All use cases

Suspicious IP Investigation with Scanning History

This workflow investigates a suspicious IP address by retrieving baseline reputation, contextual intelligence, and a focused history of scanning activity. It gives analysts a structured view of the IP and its recent behavior without requiring separate lookups.

IP Analysis

Network threat

Investigation

Enrichment

Trigger

A suspicious IP address submitted for analysis through the investigation intake process.

Outcome

A set of IP reputation, contextual intelligence, and recent scanning-history results for the submitted address.

Trigger

A suspicious IP address submitted for analysis through the investigation intake process.

Outcome

A set of IP reputation, contextual intelligence, and recent scanning-history results for the submitted address.

Before

An analyst would likely run separate reputation, context, and scanning-history searches for each suspicious IP address. They would then compare the results across those lookups to build a basic investigation view, with the process depending on each request completing successfully.

How it works

Receive an IP address for investigation and start the sequential intelligence lookup.
Retrieve baseline reputation data and additional context for the same IP address.
Review a focused recent timeline summary of destination-port scanning activity alongside the other IP findings.

Workflow details

Trigger and scope: The workflow begins when an IP address is submitted for investigation, such as through the referenced intake form.
Baseline intelligence: It performs an initial reputation-oriented lookup to retrieve available RIOT information for the IP address.
Context enrichment: It then retrieves additional context for the same IP, extending the investigation beyond the initial lookup.
Historical analysis: The workflow requests a focused timeline field summary for destination-port activity, using the configured recent-period and result-limit settings to examine scanning behavior.
Completion behavior: The three lookups run in sequence, and the workflow stops if any service request fails, leaving the analyst with the available investigation results when all requests complete successfully.

What changed

Each submitted IP is automatically passed through three sequential intelligence lookups, including a recent scanning-history review, instead of requiring separate analyst searches and manual result assembly. A failed lookup stops the workflow rather than allowing the investigation to continue with incomplete automated results.

Work removed

Manually performing separate reputation, context, and scanning-history lookups; copying the IP address between searches; and assembling the returned findings into one investigation view.

Expected outcome

Up to three recurring lookup actions and the associated result-assembly step are removed for each investigated IP address.

Connected tools

GreyNoise

Related flows

All use cases

Explore more workflows with similar topics or tools.

Automated Security Alert Enrichment

This automation runs a complex query against Log Analytics to retrieve Azure Sentinel alerts or other security logs, converts the returned data into JSON, and uses it to update security alerts with additional information. It replaces a manual search-and-update process with a consistent enrichment workflow.

Explore use case

Automated Notable Event Status Updates

This automation receives notable security alerts, locates the corresponding notable event through a controlled search process, and updates its status with a comment in the security platform. It also monitors search completion and emails an administrator when the search fails.

Explore use case

Single-Session User Activity Investigation Reports

This automation investigates the actions performed during a single Azure Active Directory session after a suspicious event. It retrieves the relevant audit history, organizes key activity details into a Workbook, and shares the completed report back with the investigating team.

Explore use case

Less busywork. More possibility.

Let your agents handle the routine. Make room for what comes next.

Let’s talk