{"id":11223,"date":"2026-03-29T12:58:20","date_gmt":"2026-03-29T10:58:20","guid":{"rendered":"https:\/\/www.sigalou-domotique.fr\/?p=11223"},"modified":"2026-03-29T14:46:59","modified_gmt":"2026-03-29T12:46:59","slug":"je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant","status":"publish","type":"post","link":"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant","title":{"rendered":"I monitor the reputation of my public IP in Home Assistant"},"content":{"rendered":"<p>I spend a lot of time monitoring, securing and understanding what is happening on my home network. Between the internet box, the unintentionally exposed equipment and the permanent scans from the internet, I once wondered one simple thing: <strong>Is my public IP known as \u201cnoisy\u201d or suspicious on the internet?<\/strong><\/p>\n<p>That is, malicious tools use my network (pc, NAS, router, HA, \u2026) ??<\/p>\n<p>That\u2019s how I came across <a href=\"https:\/\/viz.greynoise.io\/\" target=\"_blank\" rel=\"noopener\">GreyNoise<\/a>, a really interesting service that makes it possible to know whether an IP address is part of the \u201cnoise\u201d of the Internet, i.e. whether it is observed in scanning, polling or malicious traffic activities.<\/p>\n<p>GreyNoise rightly describes its approach as a way to qualify the background noise of the Internet and contextualise an observed IP.<\/p>\n<p>And as often with me, after a few tests, I thought: \u201cWell, it would still be convenient to have this directly in Home Assistant\u201d.<\/p>\n<p>Initially, I thought I would do something very simple with a classic HTTP request. On paper, it seemed trivial. In practice, the most obvious method did not work for me as I had hoped. So I changed my approach and finally switched to a command line sensor. In this article, I tell you all this step by step, as I actually set it up at home, with the Lovelace cards for the final display.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11230\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-131124.png\" alt=\"\" width=\"459\" height=\"179\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-131124.png 459w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-131124-300x117.png 300w\" sizes=\"auto, (max-width: 459px) 100vw, 459px\" \/><\/p>\n<p><!--more--><\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-light-blue ez-toc-container-direction\">\n<label for=\"ez-toc-cssicon-toggle-item-6ae4fb24a5e5e\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewbox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewbox=\"0 0 24 24\" version=\"1.2\" baseprofile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6ae4fb24a5e5e\"  aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant\/#%F0%9F%8E%AF_Mon_objectif\" >\ud83c\udfaf My goal<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant\/#%F0%9F%A7%A0_GreyNoise_cest_quoi\" >What is \ud83e\udde0 GreyNoise?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant\/#%F0%9F%86%93_Les_outils_gratuits_GreyNoise\" >\ud83c\udd93 Free tools GreyNoise<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant\/#%F0%9F%A7%AA_Mon_premier_essai_dans_Home_Assistant\" >\ud83e\uddea My first try in Home Assistant<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant\/#%E2%8C%A8%EF%B8%8F_Pourquoi_je_suis_parti_sur_command_line\" >\u2328 _ Why I left on command line<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant\/#%E2%9A%99%EF%B8%8F_Configuration_dans_Home_Assistant\" >\u2699  Configuration in Home Assistant<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant\/#%F0%9F%A7%BE_Ce_que_le_capteur_me_remonte\" >\ud83e\uddfe What the Sensor Gets Me Back<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant\/#%F0%9F%93%8A_Mes_cartes_Lovelace\" >\ud83d\udcca My Lovelace Cards<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant\/#%F0%9F%8D%84_Carte_Mushroom\" >\ud83c\udf44 Map Mushroom<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant\/#%F0%9F%A7%AA_Cartes_fictives\" >\ud83e\uddea Fictitious Cards<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant\/#%F0%9F%8E%A8_Carte_Button_Card\" >\ud83c\udfa8 Button Card<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant\/#%F0%9F%93%9D_Carte_Markdown_recapitulative\" >\ud83d\udcdd Markdown Map Summary<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant\/#%F0%9F%A7%A9_Ce_que_jai_retenu_de_cette_integration\" >\ud83e\udde9 What I have learned from this integration<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant\/#%E2%9C%85_Conclusion\" >\u2705 Conclusion<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-la-reputation-de-mon-ip-publique-dans-home-assistant\/#%F0%9F%94%97_Pour_aller_plus_loin\" >\ud83d\udd17 To go further:<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%8E%AF_Mon_objectif\"><\/span>\ud83c\udfaf My goal<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>My objective was simple: integrate in Home Assistant a sensor capable of querying GreyNoise to find out the status of my public IP, and then display the result in a clear and readable dashboard.