Weekly Shodan Query: Detect & Report Unexpected Open Ports

This n8n workflow runs every Monday at 5:00 AM to proactively monitor network security for a list of watched IP addresses. It starts by fetching the IP list and their expected ports via HTTP request. For each IP, it queries Shodan to retrieve detailed port data, extracts the ports array, and filters out any that don't match the expected list, identifying potential security risks like unauthorized open services.

Unexpected ports trigger data assembly, including IP details, hostnames, port numbers, service info, HTTP status, timestamps, and headers from Shodan. This data is formatted into an HTML table, converted to Markdown, and used to create a structured alert in TheHive with medium severity, TLP Amber, tags, and a unique reference.

Benefits include early detection of misconfigurations or breaches, reducing manual scanning time, and streamlining incident response. Ideal for security teams managing critical infrastructure, DevOps for compliance, or MSSPs monitoring client networks. Saves hours weekly on port reconnaissance and reporting.