---
title: "Shodan Enrichment | Dataminr"
slug: "shodan-enrichment"
description: "This article describes how to enable the Shodan enrichment service in ThreatConnect, view data retrieved from Shodan on the Enrichment tab of an Indicator’s Details screen, and import vulnerabilities from Shodan into ThreatConnect."
tags: ["Viewing Data", "Enriching Data"]
updated: 2026-11-06T19:41:57Z
published: 2026-11-06T19:41:57Z
canonical: "knowledge.threatconnect.com/shodan-enrichment"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Shodan Enrichment

## Overview

The Shodan® built-in enrichment in ThreatConnect® lets you access Shodan’s extensive search capabilities directly within ThreatConnect, enabling you to obtain detailed information about vulnerabilities and enrich IP addresses with actionable intelligence for threat investigations and other security operations.

This article describes how to enable the Shodan Indicator enrichment service in ThreatConnect, view data retrieved from Shodan on the **Enrichment** tab of an Indicator’s **Details** screen, and import related vulnerabilities from Shodan into ThreatConnect.

## Before You Start

### User Roles

- To enable and configure the Shodan enrichment, your user account must have a [System role](https://knowledge.threatconnect.com/docs/threatconnect-system-roles-and-permissions) of Administrator.
- To view and retrieve Shodan data on the **Enrichment** tab of an Indicator’s **Details** screen for an Indicator in your home Organization, your user account can have any [Organization role](https://knowledge.threatconnect.com/docs/organization-roles).
- To view and retrieve Shodan data on the **Enrichment** tab of an Indicator’s **Details** screen for an Indicator in any Organization on your ThreatConnect instance, your user account must have a System role of Super User.
- To view and retrieve Shodan data on the **Enrichment** tab of an Indicator’s **Details** screen for an Indicator in a Community or Source, your user account can have any [Community role](https://knowledge.threatconnect.com/docs/community-roles) except Banned in that Community or Source.
- To import related vulnerabilities from the Shodan Indicator enrichment service into an Organization, your user account must have an Organization role of Standard User, Sharing User, Organization Administrator, or App Developer in that Organization.
- To import related vulnerabilities from the Shodan Indicator enrichment service into any Organization on your ThreatConnect instance, your user account must have a System role of Super User.
- To import related vulnerabilities from the Shodan Indicator enrichment service into a Community or Source, your user account must have a [Community role](https://knowledge.threatconnect.com/docs/community-roles) of Contributor, Editor, or Director for that Community or Source.

### Prerequisites

- To enable the Shodan Indicator enrichment service on your ThreatConnect instance, you must have a valid Shodan API key. To obtain a Shodan API key, create a Shodan account at [account.shodan.io/register](https://account.shodan.io/register).
- To view the Shodan enrichment data for Address Indicators, the Shodan enrichment must be enabled for that Indicator type on your ThreatConnect instance (must be a System Administrator to perform this action).

## Enabling the Shodan Enrichment

Follow these steps to enable and configure the Shodan enrichment on your ThreatConnect instance:

1. From the **Settings**![Settings icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Settings%20icon.png)menu on the top navigation bar, select **System Settings**.
2. Select the **Indicators** tab.
3. Select **Enrichment Tools** from the left sidebar.
4. Click **Edit**![Edit icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Pencil%20icon_Black.png)in the **Options** column for **Shodan** and fill out the fields on the **Edit Vendor** window (Figure 1) as follows:

![Figure 1_Shodan Enrichment_8.2](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_Shodan%20Enrichment_8.2.png)
  - **Enable Vendor**: Select this checkbox to enable Shodan.
  - **Enable Automatic Retrieval**: Select this checkbox to enable automatic data retrieval for Shodan. If automatic data retrieval is enabled, Shodan data automatically populate when a user opens an Address Indicator’s **Enrichment** tab for the first time.ImportantThe API key entered in the next field is used each time data are retrieved from Shodan for an Indicator. To limit API key usage to [manual retrieval](/v1/docs/shodan-enrichment#retrieving-data-manually) only, clear this checkbox.
  - **API Key**: Enter the API key to retrieve data from Shodan.
  - **VALIDATE**: Click this button to validate the Shodan API key. If the API key is accepted, the **VALIDATE** button’s label changes to **VALID**.
  - **Lookup/Retrieve**: Select **IP Address** to retrieve data from Shodan for Address Indicators.
5. Click **SAVE**.

ImportantIf you make changes to the **Edit Vendor** window when the vendor is enabled, you need to revalidate the API credentials to save those changes.

## Data Overview

The **Overview** section of the **Shodan** card (Figure 2) on the [**Enrichment** tab](https://knowledge.threatconnect.com/docs/the-enrichment-tab) of an Address Indicator’s **Details** screen provides a summary of data retrieved from Shodan for the Indicator and the date and time the data were last retrieved.

