This integration transforms Shodan from a simple reconnaissance platform into a continuous security monitoring capability integrated directly into the organization’s SIEM.

In this article, I will show you step by step how to integrate these two solutions to map open ports in real time, analyze vulnerabilities, and quickly detect uninvited guests on your network.

This post follows one continuous, self-contained lab scenario — a simulated attacker brute-forcing RDP, logging in, attempting persistence, and getting caught — end to end through Wazuh.

Let’s deploy Wazuh agents on all the endpoints in my house!

Autonomous Detection, Response & Recovery on AWS using Wazuh and a SOAR Orchestrator

This guide describes how to upgrade a Wazuh Docker deployment from version 4.10 to 4.14.6 while preserving existing data and configuration.

Full technical report attached and GitHub repository