peerglass_threat_intel
Analyze IP addresses for security threats using Shodan and GreyNoise intelligence, identifying open ports, CVEs, malicious activity, and calculating risk scores.
Instructions
Passive threat intelligence for an IP address from two sources:
Shodan InternetDB (always available, no API key required):
Open ports detected via internet scanning
CVE identifiers for detected services
Reverse DNS hostnames
Shodan tags (cdn, vpn, tor-exit, etc.)
GreyNoise Community (requires GREYNOISE_API_KEY env var):
Classification: malicious / benign / unknown
RIOT flag: trusted service (Google, Amazon, etc.)
Noise flag: benign internet background scanner
Named actor or service attribution
Produces an aggregated risk score (0–100) and level (LOW / MEDIUM / HIGH / CRITICAL).
Args: params (ThreatIntelInput): - ip (str): IPv4 address (e.g. '1.2.3.4') - response_format (str): 'markdown' (default) or 'json'
Returns: str: Open ports, CVEs, GreyNoise classification, and risk assessment.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |