# Basic vs. Advanced

### Data Included with GreyNoise Basic Package <a href="#data-included-with-greynoise-basic-package" id="data-included-with-greynoise-basic-package"></a>

#### Noise Dataset <a href="#noise-dataset" id="noise-dataset"></a>

The following fields are included from the Noise dataset at no extra cost with **GreyNoise Basic**:

<table><thead><tr><th width="212.6153846153846">Noise Basic Field Name</th><th width="150">Field Type</th><th width="150">Example</th><th width="200">Noise Basic Field Description</th></tr></thead><tbody><tr><td><code>ip</code></td><td>string</td><td>1.2.3.4</td><td>IP address that information is about.</td></tr><tr><td><code>actor</code></td><td>string</td><td>unknown</td><td>The confirmed owner/operator of this IP address.</td></tr><tr><td><code>classification</code></td><td>string</td><td>unknown</td><td>IP Classification - possible options: benign, unknown, malicious.<br></td></tr><tr><td><code>last_seen</code></td><td>date</td><td>2022-09-19</td><td>Date of last observed behavior on the GreyNoise Sensor network (format: YYYY-MM-DD).</td></tr></tbody></table>

#### RIOT Dataset <a href="#riot-dataset" id="riot-dataset"></a>

The following fields are included from the RIOT dataset at no extra cost with **GreyNoise Basic**:

<table><thead><tr><th width="212.6153846153846">RIOT Basic Field Name</th><th width="150">Field Type</th><th width="150">Example</th><th width="200">RIOT Basic Field Description</th></tr></thead><tbody><tr><td><code>ip</code></td><td>string</td><td>8.8.8.8</td><td>IP address that information is about.</td></tr><tr><td><code>name</code></td><td>string</td><td>Google Public DNS</td><td>The name of the provider and/or service.</td></tr></tbody></table>

### Data Included with GreyNoise Advanced Package <a href="#data-included-with-greynoise-advanced-package" id="data-included-with-greynoise-advanced-package"></a>

#### Noise Dataset <a href="#noise-dataset-1" id="noise-dataset-1"></a>

The following fields are included from the Noise dataset with **GreyNoise Advanced**:

