Integrations
Arctic Security (Arctic Hub)
Arctic Hub ingests Shodan data to produce targeted exposure notifications for constituencies such as national CERTs and service providers. Shodan observations become actionable, recipient-specific reports.
Documentation
Axonius
The Shodan adapter fetches devices, vulnerabilities, SaaS applications and domains for a CIDR list, uploaded CSV of subnets, or search query. An Enforcement Action can also enrich existing asset records on demand.
Documentation
Burp Suite (Anonymous Cloud BApp)
This BApp Store extension scans for cloud misconfiguration and subdomain takeover issues, and accepts a Shodan API key to widen its subdomain checks. One of the few Shodan-backed extensions in the official BApp Store.
Documentation
Cisco XDR
Cisco XDR ships a third-party Shodan module for enriching observables during investigations. Analysts get Shodan context in the investigation graph and can pivot into Shodan from the pivot menu. Added under Administration > Integrations > Third-Party.
Documentation
CrowdStrike Falcon LogScale
Shodan Monitor sends alerts to Falcon LogScale through its Ingest API using a webhook notifier. Exposure events are stored and queryable alongside other telemetry in LogScale.
Documentation
Dataminr
Dataminr lists Shodan in its App Catalog for indicator enrichment plus Investigation Insights lookups against the Shodan Host and InternetDB APIs. Analysts see open ports, CPEs and Shodan tags for IPv4 and IPv6 during triage.
Documentation
DefectDojo
The Shodan connector imports CVEs Shodan observed on your internet-exposed hosts, scoped by a search query you supply. Each host becomes a Record and each CVE a finding, with severity from CVSS plus EPSS and CISA KEV context.
Documentation
Discord
Shodan Monitor delivers alerts to a Discord channel using a webhook notifier. Useful for community, research and home-lab monitoring where Discord is the main channel.
Documentation
Faraday Security
Faraday imports Shodan CLI output into its vulnerability management workspace. Running shodan host or shodan domain through faraday-cli creates hosts, services and banners inside the platform.
Documentation
Fluentd (fluent-plugin-shodan)
This Fluentd input plugin pulls Shodan data via the Search, Stream or Alert APIs and emits it as logs in Shodan banner format, routable to any Fluentd output. Search works on a free account; Stream and Alert need at least a membership.
Documentation
FOCA
FOCA, the document metadata and fingerprinting tool, can query Shodan while mapping a target's infrastructure. Shodan results supplement the server and network information FOCA extracts from documents and DNS.
Fortinet FortiSOAR
The FortiSOAR Shodan connector exposes Search Domain and Search IP operations to playbooks, with bundled sample playbooks included on import. Configuration takes a server URL and API key on the Connectors page.
Documentation
Google Security Operations (Chronicle SOAR)
The Shodan marketplace integration for Chronicle SOAR provides playbook actions for IP enrichment and Shodan search. Responders pull exposure data into cases automatically during investigation.
Documentation
Google Sheets
An Apps Script recipe pulls Shodan search results straight into a Google Sheet. Queries refresh on a schedule so exposure data can be tracked, filtered and shared as a live spreadsheet.
Documentation
Gravwell
Gravwell's data fusion platform ingests Shodan data alongside logs, network telemetry and other feeds. Shodan banners and host records can be queried with Gravwell's search pipeline for attack-surface and exposure analytics.
Graylog
Shodan Monitor alerts can be shipped to Graylog via its HTTP input, turning exposure events into searchable log messages. Dashboards and alert rules can then be built on Shodan banner fields.
Documentation
Home Assistant
The Shodan sensor platform exposes the result count for a saved Shodan query as a Home Assistant entity. Typically used to watch for changes in exposed devices over time and trigger automations.
Documentation
Hoplite Industries
Hoplite's Active Network Defense product pairs with Shodan for continuous external scanning of customer networks. Newly exposed services detected by Shodan feed into Hoplite's monitoring and alerting.
Documentation
IntelOwl
IntelOwl's analyzer framework includes Shodan analyzers for enriching IPs and other observables at scale through a single REST API and GUI. Results sit alongside dozens of other sources for the same observable.
Documentation
Jira
Shodan Monitor can open Jira issues automatically when new services or vulnerabilities appear on your network. Each alert becomes a ticket in the nominated project so remediation is tracked normally.
Documentation
JupiterOne
The JupiterOne Shodan integration ingests Organization, Alert, Host, Scan and User entities into the asset graph for querying and alerting. Makes Shodan exposure data joinable with cloud, identity and DevOps data. Requires a Shodan enterprise license.
Documentation
Kubernetes (kube-shodan)
kube-shodan keeps Shodan Monitor in sync with the external IPs exposed by a Kubernetes cluster. Services and nodes are registered automatically so newly exposed workloads are scanned and alerted on.
