Polarity

Introduction

This guide explains how to integrate Shodan data into your Polarity workflows using the official Polarity Shodan Integration. This integration allows Polarity to query Shodan and display contextual information about IP addresses, domains, and other observables directly within your existing tools and applications.

Prerequisites

1. Polarity Framework Installed: A running Polarity Server and access to the Polarity Desktop Client or Web Client.
2. Shodan API Key: You will need a Shodan API key to authenticate with the Shodan API. You can obtain or find your API key on your Shodan account page.

Usage

1. Open Polarity Client:

   Launch your Polarity Desktop Client or access the Polarity Web Client.

2. Configure the Integration:

   • Click the Integration button (or similar, depending on your Polarity version).
   • In the list of integrations, click on the Shodan integration entry.
   • Edit Settings: You will see a panel with various configuration options. The most critical setting is the API Key. That is where you provide the Shodan API Key.
   • After entering your API key and adjusting other settings, click the SAVE button.

3. See the Overlay:

   When an observable that can be queried by Shodan is detected, Polarity will display an overlay with real-time Shodan information. This overlay appears seamlessly within your existing application.

Example

If you highlight or simply view an IP address like 1.1.1.1, Polarity will query Shodan and display details such as open ports, services, banners, vulnerabilities, the owning organization, and geographical location (country, city, coordinates).