<\/p>\n<p>The idea was not to turn Home Assistant into an advanced cybersecurity centre, but rather to add a small context indicator.<\/p>\n<p>A quick glance was to let me know if my IP was seen as benign, unknown, or possibly related to more suspicious activity.<\/p>\n<p>GreyNoise sets out precisely this type of information via its public verification endpoint.<\/p>\n<p>I also wanted something understandable for a beginner: a sensor, some useful attributes, and nice cards to make all this readable without having to open a terminal and obviously without taking a subscription of anything and without registering me no.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%A7%A0_GreyNoise_cest_quoi\"><\/span>What is \ud83e\udde0 GreyNoise?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>When you discover GreyNoise for the first time, you may wonder what exactly it's for.<\/p>\n<p>In a very simple version, GreyNoise constantly observes the background noise of the Internet: automated scans, IP address surveys, repetitive login attempts, all these behaviours that are not necessarily visible to the naked eye but that exist permanently on the global network.<\/p>\n<p>GreyNoise presents its service as a means of distinguishing between substantive activity and genuinely significant traffic.<\/p>\n<p>GreyNoise\u2019s interest is that it makes it possible to contextualise an IP address. Basically, it is possible to know whether this IP is known to participate in this Internet noise, whether it is considered legitimate, or whether it is simply not known to their systems. Their public verification service returns this context in the form of JSON.<\/p>\n<p>When I understood this, I found the idea excellent for the house. We often have an internet box, sometimes port redirects, a VPN, remotely accessible equipment, and we don\u2019t always know how our IP is \u201cviewed\u201d from the outside.<\/p>\n<p>Without being a complete security tool, GreyNoise gives an interesting clue.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%86%93_Les_outils_gratuits_GreyNoise\"><\/span>\ud83c\udd93 Free tools GreyNoise<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11240\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-134347.png\" alt=\"\" width=\"751\" height=\"152\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-134347.png 751w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-134347-300x61.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-134347-600x121.png 600w\" sizes=\"auto, (max-width: 751px) 100vw, 751px\" \/><\/p>\n<p>What I liked is that you can already test things for free, without getting into a complicated integration right away.<\/p>\n<p>The first practical tool is their online verification page. The page is opened, and it directly indicates how the public IP used for navigation is viewed by GreyNoise.<\/p>\n<ul>\n<li><a href=\"https:\/\/check.labs.greynoise.io\/\" target=\"_blank\" rel=\"noopener\">https:\/\/check.labs.greynoise.io\/<\/a><\/li>\n<\/ul>\n<p>It is very convenient to do a first quick test, without installing anything.<\/p>\n<p>The other very interesting point is that there is a simple API to query. And it is precisely this API that I wanted to use in Home Assistant. At the command line, this amounts to making a request such as:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">curl -s -H \"Accept: application\/json\" https:\/\/check.labs.greynoise.io\/api\/v1\/check<\/pre>\n<p>In my case, the answer looked like this:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"json\">{ \"ip\": \"82.65.xxx.xxx\", \"status\": \"not _found\", \"classification\": null, \"noise\": false, \"common _business _services\": false, \"trust _level\": null, \"error\": \"ip not found\" }<\/pre>\n<p>This format corresponds well to the documented operation of the GreyNoise public service, which returns in particular the IP, the status, the classification, the indicator <code>noise<\/code>, the indicator <code>common_business_services<\/code>, the level of confidence and a possible error message.