Events Log

The Events Log contains a history of events that were triggered within the past 2 weeks. There are 2 types of events:

1. Service Notification: events that describe notifications sent out based on triggers for asset groups. For example, if Shodan discovers that port 80 is newly open for a monitored asset then it would send out a notification and store an event.
2. Asset Group Changed: events that store information about changes in dynamic asset groups. For example, if we’re monitoring the domain www.shodan.io and the IP associated with the hostname changes then it would fire an asset_group_changed event. Asset groups based on hostname/ domain or search query are able to generate asset_group_changed events. The user changing the list of IPs/ networks in an asset group doesn’t create an event.

Developer Access

In addition to the website, the Events Log information is also available as an RSS feed, Atom feed or via the Events Log API. All of those require providing your Shodan API key which can be found on the account page:

• Events Log API: https://monitor.shodan.io/api/v1/events?key=YOUR_API_KEY A single URL that will return the 100 most recent events as a JSON array.
• RSS feed: https://monitor.shodan.io/events.rss?key=YOUR_API_KEY
• Atom feed: https://monitor.shodan.io/events.atom?key=YOUR_API_KEY

The RSS feed URL can be accessed from the website by clicking on the RSS icon next to the Events Log heading: