Integration with Shodan

[Y3ll0wF1ash]

Hi @defensivedepth ,
I recently saw your video on youtube about Situational Awareness using Shodan. The api call is being made to shodan but I am unable to get the results on Security Onion. Can you please provide the steps that I should follow to have that in place?

Thanks

[eb-op]

Hello Y3ll0wF1ash,

Could I get a little more information on your issue? What does your current filebeat config look like in your global pillar file on the manager?

[Y3ll0wF1ash]

Hi eb-op,
I want to integrate Shodan with my Security Onion. I have just created a filebeat config. Please find my filebeat config below:
The config is present under /opt/so/saltstack/local/pillar/global.sls
Are there any steps which has to be followed after creating the filebeat config?

filebeat:
config:
inputs:
- type: httpjson
interval: 2h
request.url: "https://api.shodan.io/shodan/host/8.8.8.8?key=api_key"
response.split:
target: body.matches
processors:
- decode_json_fields:
fields: ["message"]
target: "result"
fields:
module: shodan
pipeline: shodan
fields_under_root: true

[Y3ll0wF1ash]

I figured the issue out. The final configuration is,
filebeat:
config:
inputs:

• type: httpjson
  interval: 2h
  request.url: "https://api.shodan.io/shodan/host/8.8.8.8?key=api_key"
  processors:
• decode_json_fields:
  fields: ["message"]
  target: "result"
  fields:
  module: shodan
  pipeline: shodan
  fields_under_root: true