<\/p>\n<p>Simply put: my IP was not known by GreyNoise, which is rather reassuring in this context.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%A7%AA_Mon_premier_essai_dans_Home_Assistant\"><\/span>\ud83e\uddea My first try in Home Assistant<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>As is often the case, I started with the solution that seemed to me the most \u2018clean\u2019: use a REST sensor in Home Assistant.<\/p>\n<p>In principle, this was logical. I had an HTTP URL that returned JSON, so I figured a REST sensor would do just fine. The Home Assistant REST documentation allows precisely to define an HTTP resource, to read the JSON with <code>value_template<\/code> and retrieve fields as attributes with <code>json_ Attributes<\/code>.<\/p>\n<p>I thought I would directly retrieve the status and attributes like IP, classification or trust level.<\/p>\n<p>Except that in my case, this approach did not work properly. The sensor remained in an unusable state. Rather than wasting time on a method that did not give a stable result in my installation, I decided to switch to another solution.<\/p>\n<p>And honestly, this is often how it happens in home automation: We leave with an idea, then we adjust according to reality.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%E2%8C%A8%EF%B8%8F_Pourquoi_je_suis_parti_sur_command_line\"><\/span>\u2328 _ Why I left on command line<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>I finally chose to rely on a command line sensor. It is not necessarily the most \u201celegant\u201d method on paper, but in my case it has been much more reliable.<\/p>\n<p>The principle is simple: Home Assistant executes a command <code>curl<\/code>, retrieve the JSON response, then extract the main state and several attributes. Integration <code>_line Command<\/code> Home Assistant supports a shell command, a <code>value_template<\/code> and JSON attributes.<\/p>\n<p>In other words, I started from a test that was already working in my terminal and then I simply transposed it into Home Assistant.<\/p>\n<p>This is often a good strategy for beginners: When something is already working by hand, it's easier to figure out what's going on in Home Assistant.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%E2%9A%99%EF%B8%8F_Configuration_dans_Home_Assistant\"><\/span>\u2699  Configuration in Home Assistant<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>In my file <code>configuration.yaml<\/code>, I started by including a dedicated file for my command line sensors:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">command_line: !include command _line.yaml<\/pre>\n<p>Then, in <code>command_line.yaml<\/code>, I added this sensor:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">- sensor: name: \"GreyNoise IP Check\" unique _id: greynoise _ip _check icon: mdi:shield-search command: 'curl -s -H \"Accept: application\/json\" https:\/\/check.labs.greynoise.io\/api\/v1\/check' command_timeout: 20 scan_interval: 100800 value_template: \"{{value _json['status'] }}\" json _ attributes: - ip - classification - noise - common_business_services - trust_level - error<\/pre>\n<p>I will detail this very simply:<\/p>\n<ul>\n<li><strong>command<\/strong> : this is the command actually executed by Home Assistant.<\/li>\n<li><strong>_timeout Command<\/strong> : I allow up to 20 seconds before giving up.<\/li>\n<li><strong>scan_interval<\/strong> : this is the frequency of execution, in seconds. Here I chose 100800 seconds, so every 28 hours.<\/li>\n<li><strong>value_template<\/strong> : this recovers the main value of the sensor, here the field <code>status<\/code> JSON.<\/li>\n<li><strong>json_ Attributes<\/strong> : this allows other useful fields to be stored as sensor attributes.<\/li>\n<\/ul>\n<p>Why 28 hours? Simply because I did not need to interview GreyNoise every hour. And I want to avoid 24 hours because a lot of sensors are on 24, so it will be 28 hours today. It is not something that is constantly changing in me, so I prefer a spaced execution.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%A7%BE_Ce_que_le_capteur_me_remonte\"><\/span>\ud83e\uddfe What the Sensor Gets Me Back<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11248\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-143144.png\" alt=\"\" width=\"708\" height=\"242\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-143144.png 708w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-143144-300x103.