GreyNoise Intelligence · Schema

Session

A network session captured by GreyNoise sensors. Sessions contain network flow data, protocol details, and enrichment metadata. The full set of fields is dynamic and can be discovered via the `/v3/sessions/fields` endpoint.

SecurityThreat IntelligenceCybersecurityIP ReputationVulnerability ManagementNetwork TelemetrySOC AutomationPublic APIs

Properties

Name	Type	Description
_id	string	Unique session identifier.
firstPacket	string	Timestamp of the first packet in the session.
lastPacket	string	Timestamp of the last packet in the session.
source.ip	string	Source IP address.
source.port	integer	Source port number.
destination.ip	string	Destination IP address.
destination.port	integer	Destination port number.
source.bytes	integer	Total bytes sent from source.
source.packets	integer	Total packets sent from source.
destination.bytes	integer	Total bytes sent from destination.
destination.packets	integer	Total packets sent from destination.
classification	string	GreyNoise classification of the source IP.

View JSON Schema on GitHub

JSON Schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://api-evangelist.github.io/greynoise/json-schema/greynoise-session-schema.json",
  "title": "Session",
  "type": "object",
  "description": "A network session captured by GreyNoise sensors. Sessions contain network\nflow data, protocol details, and enrichment metadata. The full set of fields\nis dynamic and can be discovered via the `/v3/sessions/fields` endpoint.\n",
  "additionalProperties": true,
  "properties": {
    "_id": {
      "type": "string",
      "description": "Unique session identifier.",
      "example": "2505-abcdef123456"
    },
    "firstPacket": {
      "type": "string",
      "format": "date-time",
      "description": "Timestamp of the first packet in the session.",
      "example": "2025-01-15T10:30:00Z"
    },
    "lastPacket": {
      "type": "string",
      "format": "date-time",
      "description": "Timestamp of the last packet in the session.",
      "example": "2025-01-15T10:30:05Z"
    },
    "source.ip": {
      "type": "string",
      "description": "Source IP address.",
      "example": "203.0.113.45"
    },
    "source.port": {
      "type": "integer",
      "description": "Source port number.",
      "example": 54321
    },
    "destination.ip": {
      "type": "string",
      "description": "Destination IP address.",
      "example": "198.51.100.10"
    },
    "destination.port": {
      "type": "integer",
      "description": "Destination port number.",
      "example": 443
    },
    "source.bytes": {
      "type": "integer",
      "description": "Total bytes sent from source.",
      "example": 1024
    },
    "source.packets": {
      "type": "integer",
      "description": "Total packets sent from source.",
      "example": 10
    },
    "destination.bytes": {
      "type": "integer",
      "description": "Total bytes sent from destination.",
      "example": 2048
    },
    "destination.packets": {
      "type": "integer",
      "description": "Total packets sent from destination.",
      "example": 8
    },
    "classification": {
      "type": "string",
      "description": "GreyNoise classification of the source IP.",
      "example": "malicious"
    }
  }
}