GreyNoise Intelligence · JSON Structure
Greynoise Gnql Stats Structure
Type: object
Properties: 4
SecurityThreat IntelligenceCybersecurityIP ReputationVulnerability ManagementNetwork TelemetrySOC AutomationPublic APIs
GNQLStats is a JSON Structure definition published by GreyNoise Intelligence, describing 4 properties. It conforms to the https://json-structure.org/meta/core/v0/# meta-schema.
Properties
query
count
adjusted_query
stats
Meta-schema: https://json-structure.org/meta/core/v0/#
JSON Structure
{
"$schema": "https://json-structure.org/meta/core/v0/#",
"$id": "https://api-evangelist.github.io/greynoise/json-structure/greynoise-gnql-stats-structure.json",
"name": "GNQLStats",
"type": "object",
"properties": {
"query": {
"type": "string",
"description": "The GNQL query string the requester queried",
"example": "last_seen:2019-07-28 classification:malicious"
},
"count": {
"type": "int32",
"description": "The number of total results for the given GNQL query",
"example": 50000
},
"adjusted_query": {
"type": "string",
"description": "If the original query was adjusted due to plan limitations (for\nexample, the requested data reach was reduced), this field\ncontains the query that was actually executed. Empty when the\noriginal query was run unchanged.\n",
"example": "last_seen:2019-07-28 classification:malicious last_seen:7d"
},
"stats": {
"type": "object",
"properties": {
"classifications": {
"type": "array",
"description": "Most common classifications",
"items": {
"type": "object",
"properties": {
"classification": {
"type": "string",
"example": "malicious"
},
"count": {
"type": "int32",
"example": 5000
}
}
}
},
"spoofable": {
"type": "array",
"description": "Count of which are spoofable",
"items": {
"type": "object",
"properties": {
"spoofable": {
"type": "boolean",
"example": false
},
"count": {
"type": "int32",
"example": 5000
}
}
}
},
"organizations": {
"type": "array",
"description": "Most common organizations",
"items": {
"type": "object",
"properties": {
"organization": {
"type": "string",
"example": "DigitalOcean, LLC"
},
"count": {
"type": "int32",
"example": 5000
}
}
}
},
"actors": {
"type": "array",
"description": "Most common actors",
"items": {
"type": "object",
"properties": {
"actor": {
"type": "string",
"example": "Shodan.io"
},
"count": {
"type": "int32",
"example": 5000
}
}
}
},
"countries": {
"type": "array",
"description": "Most common countries (Same data as\nmetadata.source_countries. source_countries is preferred)\n",
"items": {
"type": "object",
"properties": {
"country": {
"type": "string",
"example": "United States"
},
"count": {
"type": "int32",
"example": 5000
}
}
}
},
"source_countries": {
"type": "array",
"description": "Most common source countries",
"items": {
"type": "object",
"properties": {
"country": {
"type": "string",
"example": "United States"
},
"count": {
"type": "int32",
"example": 5000
}
}
}
},
"destination_countries": {
"type": "array",
"description": "Most common destination countries",
"items": {
"type": "object",
"properties": {
"country": {
"type": "string",
"example": "United States"
},
"count": {
"type": "int32",
"example": 5000
}
}
}
},
"tags": {
"type": "array",
"description": "Most common tags",
"items": {
"type": "object",
"properties": {
"tag": {
"type": "string",
"example": "SSH Bruteforcer"
},
"id": {
"type": "uuid",
"description": "The unique identifier for the tag",
"example": "4c076d9c-be48-4bd1-bec4-6005e06c0f89"
},
"count": {
"type": "int32",
"example": 5000
}
}
}
},
"operating_systems": {
"type": "array",
"description": "Most common operating systems",
"items": {
"type": "object",
"properties": {
"operating_system": {
"type": "string",
"example": "Windows 7/8"
},
"count": {
"type": "int32",
"example": 5000
}
}
}
},
"categories": {
"type": "array",
"description": "Most common categories",
"items": {
"type": "object",
"properties": {
"category": {
"type": "string",
"example": "education"
},
"count": {
"type": "int32",
"example": 5000
}
}
}
},
"asns": {
"type": "array",
"description": "Most common ASNs",
"items": {
"type": "object",
"properties": {
"asn": {
"type": "string",
"example": "AS4134"
},
"count": {
"type": "int32",
"example": 5000
}
}
}
}
}
}
}
}Work with this as data
Every JSON Structure here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for json structure
4 MCP tools reach this
find_json_structuresBrowse and filter every JSON Structure in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This JSON Structure
curl "https://apis.io/api/v1/json-structures/greynoise-gnql-stats-structure"
All json structure
curl "https://apis.io/api/v1/json-structures?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.