Third-party Data Context
Censys partners with several other data providers to give additional context on the scan data present in the Censys Platform to enable you to make more informed decisions during alert triage, incident response, and threat investigation. These partners include GreyNoise, IPinfo, Mallory, and Onionoo.
Context data is added to assets in the Platform and can be viewed and searched across in the web UI and via the API.
The contextual data described on this page is only available to Censys Core customers.
Contextual data in the UI
Contextual data for an asset is shown on the Enrichments and Raw Data tabs. See the provider-specific contextual information below to learn where this data is present in the Censys data schema.
Click the JSON tab to see enrichment data in JSON format.
Context data and reputation scores
Some context data from IPinfo is leveraged in host reputation score calculations.
There may be some hosts that have been tagged Malicious by GreyNoise or Mallory that have a Benign reputation score from Censys. This is because Censys prioritizes using its own data to calculate reputation scores.
Third-party data providers
GreyNoise
GreyNoise is a cybersecurity platform that collects and analyzes internet-wide scan and attack traffic. GreyNoise tags and classifications are available on hosts in the Censys Platform UI. While GreyNoise classification, actor, and observation timestamps are retrievable via the get host enrichment API, GreyNoise tags are not.
GreyNoise data in Censys
The following objects and fields contain GreyNoise contextual data.
| Field or object name | Description |
|---|---|
host.greynoise | The object containing GreyNoise data. |
host.greynoise.classification | The GreyNoise classification for the IP address. Values include unknown, benign, suspicious, and malicious. |
host.greynoise.actor | The actor that was observed. |
host.greynoise.tags.name | The GreyNoise tags for the IP address. GreyNoise tags are not retrievable via the get host enrichment API endpoint. |
host.greynoise.last_observed_time | When the host was last scanned by GreyNoise. |
IPinfo
IPinfo helps security teams understand and classify IP addresses with geolocation, ASN, privacy, and network intelligence. IPinfo data is used to give context on several components of the Censys Platform host dataset. IPinfo's Privacy Detection data is highlighted on the Enrichments tab in the Platform UI and displayed in the privacy data object on hosts.
IPinfo's privacy data contains information about whether a host features anonymization infrastructure like VPNs, proxies, relays, and Tor exit nodes.
IPinfo privacy data in Censys
IPinfo privacy data is contained in the host.privacy object.
IPinfo VPN, privacy, and Tor detections help determine whether anonymization infrastructure is present on a host for calculating reputation scores.
Mallory
Mallory is an AI-native threat intelligence aggregator that monitors global threat signals. Mallory data includes threat descriptions, verdicts, and sources.
Mallory data in Censys
Mallory data is not indexed and searchable in Censys but can be viewed on an enriched host and retrieved via the get host and get host enrichment API endpoints. Mallory data is contained in the third_party data object in API responses.
Onionoo
Onionoo is a Tor Project that provides structured data about current Tor relays and bridges so security teams can analyze Tor network statuses.
Onionoo data in Censys
Onionioo Tor data is contained in the host.privacy object.
Updated 3 days ago