> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Shodan

> Connect Shodan to Myrmex — add your account API key to map external exposure and enrich investigations in real time.

import { Note, Steps, Step, CardGroup, Card, Tip } from '@mintlify/components';

Connect **Shodan** so Myrmex can map your external attack surface — internet-exposed hosts, services, ports, and banners — and enrich investigations with device and IP intelligence. Myrmex queries the Shodan REST API in real time through a [Collector](/documentation/agent-endpoint-security/collector-mode).

<Note>
  Myrmex queries Shodan on demand and reads results in real time — nothing is stored on the Myrmex side.
</Note>

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="External exposure" icon="globe">
    Discover internet-facing hosts, open ports, and running services.
  </Card>

  <Card title="IP & host enrichment" icon="magnifying-glass">
    Enrich indicators during [Threat Intelligence](/documentation/detection-response/threat-intelligence) work.
  </Card>

  <Card title="Known CVEs" icon="bug">
    Surface vulnerabilities reported on exposed services.
  </Card>

  <Card title="Recon with AI" icon="robot">
    Let [Orion](/documentation/multi-agent-system/orion) use Shodan for reconnaissance.
  </Card>
</CardGroup>

## Before You Start

* A Shodan account. Some endpoints (host search, on-demand scanning) need a paid plan or available query/scan credits.
* A [Collector](/documentation/agent-endpoint-security/collector-mode) that can reach `api.shodan.io` over outbound HTTPS.

## Step 1 — Create the Credential in Shodan

<Steps>
  <Step title="Sign in">
    Go to `account.shodan.io` and sign in.
  </Step>

  <Step title="Copy your API key">
    On the **Account** page, copy your **API Key**.
  </Step>

  <Step title="Paste it into Myrmex">
    You'll add it as the API token in the next step.
  </Step>
</Steps>

<Note>
  Shodan authenticates with the API key passed as a query parameter (`?key=<APIKEY>`) — there's no username or password.
</Note>

## Step 2 — Add the Integration in Myrmex

From the **Directory**, choose **Add Integration → Shodan**, then fill in:

| Field           | Description                                                                                             |
| --------------- | ------------------------------------------------------------------------------------------------------- |
| **Name**        | A unique name for this Shodan instance.                                                                 |
| **Description** | Optional note to identify the account.                                                                  |
| **Collector**   | The [Collector](/documentation/agent-endpoint-security/collector-mode) that connects to the Shodan API. |
| **API URL**     | The Shodan API host (default `api.shodan.io`).                                                          |
| **Port**        | API port (default `443`).                                                                               |
| **API Key**     | Your Shodan account API key.                                                                            |

## Connect

Click **Connect** to validate the API key. Shodan then appears under **Environment → Integrations**, and you can use it — live — in [Threat Intelligence](/documentation/detection-response/threat-intelligence) and recon.