Add support for GreyNoise API

[deehyeon]

I propose adding the GreyNoise API as a new data source in uncover.

This would allow users to find hosts based on their observed internet behavior (e.g., malicious scanning, CVE exploitation), which is a powerful complement to discovering assets based on open ports/services.

Proposed Implementation:

• Provider: greynoise
• Query: Accepts a GreyNoise Query Language (GNQL) string.
• Auth: Uses a GreyNoise API key from provider-config.yaml.
• Output: A list of IP addresses.

Relevant Links:

• API Docs: https://docs.greynoise.io/reference/get_v3-community-ip
• GNQL Docs: https://docs.greynoise.io/docs/using-the-greynoise-query-language-gnql

[dogancanbakir]

@deehyeon Thank you for opening this issue. I checked the community endpoint, but I couldn't find the query support(gnql) in it. Am I missing something?

[deehyeon]

Thanks for looking into this, @dogancanbakir

You are absolutely right. The GNQL search functionality is part of their Enterprise API, not the free Community API.

Many other data sources in uncover (like Shodan, Censys, etc.) also have paid tiers that unlock their full potential. I believe many users who would benefit from GreyNoise integration are likely to have enterprise subscriptions.

With that in mind, would you be open to accepting a contribution for GreyNoise integration, provided that we clearly document that it requires a paid Enterprise API key to use the GNQL search feature?

This would follow the same pattern as other integrations in the project. Let me know what you think!

[dogancanbakir]

@deehyeon, I assumed that the community edition supports GNQL based on what you shared, but never mind. Go ahead!