Shodan

Technical summary

Shodan for NEXUS queries the Shodan API to enrich IPs detected in tasks and comments, with a MySQL cache (shodan_cache) and configurable TTL (1–168h, default 24h). The integration registers an Intel Hub enricher (priority 43) that processes IP artifacts automatically, with configurable live lookup budget and cache fallback. Lookups normalize ports, services, banners, CVEs, geolocation and ASN, with banner sanitization (180-char truncation). The rose-themed 3-tab UI (IP Lookup, History, Configuration) includes masked API key input, enrichment toggles, and banner/CVE inclusion selectors.

Executed scope

• plugin.php (45 lines): "Shodan" tab under "OSINT & Enrichment" with radar icon, doc, Intel Hub enricher (shodan_intel_enrich, type ip, priority 43), 5 API actions.
• backend.php (643 lines): lazy install via install.sql, shodan_api_host() with 25s curl, host normalization (ports, services, CVEs), cache with INSERT ... ON DUPLICATE KEY UPDATE, IP extraction (IPv4+IPv6, regex, 5/doc limit), markdown generation, enricher with live lookup budget and cache fallback.
• tab.php (365 lines): Alpine.js 3-tab UI (IP Lookup, History, Configuration), rose theme, KPI cards (cache, today, with ports, with CVEs), password API key input, enrichment toggles, cache TTL.
• fastr.json: /shodan <ip> slash command for direct lookup via shodan_lookup.
• doc.md (63 lines): author's technical documentation (PT).
• icon.png: Shodan brand icon (PNG).