shodan_database

Feedback:

Send email

shodan_database

Use the shodan_database operator to enrich results related to an IP address or field containing an IP address using the ThreatStream Shodan enrichment.

Syntax

|shodan_database <field or value>

<field or value>

Specify the field name or IP address to look up.

Usage

You can use the shodan_database operator to enrich results with data from the ThreatStream Shodan integration.

Examples

Example 1: Enrich IP field with Shodan database information.

Copy

|fields ip |shodan_database(ip)

Example 2: Enrich a hardcoded IP address with Shodan data.

Copy

|shodan_database '192.0.2.1'