<table><thead><tr><th width="206.0912853786777">Noise Advanced Field Name</th><th width="117">Field Type</th><th width="173">Example</th><th width="200">Noise Advanced Field Description</th></tr></thead><tbody><tr><td><code>actor</code></td><td>string</td><td>unknown</td><td>The confirmed owner/operator of this IP address.</td></tr><tr><td><code>bot</code></td><td>boolean</td><td>false</td><td>Data Enrichment - IP is associated with known bot activity.</td></tr><tr><td><code>classification</code></td><td>string</td><td>unknown</td><td>IP Classification - possible options: benign, unknown, malicious.</td></tr><tr><td><code>cve</code></td><td>string list</td><td>[<br>"CVE-2021-38645",<br>"CVE-2021-38647"<br>]</td><td>List of CVEs the IP has been observed scanning for or exploiting</td></tr><tr><td><code>first_seen</code></td><td>date</td><td>2021-11-23</td><td>Date of first observed behavior on the GreyNoise Sensor network (format: YYYY-MM-DD).</td></tr><tr><td><code>ip</code></td><td>string</td><td>1.2.3.4</td><td>IP address that information is about</td></tr><tr><td><code>last_seen_timestamp</code></td><td>date</td><td>2021-12-31</td><td>Date of last observed behavior on the GreyNoise Sensor network (format: YYYY-MM-DD).</td></tr><tr><td><code>metadata</code></td><td>object</td><td><p>{</p><p>"asn": "AS37963",</p><p>"category": "hosting",</p><p>"city": "Hangzhou",</p><p>"country": "China",</p><p>"country_code": "CN",</p><p>"organization": "Hangzhou Alibaba Advertising Co.,Ltd.",</p><p>"os": "Linux 3.11+",</p><p>"rdns": "",</p><p>"region": "Zhejiang", "tor": false</p><p>}</p></td><td>Data Enrichment - Additional IP metadata.</td></tr><tr><td><code>metadata.asn</code></td><td>string</td><td>AS37963</td><td>Data Enrichment - IPs attached ASN.</td></tr><tr><td><code>metadata.category</code></td><td>string</td><td>hosting</td><td>Data Enrichment - IPs attached category.</td></tr><tr><td><code>metadata.city</code></td><td>string</td><td>Miami</td><td>Data Enrichment - IPs attached city.</td></tr><tr><td><code>metadata.country</code></td><td>string</td><td>United States</td><td>Data Enrichment - IPs attached country.</td></tr><tr><td><code>metadata.country_code</code></td><td>string</td><td>US</td><td>Data Enrichment - IPs attached country code.</td></tr><tr><td><code>metadata.organization</code></td><td>string</td><td>FranTech Solutions</td><td>Data Enrichment - IPs attached organization.</td></tr><tr><td><code>metadata.os</code></td><td>string</td><td>Linux 2.2-3.x</td><td>Data Enrichment - IPs attached operating system.</td></tr><tr><td><code>metadata.rdns</code></td><td>string</td><td>miamitor4.us</td><td>Data Enrichment - rDNS lookup for IP.</td></tr><tr><td><code>metadata.region</code></td><td>string</td><td>Florida</td><td>Data Enrichment - IPs attached region.</td></tr><tr><td><code>metadata.tor</code></td><td>boolean</td><td>true</td><td>Data Enrichment - IP is a known tor exit node.</td></tr><tr><td><code>raw_data</code></td><td>object</td><td>{<br>"hassh": [<br>{<br>"fingerprint": "a7a87fbe86774c2e40cc4a7ea2ab1b3c",<br>"port": 22<br>}<br>],<br>"ja3": [<br>{<br>"fingerprint": "19e29534fd49dd27d09234e639c4057e",<br>"port": 8443<br>}<br>],<br>"scan": [<br>{<br>"port": 22,<br>"protocol": "TCP"<br>}<br>],<br>"web": {<br>"paths": [<br>"/favicon.ico"<br>],<br>"useragents": [<br>"Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"<br>]<br>}<br>}</td><td>Observed Activity captured by the GreyNoise sensor network.</td></tr><tr><td><code>raw_data.hassh</code></td><td>object list</td><td>[<br>{<br>"fingerprint": "a7a87fbe86774c2e40cc4a7ea2ab1b3c",<br>"port": 22<br>}<br>]</td><td>Observed HAASH activity.</td></tr><tr><td><code>raw_data.hassh.fingerprint</code></td><td>string</td><td>a7a87fbe86774c2e40cc4a7ea2ab1b3c</td><td>HASSH Fingerprint captured.</td></tr><tr><td><code>raw_data.hassh.port</code></td><td>int</td><td>22</td><td>Port observed activity occurred on</td></tr><tr><td><code>raw_data.ja3</code></td><td>object list</td><td>[<br>{<br>"fingerprint": "19e29534fd49dd27d09234e639c4057e",<br>"port": 8443<br>}<br>]</td><td>Observed JA3 activity.</td></tr><tr><td><code>raw_data.ja3.fingerprint</code></td><td>string</td><td>19e29534fd49dd27d09234e639c4057e</td><td>JA3 Fingerprint captured</td></tr><tr><td><code>raw_data.ja3.port</code></td><td>int</td><td>8443</td><td>Port observed activity occurred on.</td></tr><tr><td><code>raw_data.scan</code></td><td>object list</td><td>[ { "port": 22, "protocol": "TCP" } ]</td><td></td></tr><tr><td><code>raw_data.scan.port</code></td><td>int</td><td>22</td><td>Port observed activity occurred on.</td></tr><tr><td><code>raw_data.scan.protocol</code></td><td>string</td><td>TCP</td><td>Protocol observed activity occurred on.</td></tr><tr><td><code>raw_data.web</code></td><td>object</td><td>{<br>"paths": [<br>"/favicon.ico"<br>],<br>"useragents": [<br>"Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"<br>]<br>}</td><td>Observed scanning activity occurred with these web objects.</td></tr><tr><td><code>raw_data.web.paths</code></td><td>string list</td><td><p>[ </p><p>"/favicon.ico"</p><p>]</p></td><td>Observed scanning activity traversed this web path.</td></tr><tr><td><code>raw_data.web.useragents</code></td><td>string list</td><td>[<br>"Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"<br>]</td><td>Observed scanning activity used these user agents.</td></tr><tr><td><code>spoofable</code></td><td>boolean</td><td>false</td><td>Did this IP complete a three-way handshake with the GreyNoise sensor network? If false, indicates that traffic <em>may</em> be spoofed.</td></tr><tr><td><code>tags</code></td><td>string list</td><td>[<br>"Carries HTTP Referer",<br>"Cobalt Strike SSH Client",<br>"Follows HTTP Redirects"<br>]</td><td>List of GreyNoise tags associated with the observed scanning behavior performed by this IP.</td></tr><tr><td><code>vpn</code></td><td>boolean</td><td>false</td><td>Data Enrichment - IP is a known VPN service IP.</td></tr><tr><td><code>vpn_service</code></td><td>string</td><td>PIA_VPN</td><td>If IP is a known VPN, the name of the associated VPN Service.</td></tr></tbody></table>

