Configure and enable Shodan integration

Before you use Shodan integration, you must download it from the ServiceNow Store.

Before you begin

Role required: sn_sec_tisc.admin

Procedure

1. Using your instance, access Threat Intelligence Security Center.
2. Download the integration from the ServiceNow Store.
3. When the installation is complete, navigate to Workspaces > Threat Intelligence Security Center.
4. Select Integrations > Enrichment Integrations > All Integrations.
5. Alternatively, you can navigate to Integrations > Enrichment Integrations > All Integrations > Observable Enrichment.
6. In the Shodan card, click Configure New Enrichment to configure the integration.
7. Fill in the fields on the Configure New Enrichment form.

   Table 1. Enrichment Integration

   Field	Description
   Name	Enter a name for the new enrichment integration. For example, Shodan.
   Vendor Name	Name of the vendor. The details of the selected vendor is auto populated and by default this field will be read only. For example, Shodan.
   Integration Type	Type of integration that you selected. For example, Observable Enrichment.
   Description	Enter the description for the new enrichment integration. For example, the description for Shodan integration is, Shodan helps you to analyze banner information from connected devices all around the globe.

8. Drill down to Integration Configuration section.
9. Enter (or paste) the API Key you acquired from the Shodan portal.
10. Click Save.
    The integration details are validated, and by default the status is disabled.
11. Click Enable to enable the integration.