Connectors

GreenSnow

Greensnow

Updated 2026-08-16

Automation Guide for Bloo

1. Overview

GreenSnow is a team consisting of the best specialists in computer security, who harvest a large number of IPs from different computers located around the world. GreenSnow is comparable with SpamHaus.org for attacks of any kind except for spam.

2. GreenSnow IP Feeds

Attacks and brute force attempts that are monitored are as follows:

Scan Port
FTP
POP3
mod_security
IMAP
SMTP
SSH
cPanel

3. Configuration

GreenSnow is a pre-configured integration in Bloo that stores its data as a dataset in an event store. This is a scheduled event store and can be used to fetch threat intel data for IP Addresses.

Follow the initial configuration steps in How to Configure Automation? — refer to the Bloo Knowledge Base.
Click the edit icon to add details.

Field	Description
GreenSnow IP Source	Enter the GreenSnow IP blocklist feed URL. The official GreenSnow feed URL is: https://blocklist.greensnow.co/greensnow.txt

Enter the above details and click Save.

4. Dataset Integrated with GreenSnow

Retrieve Threat Intel Data

Retrieve threat intel data for IP Addresses. GreenSnow is a pre-configured integration in Bloo that stores its data as a dataset in an event store. This is a scheduled event store and can be used to fetch threat intel data for IP Addresses. The GreenSnow IP blocklist is automatically updated.

Function name: import_ip_intel

Input

_retrieve list

The above query retrieves a list of all the existing event stores. The output is as shown below:

Output

_retrieve query greensnow

In the pipelined query function, the _retrieve directive calls the import_ip_intel function of the GreenSnow plugin, to fetch threat intel data for IP Addresses. The output is as shown below:

Output Structure

Field	Description
EvtType	An IP/Domain
ThreatType	Bloo Feed Identification Name
IntelURL	Feed URL
IntelReference	Feed Name

Was this page helpful?