Documentation
Lampyre
Lampyre's OSINT and data analysis application includes Shodan as a data source for investigations. Host and search results can be pulled into tables, graphs and maps alongside other sources.
Documentation
Maltego
The Shodan Transform Hub item adds Shodan transforms to Maltego graphs. Analysts pivot from a domain to subdomains, or from an IP to full host details including open ports, banners and vulnerabilities.
Documentation
Mattermost
A Mattermost slash-command bot that lets teams query Shodan from inside a channel. Analysts look up an IP or run a search and share the result without leaving chat.
Documentationmcp-shodan (BurtTheCoder)
A Model Context Protocol server covering the Shodan API and CVEDB, giving AI assistants IP reconnaissance, DNS operations, vulnerability tracking and device discovery. Installs via npx or Smithery; works with Claude, Codex and Gemini CLI.
Documentation
Metasploit Framework
Metasploit ships auxiliary modules that query Shodan for host information and broad searches. Operators enumerate open ports or hunt for hosts matching a Shodan dork without leaving msfconsole.
Documentation
Microsoft Security Copilot
A Shodan plugin for Microsoft Security Copilot lets analysts ask natural-language questions about an IP or domain's internet exposure. Copilot calls the Shodan API and returns ports, services and vulnerability context inline.
Documentation
Microsoft Sentinel
Shodan Monitor alerts are forwarded into Microsoft Sentinel through a Logic App exposing an HTTP webhook. Banner data lands in Log Analytics so exposure events can be hunted alongside the rest of the SIEM.
Documentation
Microsoft Teams
Shodan Monitor sends exposure alerts to a Microsoft Teams channel via an incoming webhook. New services and vulnerabilities on monitored networks appear as Teams messages.
Documentation
Mindflow
Mindflow's automation and AI-agent platform includes a Shodan connector with actions for host lookups and searches. A Shodan agent can sequence operations autonomously as part of a broader workflow.
Documentation
MISP
MISP includes a Shodan expansion module that enriches IP address attributes with Shodan host data. Ports, services and vulnerability information are attached to events for extra analyst context.
Documentation
n8n
The n8n-nodes-shodan community node adds Shodan host, search, DNS and domain operations to n8n workflows. Scheduled workflows can monitor IP ranges and push alerts to Slack or email.
Documentation
Nmap
The shodan-api NSE script queries Shodan for every target in a scan. It returns ports and services Shodan already knows about, letting you gather information with little or no traffic sent to the target.
Documentation
OpenCTI (Filigran)
The verified Shodan connector enriches IPv4 observables and Shodan-pattern indicators inside OpenCTI. It creates organisations, hostnames, ASNs, X.509 certificates, locations and vulnerabilities with relationships.
Documentation
OWASP Amass
Amass lists Shodan among the data source APIs it queries during attack surface mapping and asset discovery. Shodan results contribute hosts and subdomains to the graph Amass builds for a target.
Documentation
PacketSnitch
A desktop PCAP analysis app whose Conv > Analyze Subnet workspace shows a Shodan card beside WHOIS, GeoIP and reputation data for any IP in a capture. The backend exposes it as a GET /shodan?ip= endpoint accepting IPv4 and IPv6. Queries Shodan InternetDB, so no key or account is needed.
Documentation
Palo Alto Networks Cortex XSOAR / XSIAM
The Shodan v2 content pack adds search, host lookup, scanning and reputation commands to XSOAR and XSIAM playbooks. Indicators can be enriched automatically during incident triage. Installed from the Cortex marketplace.
Documentation
Polarity
Polarity overlays Shodan context on whatever application an analyst is already using. Highlighting an IP or domain on screen surfaces open ports, services, tags and vulnerabilities without switching tools.
Documentation
ProjectDiscovery uncover
uncover supports the free shodan-idb (InternetDB) engine, used automatically for IP or CIDR input.
Documentation
Qualys
Qualys CyberSecurity Asset Management natively integrates Shodan data to map an organisation's external attack surface. Internet-facing assets found by Shodan are correlated with the Qualys asset inventory to reveal unknown exposures.
Documentation
Rapid7 InsightConnect
InsightConnect offers a Shodan plugin among its 300+ open-source automation plugins. Workflows enrich IPs and domains with Shodan exposure data during alert triage and response. Installed from the Rapid7 Extension Library.
Documentation
Raycast
A Raycast Store extension brings Shodan search to the macOS launcher. Users search the Shodan database, view host details and manage saved queries without opening a browser.
DocumentationRecon-ng
Recon-ng bundles several Shodan modules covering organisation, hostname, netblock and port discovery. The key is stored once in the framework keystore and reused across modules.
