Shodan_v2

Shodan is a search engine for Internet-connected devices. Unlike traditional search engines that index websites, Shodan indexes information about the devices connected to the internet, such as servers, routers, webcams, and other IoT devices.

Configure Shodan v2 in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

search

Searches Shodan using facets to get summary information on properties.

Base Command

search

Input

Context Output

Command Example

!search query="country:HK org:RLL-HK -port:80 -port:443 -port:21 -port:25 has_ssl:false" using-brand=Shodan_v2

Context Example

{
    "Shodan": [
        {
            "Banner": {
                "Asn": "AS9311",
                "Domains": [],
                "Hostnames": [],
                "IP": "1.2.3.4",
                "Isp": "HITRON TECHNOLOGY INC.",
                "Location": {
                    "City": "Hong Kong",
                    "Country": "Hong Kong",
                    "Latitude": 22.27832,
                    "Longitude": 114.17469
                },
                "OS": null,
                "Org": "RLL-HK",
                "Port": 5353,
                "Ssl": {
                    "versions": []
                },
                "Timestamp": "2021-08-17T03:33:07.392394",
                "Transport": "udp"
            }
        },
        {
            "Banner": {
                "Asn": "AS9919",
                "Domains": [],
                "Hostnames": [],
                "IP": "1.2.3.4",
                "Isp": "New Century InfoComm Tech Co., Ltd.",
                "Location": {
                    "City": "Hong Kong",
                    "Country": "Hong Kong",
                    "Latitude": 22.27832,
                    "Longitude": 114.17469
                },
                "OS": null,
                "Org": "RLL-HK",
                "Port": 5353,
                "Ssl": {
                    "versions": []
                },
                "Timestamp": "2021-08-17T03:21:00.992437",
                "Transport": "udp"
            }
        },
        {
            "Banner": {
                "Asn": "AS9311",
                "Domains": [],
                "Hostnames": [],
                "IP": "1.2.3.4",
                "Isp": "HITRON TECHNOLOGY INC.",
                "Location": {
                    "City": "Hong Kong",
                    "Country": "Hong Kong",
                    "Latitude": 22.27832,
                    "Longitude": 114.17469
                },
                "OS": null,
                "Org": "RLL-HK",
                "Port": 5353,
                "Ssl": {
                    "versions": []
                },
                "Timestamp": "2021-08-17T03:13:54.617598",
                "Transport": "udp"
            }
        }
    ]
}

Human Readable Output

Search results for query “country:HK org:RLL-HK -port:80 -port:443 -port:21 -port:25 has_ssl:false” - page 1, facets: None

IP	Port	Timestamp
1.2.3.4	5353	2021-08-17T03:13:54.617598

ip

Returns all services that have been found on the IP address of the searched host.

Base Command

ip

Input

Context Output

Command Example

!ip ip="8.8.8.8" using-brand="Shodan_v2"

Context Example

{
    "IP": {
        "ASN": "AS15169",
        "Address": "8.8.8.8",
        "Geo": {
            "Country": "United States",
            "Location": "37.406,-122.078"
        },
        "Hostname": "dns.google",
        "Relationships": [
          {
            "EntityA": "8.8.8.8",
            "EntityAType": "IP",
            "EntityB": "CVE-2016-11111",
            "EntityBType": "CVE",
            "Relationship": "related-to"
          }
        ]
    },
    "Shodan": {
        "IP": {
            "ASN": "AS15169",
            "Address": "8.8.8.8",
            "CountryName": "United States",
            "ISP": "Google LLC",
            "LastUpdate": "2021-08-20T17:13:07.423800",
            "Latitude": 37.4056,
            "Longitude": -122.0775,
            "OS": null,
            "Org": "Google LLC",
            "Port": [
                53
            ],
            "Tag": [],
            "Vulnerabilities": ["CVE-2016-11111"]
        }
    },
    "DBotScore": {
        "Indicator": "8.8.8.8",
        "Score": 0,
        "Type": "ip",
        "Vendor": "Shodan_v2"
    }
}

Human Readable Output

Shodan details for IP 8.8.8.8

ASN	Country	Hostname	ISP	Location	Ports
AS15169	United States	dns.google	Google LLC	37.406,-122.078	53

shodan-search-count

Returns the total number of results that match only the specified query or facet settings. This command does not return host results. This command does not consume query credits.

Base Command

shodan-search-count

Input

Context Output

Command Example

!shodan-search-count query="country:HK product:Apache"

Context Example

{
    "Shodan": {
        "Search": {
            "ResultCount": 498645
        }
    }
}

Human Readable Output

498645 results for query “country:HK product:Apache”

shodan-scan-ip

Requests Shodan to crawl a network.

Base Command

shodan-scan-ip

Input

Context Output

Command Example

!shodan-scan-ip ips=8.8.8.8

Context Example

{
    "Shodan": {
        "Scan": {
            "ID": "wQEp0bIIEHklpAwa",
            "Status": "PROCESSING"
        }
    }
}

Human Readable Output

Scanning results for scan wQEp0bIIEHklpAwa

ID	Status
wQEp0bIIEHklpAwa	PROCESSING

shodan-scan-internet

Requests for Shodan to perform a scan on the specified port and protocol.

Base Command

shodan-scan-internet

Input

Context Output

Command Example

#### Human Readable Output

### shodan-scan-status

***
Checks the progress of a previously submitted scan request on the specified port and protocol.

#### Base Command

`shodan-scan-status`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| scanID | The unique ID of the initial scan. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Shodan.Scan.Id | String | The unique ID of the scan request checked for progress. |
| Shodan.Scan.Status | String | The status of the scan job checked for progress. |

#### Command Example

```!shodan-scan-status scanID=7rbp1CAtx91BMwcg```

#### Context Example

```json
{
    "Shodan": {
        "Scan": {
            "ID": "7rbp1CAtx91BMwcg",
            "Status": "DONE"
        }
    }
}

Human Readable Output

Scanning results for scan 7rbp1CAtx91BMwcg

ID	Status
7rbp1CAtx91BMwcg	DONE

shodan-create-network-alert

Creates a network alert for a defined IP address or netblock used for subscribing to changes or events that are discovered within the netblock’s range.

Base Command

shodan-create-network-alert

Input

Context Output

Command Example

!shodan-create-network-alert alertName="test_alert" ip="1.1.1.1"

Context Example

{
    "Shodan": {
        "Alert": {
            "Expires": 0,
            "ID": "CB68M776ICCMS36L"
        }
    }
}

Human Readable Output

Alert ID CB68M776ICCMS36L

Expires	IP	Name
0	1.1.1.1	test_alert

shodan-network-get-alert-by-id

Gets the details of a network alert.

Base Command

shodan-network-get-alert-by-id

Input

Context Output

Command Example

!shodan-network-get-alert-by-id alertID="0EKRH38BBQEHTQ3E"

Context Example

{
    "Shodan": {
        "Alert": {
            "Expires": 0,
            "ID": "0EKRH38BBQEHTQ3E"
        }
    }
}

Human Readable Output

Alert ID 0EKRH38BBQEHTQ3E

Expires	IP	Name
0	1.2.3.4	test_alert

shodan-network-get-alerts

Gets a list of all created network alerts.

Base Command

shodan-network-get-alerts

Input

There are no input arguments for this command.

Context Output

Command Example

#### Context Example

```json
{
    "Shodan": [
        {
            "Alert": {
                "Expires": 0,
                "ID": "0EKRH38BBQEHTQ3E"
            }
        },
        {
            "Alert": {
                "Expires": 0,
                "ID": "CB68M776ICCMS36L"
            }
        },
        {
            "Alert": {
                "Expires": 0,
                "ID": "HTWLPTVPUHN5VAGA"
            }
        },
        {
            "Alert": {
                "Expires": 0,
                "ID": "VXGB6CZ536X5AWE6"
            }
        }
    ]
}

Human Readable Output

Alert ID VXGB6CZ536X5AWE6

Expires	IP	Name
0	1.1.1.1	test_alert

shodan-network-delete-alert

Removes the specified network alert.

Base Command

shodan-network-delete-alert

Input

Context Output

There is no context output for this command.

Command Example

!shodan-network-delete-alert alertID="0EKRH38BBQEHTQ3E"

Human Readable Output

Deleted alert 0EKRH38BBQEHTQ3E

shodan-network-alert-set-trigger

Enables receiving notifications for network alerts that are set off by the specified triggers.

Base Command

shodan-network-alert-set-trigger

Input

Context Output

There is no context output for this command.

Command Example

!shodan-network-alert-set-trigger alertID="0EKRH38BBQEHTQ3E" Trigger=any

Human Readable Output

Set trigger “any” for alert 0EKRH38BBQEHTQ3E

shodan-network-alert-remove-trigger

Disables receiving notifications for network alerts that are set off by the specified triggers.

Base Command

shodan-network-alert-remove-trigger

Input

Context Output

There is no context output for this command.

Command Example

!shodan-network-alert-remove-trigger alertID="0EKRH38BBQEHTQ3E" Trigger="any"

Human Readable Output

Deleted trigger “any” for alert 0EKRH38BBQEHTQ3E

shodan-network-alert-whitelist-service

Ignores the specified services for network alerts that are set off by the specified triggers.

Base Command

shodan-network-alert-whitelist-service

Input

Context Output

There is no context output for this command.

Command Example

!shodan-network-alert-whitelist-service alertID="0EKRH38BBQEHTQ3E" trigger="any" service="1.1.1.1:80"

Human Readable Output

Whitelisted service “1.1.1.1:80” for trigger any in alert 0EKRH38BBQEHTQ3E

shodan-network-alert-remove-service-from-whitelist

Resumes receiving notifications for network alerts that are set off by the specified triggers.

Base Command

shodan-network-alert-remove-service-from-whitelist

Input

Context Output

There is no context output for this command.

Command Example

!shodan-network-alert-remove-service-from-whitelist alertID="0EKRH38BBQEHTQ3E" trigger="any" service="1.1.1.1:80"

Human Readable Output

Removed service “1.1.1.1:80” for trigger any in alert 0EKRH38BBQEHTQ3E from the allow list

shodan-get-events

Retrieves events from Shodan.

Base Command

shodan-get-events

Input

Context Output

There is no context output for this command.

Fetch Events

Fetch process returns a listing of all the network alerts that are currently active on the account.

To enable the Shodan integration you need to have an API key, which you can get for free by creating a Shodan account https://account.shodan.io/register
Once you have an API key, you insert it into the API Key field and click the Test button.

Rate Limits

All API plans are subject to a rate limit of 1 request per second - docs