Automated Attack Surface Monitoring with n8n and Shodan

Your external attack surface is dynamic, with new open ports, misconfigurations, and shadow IT appearing long before your next scheduled perimeter scan. Traditional monitoring tools often flood IT teams with repetitive alerts, leading to alert fatigue where critical vulnerabilities get lost in the noise. I built an automated solution using n8n and Shodan that tracks these changes continuously and only alerts you when a genuine state change occurs.

The Reality of Dynamic Attack Surfaces

Unlike internal networks, your external attack surface is exposed to the public internet around the clock. Assets come and go, and infrastructure configurations change rapidly to adapt to business needs [4]. Cloud sprawl, shadow IT—unsanctioned technologies deployed without IT oversight—and orphaned subdomains have made tracking what is actually exposed a moving target [4, 5]. Point-in-time scans, whether performed monthly or quarterly, leave massive blind spots in your security posture. A developer might spin up a temporary database for testing and forget to close the port. If your next vulnerability scan is not scheduled for another three weeks, that open port remains a glaring entry point for attackers.

Continuous attack surface management is required to discover and prioritize exposed assets in near real-time [2]. This approach ensures that the time taken between an environment change and its detection is minimized [2]. However, shifting from periodic to continuous scanning introduces a new logistical problem: the sheer volume of data generated. When you scan your perimeter daily or hourly, you need a way to process that data without overwhelming your team.

Why Traditional Monitoring Fails Small Businesses

For small and mid-sized businesses, IT and security resources are strictly limited. When you implement basic continuous monitoring, the default behavior of many tools is to report on every single finding during every single scan. If you have 50 public-facing IP addresses and five open ports per IP, a daily scan generates 250 data points. If the system alerts you to the presence of these same 250 ports every day, your team will quickly develop alert fatigue.

Genuine threats—like a newly exposed Remote Desktop Protocol (RDP) service or a recently disclosed Common Vulnerabilities and Exposures (CVE) identifier—become buried under a mountain of redundant notifications. SMBs rarely have dedicated Security Operations Centers to manually triage this noise. They need systems that provide continuous visibility without the operational overhead of false positives. The goal is actionable security intelligence: knowing exactly when a configuration changes from a known baseline to a potentially vulnerable state, and receiving technical proof of that exposure [1].

Engineering a Stateless Diff Engine with n8n and Shodan

To address the dual problems of unseen threats and alert fatigue, I engineered an advanced automation workflow using n8n and Shodan. By combining Shodan’s vast internet-scanning capabilities with n8n’s workflow automation, you can build a system that periodically checks your organization’s public footprint [3]. While Shodan Monitor can watch declared IP ranges continuously [5], relying solely on static IP tracking misses dynamic subdomains and lacks customized filtering logic.

The core innovation of this specific solution is a stateless diff engine. Instead of alerting on the absolute state of the network, the engine establishes a baseline for every host and intelligently compares the current scan data against this historical baseline. The workflow integrates directly with the Shodan DNS API to automatically discover and enumerate subdomains, resolve their associated IP addresses, and thoroughly profile each host.

During this profiling phase, the system specifically monitors for changes in highly sensitive ports. These include FTP, SSH, Telnet, HTTP/S, SMB, RDP, and various proxy services. It also cross-references the findings to identify newly published CVEs associated with the detected software versions. The diff engine ensures that if an SSH port was open yesterday and is still open today, no alert is generated. But if a new FTP server appears, or if Shodan flags a newly critical CVE on an existing web server, the workflow triggers a rich-embed message directly to a Discord channel. This strictly limits notifications to new exposures, effectively reducing the noise to zero while maintaining continuous clarity.

Step-by-Step: Automating Your Perimeter Monitoring

Implementing this system transforms external perimeter monitoring from a reactive, manual task into a proactive, hands-off process. Here is how to replicate this architecture for your own infrastructure.

1. Define Your Scope: Begin by mapping your known external perimeter. Gather your organization’s CIDR blocks, static IP addresses, and root domains. This forms the seed data for the automated discovery process.
2. Deploy n8n and the Shodan Integration: Set up an instance of n8n. To integrate Shodan, navigate to Settings, then Community Nodes, and install n8n-nodes-shodan [6]. You will need an active Shodan API key to authenticate the node and perform queries.
3. Automate Subdomain Enumeration: Configure the workflow to query the Shodan DNS API using your root domains. The workflow should extract all known subdomains and resolve them to their current IP addresses. This step is critical for catching shadow IT hosted on forgotten subdomains.
4. Build the Stateless Diff Logic: This is the engine of the workflow. Configure n8n to store the JSON output of the current scan (the baseline). On the next execution, use n8n’s data manipulation nodes to compare the new Shodan output against the stored baseline. You are looking specifically for delta values—new rows that indicate something changed on your perimeter [5].
5. Filter for High-Risk Ports and CVEs: Do not alert on every change. Route the diff output through a filter node that isolates sensitive ports (such as FTP, SSH, Telnet, SMB, and RDP) and checks for the presence of new CVE identifiers. If a new marketing subdomain opens port 80, it may be expected; if it opens a database port, it feeds into your risk model as a high-priority threat [1].
6. Route Actionable Alerts: Connect the filtered output to a messaging node (like Discord or Slack). Format the payload as a rich embed containing the affected IP, the resolved subdomain, the newly opened port, and any associated CVE data. This provides the engineering team with immediate technical evidence [1].

Common Pitfalls in Attack Surface Management

When businesses attempt to automate their security monitoring, they often fall into a few predictable traps that undermine the effectiveness of the system.

• Alerting on static states: The most common mistake is configuring alerts for the presence of a vulnerability rather than the discovery of one. If you alert on static states, your team will ignore the channel within a week. Always diff the output against the previous run [5].
• Ignoring dynamic assets: Scanning only a rigid list of static IPs ignores the reality of modern infrastructure. Subdomains must be continuously enumerated and resolved, as cloud environments and dev teams frequently spin up new assets outside of documented IP ranges.
• Scanning too infrequently: Because development and operations changes can occur daily, scanning must match that cadence. Relying on weekly or monthly sweeps ensures that the time taken between an environment change and detection remains dangerously wide [2].

Key takeaways

• External attack surfaces are highly dynamic; point-in-time scans leave unacceptable blind spots between testing windows.
• Traditional continuous monitoring often creates alert fatigue by repeatedly notifying teams of known, existing issues.
• Integrating n8n with the Shodan API allows you to automate the discovery and profiling of external assets, including orphaned subdomains.
• Implementing a stateless diff engine ensures you only receive alerts when a genuine state change occurs, such as a newly opened RDP port or a newly published CVE.
• Filtering alerts to focus exclusively on actionable intelligence drastically reduces operational noise and allows IT teams to focus on real threats.

Sources

1. Shodan — ThreatNG Security – External Attack Surface Management (EASM) – Digital Risk Protection – Security Ratings [1]
2. Continuous Attack Surface Management: An Easy Guide [2]
3. Monitor Internet-Facing Assets with Shodan and n8n [3]
4. Qualys Integrates with Shodan to Help Map the External Attack Surface | Qualys [4]
5. Shodan Tutorial: OSINT Attack Surface Recon in 12 Steps [5]
6. N8N | Shodan Book [6]

Recommended reading & tools

• Black Hat Python, 2nd Edition (No Starch Press)
• How Cybersecurity Really Works (No Starch Press)

As an Amazon Associate I earn from qualifying purchases.

Need a hand with this? CyberResonance helps small and mid-sized businesses with security audits, penetration testing and production-grade n8n automation. See the services or learn more about Kacper.