A search engine for internet-connected devices and services. Security teams use it to discover exposed assets, identify attack surface, and track infrastructure linked to threat actors.
What is Shodan?
Shodan is a search engine for internet-connected devices and services, continuously scanning the public internet and indexing everything it finds: servers, routers, industrial control systems, security cameras, databases, and any other device with an exposed network port. For security teams, Shodan serves two primary purposes. The first is attack surface management: by searching for an organization's IP ranges, domain names, and SSL certificates, teams can identify assets that are unintentionally exposed to the internet, discover shadow IT, and find services running outdated or vulnerable software versions. The second is threat intelligence: Shodan can be used to identify infrastructure operated by threat actors, track the spread of specific vulnerabilities across the internet, and correlate suspicious IP addresses encountered in investigations with known hosting patterns associated with malicious campaigns.
How does Shodan work with Qevlar?
Qevlar uses Shodan to enrich IP addresses and domains encountered during automated investigations. When an investigation involves an unknown external IP or domain, Qevlar can query Shodan to determine what services are running on that infrastructure, whether it is associated with known malicious hosting, and whether it shares characteristics with other infrastructure linked to the same threat actor.
Want to help your analysts focus on the most critical alerts?
Frequently asked questions
What is Shodan?
Shodan is a search engine for internet-connected devices and services. Security teams use it to discover exposed assets, map their attack surface and track infrastructure linked to threat actors.
What can you do with Shodan in Qevlar?
Qevlar can query Shodan to enrich IPs and domains during an investigation — determining what services run on an unknown host, whether it is associated with malicious hosting and whether it shares traits with other threat-actor infrastructure.
Does Qevlar enrich external infrastructure automatically?
Yes. When an investigation involves an unfamiliar external IP or domain, Qevlar uses Shodan to add context without manual lookups.
Can Shodan data link an alert to a wider campaign?
Yes. By comparing infrastructure characteristics, Qevlar can connect an isolated indicator to broader malicious activity.
Other integrations