![Figure 2_Shodan Enrichment_7.8.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_Shodan%20Enrichment_7.8.1.png)

- **HostNames**: The hostname(s) associated with the Address.
- **Domains**: The domain(s) associated with the Address.
- **Tags**: The tag(s) applied to the Address in Shodan.
- **Cloud Provider**: The cloud provider associated with the Address.
- **Cloud Region**: The region associated with the Address’s cloud provider.
- **Country**: The country associated with the Address.
- **City**: The city associated with the Address.
- **Organization**: The registering organization associated with the Address.
- **ISP**: The internet service provider (ISP) associated with the Address.
- **ASN**: The autonomous system number (ASN) associated with the Address.
- **OpenPorts**: The ports open on the Address.
- **Last Updated**: The date and time when data for the Address were last updated in Shodan.

## Shodan Detailed View

Click **Open Detailed View** on the **Shodan** card to open the **Shodan Detailed View** drawer (Figure 3), which displays cards with additional data retrieved from Shodan.

![Figure 3_Shodan Enrichment_7.8.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_Shodan%20Enrichment_7.8.1.png)

The **Shodan Detailed View** drawer displays the following cards:

- **TCP:<*port number*>**: The details about a Transmission Control Protocol (TCP) port number open on the Address. This card may also display details about the product and Secure Sockets Layer (SSL) certificate, if available.
- **UDP:<*port number*>**: The details about a User Datagram Protocol (UDP) port number open on the Address. This card may also display details about the product and SSL certificate, if available.
- **Unverified Vulnerabilities**: Vulnerabilities that may or may not affect the Address and are implied based on metadata (e.g., software, version) collected by Shodan. Details displayed for each vulnerability include the Common Vulnerabilities and Exposures (CVE) ID number, the affected port number, and a description of the CVE.
- **Verified Vulnerabilities**: Verified vulnerabilities that affect the Address. Details displayed for each vulnerability include the CVE ID number, the affected port number, and a description of the CVE.

NoteThe **Shodan Detailed View** drawer displays only cards for which data were returned from Shodan.

## Importing Vulnerabilities From Shodan Into ThreatConnect

You may import vulnerabilities displayed on the **Unverified Vulnerabilities** or **Verified Vulnerabilities** cards into ThreatConnect as Vulnerability Groups and associate them to the enriched Indicator (i.e., the Indicator whose **Details** screen you are viewing).

Follow these steps to import vulnerabilities from Shodan into ThreatConnect:

1. Expand one of the following cards on the **Shodan Detailed View** drawer (Figure 3) to view vulnerabilities retrieved from Shodan that are related to the enriched Indicator:
  - **Unverified Vulnerabilities**: Vulnerabilities on this card will be imported as Vulnerability Groups.
  - **Verified Vulnerabilities**: Vulnerabilities on this card will be imported as Vulnerability Groups.
2. Select the checkbox for each vulnerability to import into ThreatConnect, or select the checkbox in the table’s header to import all vulnerabilities displayed on the current page in the table.
3. Click **Import** at the top left of the card.
4. On the **Import Groups** window, provide the following details in the **Group Details** section for the Groups that will be created in ThreatConnect:
  - **Owner**: Select the [owner](https://knowledge.threatconnect.com/docs/ownership-in-threatconnect) in which the Groups will be created.
  - **Tags**: Enter one or more [Tags](https://knowledge.threatconnect.com/docs/applying-tags) to apply to the Groups. By default, the **Tags** text box includes a **Shodan Enrichment** Tag.
5. Review the list of vulnerabilities to import and associate to the enriched Indicator. After import, each Vulnerability Group’s name will include the vulnerability’s name and port number (e.g., **CVE-2008-3844 on port 22**), and the description will be the Group’s default [Description](https://knowledge.threatconnect.com/docs/the-description-attribute).
6. Click **Import Groups** to import the vulnerabilities and associate them directly to the enriched Indicator.

## Retrieving Data Manually

When you open an Indicator’s **Enrichment** tab for the first time, data are automatically retrieved from Shodan and displayed on the **Shodan** card if your System Administrator enabled automatic data retrieval for Shodan. If no data are displayed, click **Retrieve Data** on the card to retrieve data manually. Once data have been retrieved, they are cached for a period of time configured by your System Administrator. Each time you revisit that Indicator’s **Enrichment** tab, the cached Shodan data are displayed until this period of time has passed. You can click **Retrieve Data** to update the displayed data at any time.

## Enriching Indicators Using the ThreatConnect API

You can use the ThreatConnect v3 API to enrich Address Indicators with data from Shodan. For instructions on using the ThreatConnect v3 API to enrich Indicators, see [*Indicator Enrichment Overview*](https://threatconnect.readme.io/reference/indicator-enrichment-overview).

---

*ThreatConnect® is a registered trademark of ThreatConnect, Inc. Shodan® is a registered trademark of Shodan.*

20146-04 v.05.A