Posted
ThreatConnect and Shodan have partnered to deliver the Shodan Playbook App. This app allows you to retrieve multiple types of enrichment information for IOCs. Additionally, it allows you to craft custom Shodan searches to retrieve result sets based on factors such as software versions being run, services running, open ports, and more. You can even use it to monitor your own potentially open and vulnerable infrastructure, among numerous other possible use cases. We’re excited to see what you use it for!
When put into production, the Shodan Playbook App will allow you to:
- Aggregate available enrichment and analysis from various outside sources into one location- the ThreatConnect Platform. You will have a more holistic understanding of potential threats to make the most informed decision as part of your analytic, investigative, and remediation actions.
- Utilize information from Shodan to aid and corroborate intelligence analysis or validate the accuracy and severity of security alerts.
- Corroborate or dispute the output from other tools and services to perform an all-source assessment. Because operations feed intelligence in a continuous loop, your Security Operations Center (SOC) and Incident Response (IR) teams can leverage the work from the Threat Intelligence team during the course of their investigations.
- Monitor for potential instances of your enterprise’s infrastructure appearing in the Shodan data set via vulnerable software, rogue services, etc. allowing direct and immediate value to be derived.
The following actions are available with this Playbook App:
- DNS Lookup
- Reverse DNS Lookup
- Search Shodan
- Get Enrichment
- Parse Results
Together, ThreatConnect and Shodan help you to enrich Threat data so that you can make informed decisions and proactively monitor your own infrastructure.
If you’re a ThreatConnect customer, please reach out to your dedicated Customer Success Team for more information on utilizing the Shodan Playbook App. If you’re not yet a customer and are interested in ThreatConnect and this integration, contact us at sales@threatconnect.com.