greynoise_tag_timeline.py

import requests

# replace with CVE and GreyNoise API key
CVE = "CVE-2024-3273"
GN_API_KEY = "<GN_API_KEY>"

headers = {
    "accept": "application/json",
    "key": GN_API_KEY
}

# query the tags medadata endpoint to find the id for a tag by the CVE
tags_metadata_url = "https://api.greynoise.io/v2/meta/metadata"
cve_id = ""

tags_info = requests.get(tags_metadata_url, headers=headers).json()
for i in tags_info["metadata"]:
    if(CVE in i["cves"]):
        cve_id = i["id"]


# with the id for a tag query GreyNoise for the timeline of a tag
timeline_url = "https://api.greynoise.io/v3/tags/{}/activity?days=30&granularity=24h".format(cve_id)

response = requests.get(timeline_url, headers=headers).json()
for i in response["activity"]["malicious"]:
    print(i)


# query GreyNoise for IP's exploiting CVE
greynoise_query_url = "https://api.greynoise.io/v2/experimental/gnql?query=cve%3A{}&size=10000".format(CVE)
cve_details = requests.get(greynoise_query_url, headers=headers).json()
for i in cve_details["data"]:
    print(i["ip"])