to 8.7.0Update structlog to 21.1.0Version0.7.0Date: January 07, 2021API client:Add “include_invalid” option to QUICK lookup to return invalid IPs as part of the JSON responseAdded support for new /riot endpointUpdated logic in quick to better handle non-list format input (‘ip_1,ip_2’)instead of
[‘ip_1’,’ip_2’]Added ability to configure CACHE TTL and CACHE MAX SIZE instead of only using hardcoded defaultsCLI:Added support for new riot commandUpdated json_formatter for query commands to return data only as New Line Delimited JSONDependencies:Updated sphinx to 3.4.0Updated structlog to 20.2.0 for python 3.6 and 3.7Version0.6.0Date: December 21, 2020API client:Addedtest_connectionmethod to allow for integrations to validate connection and API keyCLI:Added spoofable and CVE outputs where possibleBoth API client and CLI:Fix IP_Validation method bug which was preventing valid IPs from being submittedVersion0.5.0Date: December 16, 2020API client:addmetadatamethod.replacedicttoxmlwithdict2xmlfor license-compatibility.Both API client and CLI:Update dependencies to the latest versionAdd support for PROXY usageUpdate the IP validator to ensure better validationVersion0.4.1Date: January 3, 2020API client:addspoofablefield.Version0.4.0Date: November 18, 2019API client:addinterestingmethod.addfiltermethod.addanalyzemethod.addscrollandsizeparameters toquerymethod.addapi_serverandintegration_nameparameters to__init__method.CLI:addinterestingsubcommand.addfiltersubcommand.addanalyzesubcommand.addapi_serveroption to setup subcommand.Both API client and CLI:
* use structlog logging library.Version0.3.0Date: September 06, 2019API client:rename API client methods to match CLI command names.use LRU cache for IP context and quick check calls.CLI:add help, repl and version subcommands.global options moved to those subcommands where they apply.make request timeout configurable.Version0.2.2Date: August 28, 2019CLI:fixsetupsubcommand when configuration directory doesn’t exist.Version0.2.1Date: August 28, 2019API clientVersion sent inUser-Agentheader.RaiseRateLimitErroron 429 response.CLIColored output.Add-i/--inputoption.Version0.2.0Date: August 21, 2019Complete codebase refactoring.