Before
Security or network teams likely had to run recurring exposure searches manually, review result pages and product categories, and copy findings into a report. They then had to format the report and send its location to the responsible team, creating repeated handoffs for each scan.
How it works
- A scheduled run builds the search criteria and checks whether exposed IP camera results exist within the defined network scope.
- If results are present, the workflow counts product categories, processes all result pages, and captures the relevant host, service, location, and banner information.
- It creates and formats a spreadsheet report, populates it with the findings, and posts the report link to the responsible Slack channel.
Workflow details
- Scheduled monitoring: The workflow starts on a predetermined schedule and builds network and location-based search criteria for identifying IP camera exposures.
- Exposure discovery: It first checks whether matching results exist, identifies the product categories returned by the search, and retrieves all available result pages for each category.
- Structured reporting: When matches are found, the workflow creates a dated spreadsheet, adds headers, formats the columns, and records product, version, host, port, hostname, location, and banner details for each result.
- Automated handoff: After the report is populated, the spreadsheet is formatted for review and its URL is posted to the responsible team in Slack.
- No-match handling: If the initial search returns no matches, the workflow completes without creating the exposure report or sending the report notification.
What changed
Exposure checks now run on schedule without a person initiating each search or assembling the results. Matching findings are automatically consolidated into a formatted spreadsheet and handed to the responsible team through Slack, while no-match scans end without creating an unnecessary report.
Work removed
Running recurring Shodan searches, checking whether results exist, counting product categories, paging through matches, copying findings into a spreadsheet, formatting report columns, and manually notifying the responsible team.
Expected outcome
Each scheduled run can replace roughly five recurring manual action groups—searching, reviewing pages, compiling findings, formatting the report, and notifying the team—while providing a consistent exposure report whenever matches are identified.
