Skip to main content
{ Attack Surface Management / Reporting and Compliance }

Shodan Attack Surface Posture Report

Delivers a weekly report on what Shodan indexes across the organization's network ranges, with new services, Shodan Monitor coverage and triggers, and anything that needs attention.

What this agent does

This read-only agent reports every week on what Shodan indexes across the organization's public addresses. It counts the hosts and services Shodan holds for the organization's ranges and names and lists the services that appeared and are no longer indexed since last week. It reads the Shodan Monitor network alerts, checks that they cover every public range and address the organization owns, and summarizes the trigger notifications that arrived at the notifier I connect. It flags anything that needs an admin, such as a new open database, an expired certificate, or a range with no monitor.

The challenge

Shodan Monitor sends an email for every trigger, and the emails go to a mailbox nobody reads. A new cloud account adds public addresses that no monitor covers, so Shodan indexes them and nobody is told. The triggers fire, the index grows, and the only record is a mailbox.

The solution

The agent reads the indexed hosts, the monitor alerts, and the trigger notifications in one pass each week and compares them with the previous week. It compares the monitored ranges with the public addresses in the cloud accounts and lists the gaps. It lists what changed and what someone needs to act on, with the fix for each item. Provides a weekly briefing an attack surface owner reads in a few minutes.

Workflow

  1. 01

    Read the index

    Search Shodan for the organization's ranges and names, count the hosts and services, and compare with last week to list additions and services no longer indexed.

  2. 02

    Read monitors

    Read the Shodan Monitor network alerts, their ranges, and their enabled triggers, and the trigger notifications since last week from the webhook or Slack notifier I connect.

  3. 03

    Check coverage

    Compare the monitored ranges with the public addresses in the cloud accounts I connect, and list the addresses with no monitor.

  4. 04

    Report

    Publish what changed and what needs action, with the fix for each item.

Agent template 

# Shodan Attack Surface Posture Report

## Measurable outcomes

Every week, the attack surface owner knows what Shodan indexed, what changed, which triggers fired, and which public addresses no monitor covers. Track the indexed host and service counts, the uncovered address count, and the open action items on every run.

## Procedure

Once a week, search Shodan for the network ranges, hostnames, and certificate subject names I configure, and count the hosts and services. Compare with last week's result and list the services added and the services no longer indexed, grouped by port and product. A service no longer indexed is one Shodan has stopped seeing, and that lags the real closure by days or weeks. Flag any new service on a database, remote access, or management port. Read the Shodan Monitor network alerts with the ranges each one covers and the triggers enabled on it. Flag any alert without the open database, malware, vulnerable, expired certificate, and new service triggers enabled, unless I set another list. Shodan does not keep a history of fired triggers, so read the trigger notifications since last week from the webhook or Slack notifier I connect, summarize them by type and by range, and report trigger history as not checked when no notifier is connected. When I grant read-only access to the cloud accounts, list the public addresses and ranges they hold, and list each address that no monitor covers. List the hosts whose certificate expires within 30 days or has expired. Compare everything with last week's report, and lead with what changed. Give every action item the specific fix, such as add a monitor, enable a trigger, or close a service. Report a check it cannot run as not checked, never as fine.

## Requirements

It needs a Shodan API key on a plan with search filters and Shodan Monitor, optional read access to the webhook or Slack notifier that receives the trigger notifications, and optional read-only access to the cloud accounts for the coverage comparison, and nothing more. It never requests an on-demand scan from Shodan, and it never creates or changes a monitor, a trigger, a notifier, or any asset. Reports show ports, products, trigger types, and counts. Addresses and hostnames appear as stable pseudonyms in the summary and in full in the ticket for each action item.