GreenSnow is a team consisting of the best specialists in computer security, who harvest a large number of IPs from different computers located around the world. GreenSnow is comparable with SpamHaus.org for attacks of any kind except for spam.
GreenSnow IP feeds
Attacks / bruteforce that are monitored are as follows:
- Scan Port
- FTP
- POP3
- mod_security
- IMAP
- SMTP
- SSH
- cPanel
Configuration
GreenSnow is a pre-configured integration in DNIF that stores its data as a dataset in an eventstore, this is a scheduled eventstore and can be used to fetch threat intel data for IP Addresses.
- Follow the initial configuration steps in How to Configure Automation?
- Click the edit icon to add details.
Field Description GreenSnow IP Source Enter valid IP Source - Enter the above details and click Save.
Dataset integrated with GreenSnow
Retrieve threat intel data
Retrieve threat intel data for IP Addresses. GreenSnow is a pre-configured integration in DNIF that stores its data as a dataset in an eventstore, this is a scheduled eventstore and can be used to fetch threat intel data for IP Addresses.
Function_name
import_ip_intel
Input
_retrieve list
Output
_retrieve query greensnow
The output is as shown below:
Output Structure
| Field | Description |
| EvtType | An IP/Domain |
| ThreatType | DNIF Feed Identification Name |
| IntelURL | Feed URL |
| IntelReference | Feed Name |