Graylog Integration

Shodan provides an integrated Graylog package to enrich IP information from our database.

Installation

Simply download the .jar file from our Gitlab release. Please check your Graylog version to choose the right package as the table below shows what our integrated version is compatible with your app version.

After download, put the .jar file to the Graylog plugin folder. The plugin directory is the plugins/ folder relative from your graylog-server directory by default and can be configured in your graylog.conf file.

Restart Graylog and check the System -> Lookup Tables -> Data Adapter -> Create Data Adapter. Shodan and Shodan InternetDB should appear.

• Shodan Adapter: If you already have Shodan account, it will help you enrich a lot of IP address information. For more details, you can check it here to see what data Shodan returns.

• Shodan InternetDB Adapter: Free database for everyone, you can use it with no API key. InternetDB returns hostnames, open ports, cpes, tags, vulnerabilities.

How to use

We will demonstrate an example to attach Shodan InternetDB lookup when fetching data into Graylog.

First create a new Shodan InternetDB Adapter. Then create new lookup table using the Shodan Internet Adapter we just created before.

Go to System -> Pipelines -> Manage Rules -> Create Rule. We need to add Rule Source here to check IP information from Shodan InternetDB Table if there is an IP field in your log (in this example src_ip).

rule "Shodan InternetDB check IP"
when
    // Change field 'src_ip' depends on your log
    has_field("src_ip")
then
  let update_source = lookup("shodan_internetdb_table", $message.src_ip);
  set_field("shodan_internetdb", update_source);
end

Back to System -> Pipelines -> Manage Pipelines. Create a new pipeline Shodan InternetDB. We need to configure which Stream the pipeline will connect to. Here we use All messages.

Finally, add new stage that tells the pipeline which uses the rule we just created and save.

Please check the Messages Processor Configuration in System/Configuration should follow this order.

Once the preparation is done, we can check the stream log and see the result.