GreyNoise Intelligence · Schema
GNQLStats
SecurityThreat IntelligenceCybersecurityIP ReputationVulnerability ManagementNetwork TelemetrySOC AutomationPublic APIs
Properties
| Name | Type | Description |
|---|---|---|
| query | string | The GNQL query string the requester queried |
| count | integer | The number of total results for the given GNQL query |
| adjusted_query | string | If the original query was adjusted due to plan limitations (for example, the requested data reach was reduced), this field contains the query that was actually executed. Empty when the original query |
| stats | object |
JSON Schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://api-evangelist.github.io/greynoise/json-schema/greynoise-gnql-stats-schema.json",
"title": "GNQLStats",
"type": "object",
"properties": {
"query": {
"type": "string",
"description": "The GNQL query string the requester queried",
"example": "last_seen:2019-07-28 classification:malicious"
},
"count": {
"type": "integer",
"description": "The number of total results for the given GNQL query",
"example": 50000
},
"adjusted_query": {
"type": "string",
"description": "If the original query was adjusted due to plan limitations (for\nexample, the requested data reach was reduced), this field\ncontains the query that was actually executed. Empty when the\noriginal query was run unchanged.\n",
"example": "last_seen:2019-07-28 classification:malicious last_seen:7d"
},
"stats": {
"type": "object",
"properties": {
"classifications": {
"type": "array",
"description": "Most common classifications",
"items": {
"type": "object",
"properties": {
"classification": {
"type": "string",
"example": "malicious"
},
"count": {
"type": "integer",
"example": 5000
}
}
}
},
"spoofable": {
"type": "array",
"description": "Count of which are spoofable",
"items": {
"type": "object",
"properties": {
"spoofable": {
"type": "boolean",
"example": false
},
"count": {
"type": "integer",
"example": 5000
}
}
}
},
"organizations": {
"type": "array",
"description": "Most common organizations",
"items": {
"type": "object",
"properties": {
"organization": {
"type": "string",
"example": "DigitalOcean, LLC"
},
"count": {
"type": "integer",
"example": 5000
}
}
}
},
"actors": {
"type": "array",
"description": "Most common actors",
"items": {
"type": "object",
"properties": {
"actor": {
"type": "string",
"example": "Shodan.io"
},
"count": {
"type": "integer",
"example": 5000
}
}
}
},
"countries": {
"type": "array",
"description": "Most common countries (Same data as\nmetadata.source_countries. source_countries is preferred)\n",
"items": {
"type": "object",
"properties": {
"country": {
"type": "string",
"example": "United States"
},
"count": {
"type": "integer",
"example": 5000
}
}
}
},
"source_countries": {
"type": "array",
"description": "Most common source countries",
"items": {
"type": "object",
"properties": {
"country": {
"type": "string",
"example": "United States"
},
"count": {
"type": "integer",
"example": 5000
}
}
}
},
"destination_countries": {
"type": "array",
"description": "Most common destination countries",
"items": {
"type": "object",
"properties": {
"country": {
"type": "string",
"example": "United States"
},
"count": {
"type": "integer",
"example": 5000
}
}
}
},
"tags": {
"type": "array",
"description": "Most common tags",
"items": {
"type": "object",
"properties": {
"tag": {
"type": "string",
"example": "SSH Bruteforcer"
},
"id": {
"type": "string",
"format": "uuid",
"description": "The unique identifier for the tag",
"example": "4c076d9c-be48-4bd1-bec4-6005e06c0f89"
},
"count": {
"type": "integer",
"example": 5000
}
}
}
},
"operating_systems": {
"type": "array",
"description": "Most common operating systems",
"items": {
"type": "object",
"properties": {
"operating_system": {
"type": "string",
"example": "Windows 7/8"
},
"count": {
"type": "integer",
"example": 5000
}
}
}
},
"categories": {
"type": "array",
"description": "Most common categories",
"items": {
"type": "object",
"properties": {
"category": {
"type": "string",
"example": "education"
},
"count": {
"type": "integer",
"example": 5000
}
}
}
},
"asns": {
"type": "array",
"description": "Most common ASNs",
"items": {
"type": "object",
"properties": {
"asn": {
"type": "string",
"example": "AS4134"
},
"count": {
"type": "integer",
"example": 5000
}
}
}
}
}
}
}
}Work with this as data
Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for schemas
4 MCP tools reach this
find_json_schemasBrowse and filter every JSON Schema in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This JSON Schema
curl "https://apis.io/api/v1/json-schemas/greynoise-gnql-stats"
All schemas
curl "https://apis.io/api/v1/json-schemas?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.