Skip to main content
Connect Shodan so Myrmex can map your external attack surface — internet-exposed hosts, services, ports, and banners — and enrich investigations with device and IP intelligence. Myrmex queries the Shodan REST API in real time through a Collector.
Myrmex queries Shodan on demand and reads results in real time — nothing is stored on the Myrmex side.

​
What Myrmex Can Do

External exposure

Discover internet-facing hosts, open ports, and running services.

IP & host enrichment

Enrich indicators during Threat Intelligence work.

Known CVEs

Surface vulnerabilities reported on exposed services.

Recon with AI

Let Orion use Shodan for reconnaissance.

​
Before You Start

  • A Shodan account. Some endpoints (host search, on-demand scanning) need a paid plan or available query/scan credits.
  • A Collector that can reach api.shodan.io over outbound HTTPS.

​
Step 1 — Create the Credential in Shodan

1

Sign in

Go to account.shodan.io and sign in.
2

Copy your API key

On the Account page, copy your API Key.
3

Paste it into Myrmex

You’ll add it as the API token in the next step.
Shodan authenticates with the API key passed as a query parameter (?key=<APIKEY>) — there’s no username or password.

​
Step 2 — Add the Integration in Myrmex

From the Directory, choose Add Integration → Shodan, then fill in:

​
Connect

Click Connect to validate the API key. Shodan then appears under Environment → Integrations, and you can use it — live — in Threat Intelligence and recon.