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-143144-600x205.png 600w\" sizes=\"auto, (max-width: 708px) 100vw, 708px\" \/><\/p>\n<p>Once the sensor is operational, I recover a main state and several attributes.<\/p>\n<p>The main state is the field <code>status<\/code>. At home, for example, I get <code>not_found<\/code>. It is this value that becomes the sensor state in Home Assistant. The public endpoint GreyNoise returns this status field in its JSON response.<\/p>\n<p>Next to that, I have several useful attributes:<\/p>\n<ul>\n<li><strong>ip<\/strong> : the public IP address detected.<\/li>\n<li><strong>classification<\/strong> : the classification, if any.<\/li>\n<li><strong>noise<\/strong> : indicates whether the IP is considered to be part of the Internet noise.<\/li>\n<li><strong>common_business_services<\/strong> : indicates whether the IP is linked to known corporate services.<\/li>\n<li><strong>_level Trust<\/strong> : an additional indicator when available.<\/li>\n<li><strong>error<\/strong> : an information message, e.g. \u201cip not found\u201d.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%93%8A_Mes_cartes_Lovelace\"><\/span>\ud83d\udcca My Lovelace Cards<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Once the sensor was created, I especially wanted a nice display in the dashboard. So I made a small dedicated page with several cards to test the renders.<\/p>\n<p>I used both Mushroom, Button Card and a Markdown card. This allowed me to compare a more \u201csober\u201d style, a more \u201cvisual\u201d style, and a more \u201cinformative\u201d style.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%8D%84_Carte_Mushroom\"><\/span>\ud83c\udf44 Map Mushroom<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11227\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-130555.png\" alt=\"\" width=\"457\" height=\"115\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-130555.png 457w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-130555-300x75.png 300w\" sizes=\"auto, (max-width: 457px) 100vw, 457px\" \/><\/p>\n<p>The first card I made was a Mushroom card based on the actual sensor:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">Type: custom:mushroom-template-card entity: sensor.greynoise_ip_check primary: &gt; {% set c = state_attr(entity, 'classification') %} {% if c == 'malicious' %GreyNoise: malicious activity {% elif c == 'suspicious' %GreyNoise: suspicious activity {% elif c == 'benign' %GreyNoise: legitimate service {% elif states(entity) in ['not _found', 'unknown', 'unavailable'] %GreyNoise: no known activity {% else %GreyNoise: {{ states(entity) }} {% endif %} secondary: &gt; {% set ip = state_attr(entity, 'ip') or 'IP unknown' %} {% set classif = state_attr(entity, 'classification') or 'none' %} {% set noise = state_attr(entity, 'noise') %} {% set cbs = state_attr(entity, 'common_business_services') %} IP: {{ ip }} \u2022 Classification: {{classif }} \u2022 Noise: {{ noise }} \u2022 Known services: {{ cbs }} icon: &gt; {% set c = state_attr(entity, 'classification') %} {% if c == 'malicious' %mdi:shield-alert {% elif c == 'suspicious' %mdi:shield-search {% elif c == 'benign' %mdi:shield-check {% else %mdi:shield-check-outline {% endif %} icon_color: &gt; {% set c = state_attr(entity, 'classification') %} {% if c == 'malicious' %} red {% elif c == 'suspicious' %} orange {% elif c == 'benign' %} teal {% else %} green {% endif %Multiline _secondary: true fill_container: true tap_action: Action: more-info<\/pre>\n<p>I really like this card because it is easy to read. At a glance, I see a clear message, a suitable icon and a consistent colour.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%A7%AA_Cartes_fictives\"><\/span>\ud83e\uddea Fictitious Cards<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11230\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-131124.png\" alt=\"\" width=\"459\" height=\"179\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-131124.png 459w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-131124-300x117.png 300w\" sizes=\"auto, (max-width: 459px) 100vw, 459px\" \/><\/p>\n<p>To compare the states visually, I also created a few purely fictitious maps. This makes it possible to see what the different cases would look like without waiting for them to actually happen.