Weekly Shodan Scan and Alerting to TheHive

![Scheduled]({{ $env.WEBHOOK_URL }}
# Workflow Overview

The n8n workflow initiates with a node that fetches a list of IP addresses and their specified ports from a security system, which is essential for ongoing surveillance of network integrity. 

The data is expected to be in JSON format, detailing each IP with an array of associated ports to be monitored. While the example provided showcases a basic API call, in practice, this should be replaced with a call to the organization's own security system. 

`It's important to note that error handling is not included in this example and should be implemented according to the specific data formatting and error response protocols of the user's system.` The expectation for successful execution is that the incoming data conforms to the predefined JSON structure.

## Get list of IPs from your IPS or database

This section retrieves a current list of IP addresses and their associated ports that require monitoring from your Intrusion Prevention System (IPS). It is essential to maintain an updated list to monitor for any unauthorized changes or traffic. The expected format for each entry is a JSON object containing the IP address and an array of ports.

Our sample api call below can be replaced with api access to your IPS. To ensure it works, this workflow expects data to be in the following format:
```
[
  {
    "ip": "116.202.106.35",
    "ports": [
      5678,
      80
    ]
  },
  {
    "ip": "188.114.96.9",
    "ports": [
      8080,
      80
    ]
  }
]
```