The Shodan package for Zeek is open-source and available here.
Once you download the .tar.gz file, extract it and run the commands:
./configure && make && sudo make install
The Zeek Package Manager makes it easy for Zeek users to install and manage third party scripts as well as plugins for Zeek and ZeekControl. Our InternetDB package has been added into the zkg package. This is another way to set up.
Note that this method does require independent installation of zkg's dependencies, which is usually easiest to do via pip3:
pip3 install zkg
After installing via pip3, zkg must be configured. Make sure you already install Zeek and set PATH in the previous guideline.
zkg autoconfig
zkg refresh
Finally, install shodan-zeek package which contains the main InternetDB function.
zkg install shodan-zeek
The SQLite version of InternetDB requires an Enterprise license to Shodan and lets you do fast IP enrichment using an offline database. To get started, visit the Account page and grab your API key. Afterwards, look for the update-internetdb.sh script that's in the folder from the extracted archive and edit the API key line at the top of the script with your own API key:
API_KEY=”xxxx”
Now we only just need to run the file. Note that the SQLite file will take up around 50GB of disk storage and it is placed in /usr/share/InternetDB. The Zeek package expects the SQLite file in that location so make sure to not change that aspect:
$ ./update-internetdb.sh
Connecting to the Shodan API...
Downloading latest file...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 4863M 100 4863M 0 0 4750k 0 0:17:28 0:17:28 --:--:-- 3448k
Verifying file integrity...
Uncompressing file...
Successfully updated InternetDB. Reload your application to take advantage of it.
At this point, you should be able to use the zeek command to confirm that the functions are available:
$ zeek -NN | grep InternetDB
InternetDB::lookup_internetdb - Get IP address information from Shodan InternetDB (dynamic, version 1.1.0)
[Function] InternetDB::lookup_internetdb_api
[Function] InternetDB::lookup_internetdb_sqlite