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">Type: vertical-stack cards: - type: custom:mushroom-template-card primary: Fictif - mainly secondary: \"PI: 45.67.89.10 \u2022 noise \u2022 noise: true\" icon: mdi:shield-alert icon_color: red multiline _secondary: true - type: custom:mushroom-template-card primary: Fictif - benign secondary: \"PI: 1.1.1.1 \u2022 benign \u2022 noise: false\" icon: mdi:shield-check icon_color: teal multiline _secondary: true - type: custom:mushroom-template-card primary: Fictif - not found secondary: \"PI: 82.65.100.200 \u2022 not_found \u2022 noise: false\" icon: mdi:shield-check-outline icon_color: green multiline _secondary: true<\/pre>\n<p>It is stupid, but very useful when you build an interface: you can choose the style before you even have a real case.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%8E%A8_Carte_Button_Card\"><\/span>\ud83c\udfa8 Button Card<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11233\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-131446.png\" alt=\"\" width=\"468\" height=\"101\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-131446.png 468w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-131446-300x65.png 300w\" sizes=\"auto, (max-width: 468px) 100vw, 468px\" \/><\/p>\n<p>Then I wanted something more visual, almost like an alert card. So I used Button Card.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">Type: custom:button-card entity: sensor.greynoise_ip_check name: | [[const c = entity?.attributes?.classification; if (c === 'malicious') return 'GreyNoise - malicious activity'; if (c === 'suspicious') return 'GreyNoise - suspicious activity'; if (c === 'benign') return 'GreyNoise - legitimate service'; return 'GreyNoise - no known activity'; ]]] icon: | [[const c = entity?.attributes?.classification; if (c === 'malicious') return 'mdi:shield-alert'; if (c === 'suspicious') return 'mdi:shield-search'; if (c === 'benign') return 'mdi:shield-check'; return 'mdi:shield-check-outline'; ]]] show _state: true state_display: | [[[ return entity?.state || 'unknown'; ]]] Label: | [[ const ip = entity?.attributes?.ip || 'IP unknown'; const c = entity?.attributes?. || classification 'none'; const noise = entity?.attributes?.noise; const cbs = entity?.attributes?.common _business _services; return `IP ${ip} \u2022 ${c} \u2022 noise: ${noise} \u2022 common business: ${cbs}\u201c; ]]] show_label: true tap_action: Action: more-info styles: card: - padding: 18px - border-radius: 20px - color: white - background: | [[const c = entity?.attributes?.classification; if (c === 'malicious') return 'linear-gradient(135deg, #b71c1c 0%, #e53935 100%)'; if (c === 'suspicious') return 'linear-gradient(135deg, #ef6c00 0%, #ffa726 100%)'; if (c === 'benign') return 'linear-gradient(135deg, #00695c 0%, #26a69a 100%)'; return 'linear-gradient(135deg, #2e7d32 0%, #66bb6a 100%)'; ]]] grid: - grid-template-areas: \"\\\"i n\\\" \\\"i s\\\" \\\"l l\\\" - grid-template-columns: 60px 1fr - grid-template-rows: min-content min-content min-content icon: - width: 42px - color: white name: - justify-self: start - font-size: 18px - font-weight: 700 state: - justify-self: start - font-size: 15px - font-weight: 500 label: - justify-self: center - text-align: center - width: 100% - font-size: 13px - opacity: 0.92<\/pre>\n<p>This card is very nice, especially when you want something that is a little more eye-catching. I have also adjusted the bottom line so that it is centred, which really improves the rendering.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%93%9D_Carte_Markdown_recapitulative\"><\/span>\ud83d\udcdd Markdown Map Summary<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11235\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-131623.png\" alt=\"\" width=\"451\" height=\"332\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-131623.png 451w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/03\/Capture-decran-2026-03-29-131623-300x221.png 300w\" sizes=\"auto, (max-width: 451px) 100vw, 451px\" \/><\/p>\n<p>Finally, I added a Markdown card to display all the information in a legible way:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">Type: markdown content: &gt;- {% set e = 'sensor.greynoise _ip _check' %} ## Full GreyNoise report - **Status**: {{ states(e) }} - **IP**: {{ state_attr(e, 'ip') or 'unknown' }} - **Classification**: {{ state_attr(e, 'classification') or 'none' }} - **Internet noise**: {{state_attr(e, 'noise') }} - **Known services**: {{ state_attr(e, 'common_business_services') }} - **Trust level**: {{ state_attr(e, 'trust _level') or '--' }} - **Information message**: {{ state_attr(e, 'error') or 'none' }} --- - **Last execution of the request**: {{ relative _time(states[e].last _updated) }} - **Horodatage of last execution**: {{ as_local(states[e].last _updated).strftime('%d\/%m\/%Y %H:%M:%S') }}<\/pre>\n<p>I like this card because it is very clear, especially for diagnosis.