Documentation
runZero
runZero syncs externally-facing assets and services from Shodan into its asset inventory, correlating them with its own scan results. Configurable as a scan probe or an independent scheduled connector task.
Documentation
ServiceNow
ServiceNow Security Operations supports Shodan lookups for enrichment of security incidents and observables. Analysts pull Shodan host details into an incident record to understand external exposure.
Documentation
shodan R package (rOpenSec)
An R client wrapping the Shodan API for analysts working in R and RStudio. Covers search, host lookup, exploit search, on-demand scanning, saved query browsing and the ports/protocols/services endpoints.
shodan-mcp (Vorota AI)
A Docker-first MCP server with 20 tools spanning IP recon, device search, CVE/CPE intelligence, DNS and honeypot detection. Four tools run with no API key, and every query is passive against Shodan's index.
shodan-mcp-server (Cyreslab AI)
An MCP server exposing Shodan host lookups, search, scanning, SSL certificate data and the CVE database to MCP-compatible assistants. CVE, CPE, KEV and EPSS tools work for free; search and scanning need a paid plan.
ShoMon
A Go-based Shodan alert feeder that turns Shodan Monitor findings into TheHive alerts. Runs as a webhook listener that Shodan posts to, or as a stream listener that connects out and parses the alert stream. Docker images ship via ghcr and Docker Hub.
Shuffle
The open-source SOAR platform Shuffle publishes a Shodan app that can be wired to Wazuh, QRadar, IBM X-Force, TheHive and hundreds of others without code. Self-hostable or run on Shuffle's cloud.
Documentation
Slack
Shodan Monitor posts network alerts into a Slack channel through a webhook notifier. Teams get near real-time notice when a new port, service or vulnerability appears on monitored assets.
Documentation
SpamScope
SpamScope, a distributed mail analysis tool, can enrich IP addresses extracted from email headers and bodies using Shodan. This adds infrastructure context to phishing and spam investigations.
SpiderFoot
SpiderFoot's 200+ module OSINT engine includes Shodan modules that feed other modules in a publisher/subscriber model. Shodan contributes open ports, banners and CVE detections to host enumeration and attack surface mapping.
Documentation
Splunk
Official Shodan add-on for Splunk Enterprise that lets analysts run Shodan searches and host lookups directly from SPL. Results are indexed as events so exposed services can be correlated with existing log and SIEM data.
Documentation
Splunk SOAR (formerly Phantom)
The Shodan connector for Splunk SOAR adds playbook actions for search, host lookup and on-demand scanning. Automated workflows enrich an IP or kick off a Shodan crawl during incident response.
Documentation
Steampipe / Powerpipe
The Shodan plugin exposes Shodan's API as SQL tables queryable with Steampipe and visualisable with Powerpipe. Hosts, domains, DNS records and scan data become joinable relations for dashboards.
DocumentationStriker
Striker is an offensive reconnaissance scanner that uses Shodan to gather information about a target's hosts. Shodan results supplement its DNS, header and fingerprinting checks.
Sumo Logic
Sumo Logic's Automation Service ships a certified Shodan integration in App Central with Search and Search IP enrichment actions. Runs via cloud execution or a bridge, with configurable timeouts, TLS verification and proxy options.
Documentation
Telegram
Shodan Monitor supports Telegram as a notification channel for network alerts. Alerts are pushed to a chat or group as soon as Shodan crawls a change on your assets.
Documentation
TheHive / Cortex (StrangeBee)
The Cortex analyzer suite used by TheHive includes Shodan_Host and Shodan_Search analyzers. Running one against an observable produces short and long Shodan reports inside the case.
Documentation
ThreatConnect
ThreatConnect enriches indicators in its threat intelligence platform with Shodan host data. Analysts see open ports, service banners and exposure context beside existing intel to speed up triage.
DocumentationThreatPinch Lookup
A Chrome and Firefox extension showing hover tooltips for IPs, domains and hashes on any page, with Shodan among its configurable lookup sources.
Tines
Tines stories can call the Shodan API to enrich IPs and domains as part of no-code security automation. Exposure data is used to branch workflows, raise cases or notify teams.
Documentation
Torq
Torq offers a native Shodan step integration plus ready-made workflow templates for IP and domain enrichment with 24-hour response caching. Enrichment results are returned to parent workflows to drive case decisions.
Documentation
Zeek
The Shodan InternetDB package for Zeek enriches live network connections using a local SQLite copy of InternetDB. Scripts can tag or block traffic based on Shodan tags such as proxy or compromised, with no per-query API call.
DocumentationWant your integration or application to get listed? Contact us at support@shodan.io