Splunk Enterprise Security

How can I use Shodan data with Splunk Enterprise Security?

rickettw
New Member

I am starting to use Enterprise Security to monitor IT security metrics in my enterprise. I am aware of Shodan and have downloaded reports in the past when i did searches for my interfacing IP addresses and to monitor for vulnerabilities. I was recently at .conf2016 and during one of the breakouts, the speaker asked for a show of hands how many have heard of or are using Shodan. So my question is, how i can use Shodan data within Splunk, or more specifically with ES?

0 Karma

LukeMurphey
Champion

I can see three ways:

  1. Workflow action: allow users to open the Shodan web UI in the users browser
  2. Adaptive Response Action: get info from Shodan in a way that it can be viewed on Incident Response. To work best with ES, this should be a full Adaptive Response Action (not just a plain Alert Action).
  3. Modular Input: to keep retrieving information for a particular host (if you want to monitor changes in hosts)

I think number 2 is the most important. I'm seriously thinking of making that alert action. I'll update this comment if I can get time to do it; I don't think it will take me long.

guarisma
Contributor

You will have to interact with shodan's API to pull the information you need and get it into splunk, probably by using a scripted input.
Here's a link to Shodan Developer website for more information: https://developer.shodan.io/

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...