Before
A team member likely searched each IP address individually, reviewed the returned port findings, and recorded the relevant port, product, and protocol details. They then separated IPs with no findings from those with exposed ports and manually assembled and posted a report for the team.
How it works
- The workflow receives an emailhook event and loops through the configured IP addresses.
- It searches each IP for exposed ports, checks the response, and branches based on whether findings exist and how many ports are returned.
- It formats the results into exposed-port and no-exposed-port sections and posts the final report to Slack.
Workflow details
- Trigger and scope: An emailhook event starts the workflow, which iterates through the configured list of IP addresses to scan.
- Port discovery: Each IP address is searched in Shodan to determine whether exposed ports are reported and to retrieve available port, product, and transport details.
- Automated decisions: The workflow evaluates the search response and separates IPs with no exposed ports from IPs with one or more exposed ports. IPs with multiple findings are processed individually so each port can be included in the report.
- Report preparation: For exposed ports, the workflow builds readable entries containing the scanned IP, port number, product, and protocol. IPs without exposed ports are recorded in a separate section.
- Delivery: A consolidated ports scan report is posted to the designated Slack channel, giving the team a single message containing both exposed and non-exposed IP results.
What changed
Port checks now run automatically for every configured IP in the list, with the exposed-port decision and result formatting handled by the workflow. The team receives one consolidated Slack message instead of relying on a manually compiled report.
Work removed
Manually searching each IP address, reviewing port findings one by one, checking whether the response contains exposed ports, copying port and service details, separating no-finding results, assembling the summary, and posting the report to Slack.
Expected outcome
A repeatable port-visibility report is produced for each configured IP list, removing the recurring manual scan, comparison, and report-posting cycle.
