Shodan lets you search for devices that are connected to the Internet.

Connect Shodan with Devo SOAR

1. Navigate to Automations > Integrations.

2. Search for Shodan.

3. Click Details, then the + icon. Enter the required information in the following fields.

4. Label: Enter a connection name.

5. Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.

6. Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).

7. Remote Agent: Run this integration using the Devo SOAR Remote Agent.

8. API Key: The API key to connect to the Shodan.

9. After you've entered all the details, click Connect.

Actions for Shodan

IP Lookup

Submit an IP to return all services that have been found on the given IP.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• result: Searches devices.

``` {json}{ "error": "Empty search query" }

List Ports

This returns a list of port numbers that the crawlers are looking for.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

``` {json}{ "has_error": false, "result": [ 7, 11, 13, 15, 17 ], "error": null }

List Scans

This returns a listing of all the on-demand scans that are currently active on the account.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

``` {json}[ { "status_check": "2024-04-30T11:13:42.719000", "size": 1, "credits_left": 655, "has_error": false, "id": "TEST_ID", "error": null, "api_key": "TEST_API", "status": "PROCESSING", "created": "2024-04-30T11:13:42.664000" }, { "status_check": "2024-04-30T11:13:42.719000", "size": 1, "credits_left": 654, "has_error": false, "id": "TEST_ID", "error": null, "api_key": "TEST_API", "status": "PROCESSING", "created": "2024-04-30T11:13:42.664000" } ]

Scan Network

This is used to request Shodan to crawl a network. Use either IPs or services from optional params.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

``` {json}{ "count": 1, "credits_left": 65523, "has_error": false, "id": "Test", "error": null }

Get Alert

This is used to get the information about a specific network alert.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

``` {json}{ "notifiers": [], "name": "CIDR", "expires": 0, "size": 16384, "has_triggers": true, "triggers": { "malware": {}, "open_database": {}, "iot": {}, "end_of_life": {}, "internet_scanner": {}, "industrial_control_system": {}, "new_service": {}, "ssl_expired": {}, "vulnerable": {} }, "has_error": false, "id": "Id", "error": null, "filters": { "ip": [ "0.0.0.0/18" ] }, "expiration": null, "created": "2023-10-18T12:23:47.205000" }

Modify Alert

This is used to edit a network alert with a new list of IPs/networks to keep track of.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

``` {json}{ "name": "DNS Alert 2902", "expires": 0, "size": 5, "has_triggers": false, "triggers": {}, "has_error": false, "id": "ID", "error": null, "filters": { "ip": [ "8.8.8.8", "1.1.1.1", "2.2.2.2", "3.3.3.3", "4.4.4.4" ] }, "expiration": null, "created": "2024-04-30T11:52:48.108000" }

List Triggers

This returns a list of all the triggers that can be enabled on network alerts.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

``` {json}[{ "name": "any", "description": "Match any service that is discovered", "rule": "*", "has_error": false, "error": null }, { "name": "industrial_control_system", "description": "Services associated with industrial control systems", "rule": "tag:ics", "has_error": false, "error": null }]

Disable Trigger

This is used to stop getting notifications for the specified trigger.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

``` {json}{ "has_error":false, "success":true, "error":null }

Remove From Whitelist

This is used to start getting notifications again for the specified trigger.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

``` {json}{ "has_error":false, "success":true, "error":null }

Remove Notifier

This is used to remove the notification service from the alert. Notifications are only sent if triggers have also been enabled.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

{json}{ "has_error":false, "success":true, "error":null }

Release Notes

• v2.1.1 - Added 17 new actions : List Ports, List Protocols, List Scans, Status of Scan, Scan Network, Create Alert, Get Alert, Delete Alert, Modify Alert, List Alerts, List Triggers, Enable Trigger, Disable Trigger, Add to Whitelist, Remove From Whitelist, Add Notifier andRemove Notifier

• v2.0.8 - Modified IP Lookup v2 to Lookup v2, to handle generic filter search while maintaining backward compatibility.

• v2.0.0 - Updated architecture to support IO via filesystem

• v1.1.2 - Added documentation link in the automation library.

• v1.1.1 - New action created which returns valid json