<\/p>\n<p>In addition, I added the concept of time elapsed since the last update, which is useful to know when the request was actually executed.<\/p>\n<p>Properties <code>last_updated<\/code> and <code>last_changed<\/code> are well available in the Home Assistant template engine for this type of use.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%A7%A9_Ce_que_jai_retenu_de_cette_integration\"><\/span>\ud83e\udde9 What I have learned from this integration<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>This small project reminded me of something important: in home automation, the most important is not always the theoretically most elegant method, but the one that actually works reliably at home.<\/p>\n<p>Initially, I wanted to go on REST. Finally, it was the command-line sensor that allowed me to achieve a stable, readable and easy-to-maintain result. And frankly, for domestic use, that is exactly what I was looking for.<\/p>\n<p>I also realised that this type of integration has real pedagogical value. You learn how to retrieve JSON, create a Home Assistant sensor, exploit attributes, format a dashboard, and turn raw information into something visual and understandable.<\/p>\n<p>In the end, I used the Mushroom Card in a small corner of my dashboard, at a glance, I will see if the icon turns red.<\/p>\n<p>If the heart tells me, I can add the change of state of sensor.greynoise_ip_check in the triggers of any SMS or visual notifications \u2026<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%E2%9C%85_Conclusion\"><\/span>\u2705 Conclusion<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>With GreyNoise, I added in Home Assistant a small brick of network context that I find really interesting. It is not a miracle tool, nor a complete SDI, but it is a good indicator of how my public IP is perceived from the outside.<\/p>\n<p>I started by testing the online verification page, then the API query in terminal, then I tried the integration in Home Assistant. As the REST sensor was not conclusive in my case, I left on <code>_line Command<\/code>, and it was ultimately this method that did the job. The approach described is consistent with the documented capabilities of Home Assistant\u2019s REST and command_line integrations.<\/p>\n<p>In the end, I get a simple sensor, some useful attributes, and above all Lovelace cards that are pleasant to read. For me, this is exactly the kind of integration I like: a somewhat technical subject at first, but transformed into something concrete, visual and accessible on a daily basis.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%94%97_Pour_aller_plus_loin\"><\/span>\ud83d\udd17 To go further:<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><a href=\"https:\/\/viz.greynoise.io\/\" target=\"_blank\" rel=\"noopener\">https:\/\/viz.greynoise.io\/<\/a><\/li>\n<li><a href=\"https:\/\/check.labs.greynoise.io\/\" target=\"_blank\" rel=\"noopener\">https:\/\/check.labs.greynoise.io\/<\/a><\/li>\n<li><a href=\"https:\/\/ougier.net\/cyber-zombies-votre-routeur-est-il-un-soldat-pour-un-botnet\/\" target=\"_blank\" rel=\"noopener\">https:\/\/ougier.net\/cyber-zombies-votre-routeur-est-il-un-soldat-pour-un-botnet\/<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>I spend a lot of time monitoring, securing and understanding what is happening on my home network. Between the internet box, the unintentionally exposed equipment and the permanent scans from the internet, I once wondered one simple thing: Is my public IP known as \u201cnoisy\u201d or suspicious on [\u2026]<\/p>","protected":false},"author":1,"featured_media":11238,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[70,14,53],"tags":[],"class_list":["post-11223","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurite","category-domotique","category-home-assistant"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/posts\/11223","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/comments?post=11223"}],"version-history":[{"count":0,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/posts\/11223\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/media\/11238"}],"wp:attachment":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/media?parent=11223"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/categories?post=11223"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/tags?post=11223"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}