#### RIOT Dataset <a href="#riot-dataset-1" id="riot-dataset-1"></a>

The following fields are included from the RIOT dataset with **GreyNoise Advanced**:

<table><thead><tr><th width="212.6153846153846">RIOT Advanced Field Name</th><th width="150">Field Type</th><th width="150">Example</th><th>RIOT Advanced Field Description</th></tr></thead><tbody><tr><td><code>ip</code></td><td>string</td><td>8.8.8.8</td><td>IP address that information is about.</td></tr><tr><td><code>name</code></td><td>string</td><td>Google Public DNS</td><td>The name of the provider and/or service.</td></tr><tr><td><code>category</code></td><td>string</td><td>public_dns</td><td>The RIOT category the provider belongs to identifying the type of service provided.</td></tr><tr><td><code>description</code></td><td>string</td><td>Google's global domain name system (DNS) resolution service.</td><td>A description of the provider and what they do.</td></tr><tr><td><code>explanation</code></td><td>string</td><td>Public DNS services are used as alternatives to ISP's name servers. You may see devices on your network communicating with Google Public DNS over port 53/TCP or 53/UDP to resolve DNS lookups.</td><td>An explanation of the category type and what may be expected from this provider and category.</td></tr><tr><td><code>last_updated</code></td><td>datetime</td><td>2021-11-24T11:42:37Z</td><td>Date and time when this record was last updated from its source (format: YYYY-MM-DDTHH:MM:SSZ).</td></tr><tr><td><code>logo_url</code></td><td>string</td><td>https[:]//upload.wikimedia.org/wikipedia/<br>commons/2/2f/Google_2015_logo.svg</td><td>URL to a logo for the provider (unused in most cases and generally can be ignored/excluded).</td></tr><tr><td><code>reference</code></td><td>url</td><td>https[:]//developers.google.com/speed/<br>public-dns/docs/isp#alternative</td><td>Reference URL for information about this provider and/or service.</td></tr><tr><td><code>trust_level</code></td><td>string</td><td>1</td><td>GreyNoise defines the trust level assigned to this IP/provider. Additional information on trust levels can be found <a href="https://docs.greynoise.io/docs/understanding-greynoise-riot-trust-levels">here</a>.<br></td></tr></tbody></table>