Splunk Enterprise Security

How can I use Shodan data with Splunk Enterprise Security?

New Member

I am starting to use Enterprise Security to monitor IT security metrics in my enterprise. I am aware of Shodan and have downloaded reports in the past when i did searches for my interfacing IP addresses and to monitor for vulnerabilities. I was recently at .conf2016 and during one of the breakouts, the speaker asked for a show of hands how many have heard of or are using Shodan. So my question is, how i can use Shodan data within Splunk, or more specifically with ES?

0 Karma


I can see three ways:

  1. Workflow action: allow users to open the Shodan web UI in the users browser
  2. Adaptive Response Action: get info from Shodan in a way that it can be viewed on Incident Response. To work best with ES, this should be a full Adaptive Response Action (not just a plain Alert Action).
  3. Modular Input: to keep retrieving information for a particular host (if you want to monitor changes in hosts)

I think number 2 is the most important. I'm seriously thinking of making that alert action. I'll update this comment if I can get time to do it; I don't think it will take me long.


You will have to interact with shodan's API to pull the information you need and get it into splunk, probably by using a scripted input.
Here's a link to Shodan Developer website for more information: https://developer.shodan.io/

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...