Current ThreatQ Version Filter

Shodan Operation

The web format of this guide reflects the most current release. Guides for older iterations are available in PDF format.

Integration Details

ThreatQuotient provides the following details for this integration:

Current Integration Version

2.1.0

Compatible with ThreatQ Versions

>= 4.0.0

Support Tier

ThreatQ Supported

Introduction

The Shodan Operation for ThreatQuotient enables a user to query Shodan contextual information around FQDNs and IP Addresses.

The operation provides the following action:

Query - queries Shodan for any context it has on the given object.

The operation is compatible with FQDN, IP Address, and URL type Indicators

Prerequisites

You must register for a free account with Shodan at https://www.shodan.io/ in order to receive an API Key. The API Key is required when configuring the operation.

Installation

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

Navigate to your integrations management page in ThreatQ.
Select the Operation option from the Type dropdown (optional).
Click on the integration entry to open its details page.

Enter the following parameter under the Configuration tab:

Parameter	Description
API Token	Your Shodan API Key. See the Prerequisites chapter for details on obtaining a Shodan API Key.

Review any additional settings, make any changes if needed, and click on Save.
Click on the toggle switch, located above the Additional Information section, to enable it.

Actions

The operation provides the following action:

Action	Description	Object Type	Object Subtype
Query	This action queries Shodan for any context it has on the given object	Indicators	FQDN, IP Address, URL

Query

The Query action quiries Shodan for any context it has on the given FQDN, IP Address, or URL.

URLs, FQDNs

The following endpoint is queried for URLs and FQDNs:

GET https://api.shodan.io/shodan/host/search

IP Addresses

The following endpoint is queried for IP Addresses:

GET https://api.shodan.io/shodan/host/<IP Address>

Sample Response (both endpoints):

{
    "matches": [
        {
            "_shodan": {
                "crawler": "5faf2928ceb560cb4276cc1b4660b2d763cc6397",
                "id": "e57d03a2-be0e-4d1e-b9d5-1126d5aaccba",
                "module": "dht",
                "options": {},
                "ptr": true
            },
            "asn": "AS5650",
            "data": "DHT Nodes\n71.10.99.93\t17304\n238.52.42.184\t45425\n187.186.123.66\t7914\n105.249.52.87\t44848\n...",
            "domains": ["frontiernet.net"],
            "hash": 751499058,
            "hostnames": ["47-189-204-206.dlls.tx.frontiernet.net"],
            "ip_str": "47.189.204.206",
            "ip": 800967886,
            "isp": "Frontier Communications",
            "location": {
                "area_code": 281,
                "city": "League City",
                "country_code": "US",
                "country_code3": "USA",
                "country_name": "United States",
                "dma_code": 618,
                "latitude": 29.517300000000006,
                "longitude": -95.0963,
                "postal_code": "77573",
                "region_code": "TX"
            },
            "org": "Frontier Communications",
            "os": null,
            "port": 6881,
            "timestamp": "2020-03-27T05:52:30.229192",
            "transport": "udp"
        }
    ],
    "total": 1
}

ThreatQuotient provides the following default mapping for this action:

Feed Data Path	ThreatQ Entity	ThreatQ Object Type or Attribute Key	Examples	Notes
.matches[].asn	Indicator.Value	ASN	AS5650	N/A
.matches[].cpe	Attribute.Value	CPA		N/A
.matches[].domains	Indicator.Value	FQDN	frontiernet.net	N/A
.matches[].hostnames	Indicator.Value	FQDN	47-189-204-206.dlls.tx.frontiernet.net	N/A
.matches[].http.title	Attribute.Value	HTTP Title		N/A
.matches[].http.host	Indicator.Value	IP Address		N/A
.matches[].ip_str	Indicator.Value	IP Address	47.189.204.206	N/A
.matches[].isp	Attribute.Value	ISP	Frontier Communications	N/A
.matches[].link	Attribute.Value	Link		N/A
.matches[].location.area_code	Attribute.Value	Area Code	281	N/A
.matches[].location.city	Attribute.Value	City	League City	N/A
.matches[].location.country_code	Attribute.Value	Country Code	US	N/A
.matches[].location.country_name	Attribute.Value	Country	United States	N/A
.matches[].location.postal_code	Attribute.Value	Postal Code	77573	N/A
.matches[].location.region_code	Attribute.Value	Region Code	TX	N/A
.matches[].org	Attribute.Value	Organization	Frontier Communications	N/A
.matches[].os	Attribute.Value	Operation System		N/A
.matches[].port	Attribute.Value	Port	6881	N/A
.matches[].product	Attribute.Value	Product		N/A
.matches[].tags[]	Attribute.Value	Tag		N/A
.matches[].transport	Attribute.Value	Transport	udp	N/A
.matches[].version	Attribute.Value	Version		N/A

Change Log

Version 2.1.0
- Initial Release
Version 2.0.0
- Beta Release

PDF Guides

Document	ThreatQ Version
Shodan Operation Guide v2.1.0	4.25.0 or Greater
Shodan Operation Guide v2.1.0	4.25.0 or Greater