add a new modeling rule to shodan pack

Packs/Shodan/ModelingRules/Shodan/Shodan.xif

@@ -0,0 +1,14 @@
+[MODEL:dataset = "shodan_banner_raw"]
+  alter
+    has_triggers_obj = object_create("has_triggers",has_triggers),
+    expires_obj = object_create("expires",expires),
+    expiration_obj = object_create("expiration",expiration),
+    triggers_obj = object_create("triggers",replex(triggers,"[\\\"]","")),
+    internal_ipv4 = arrayindex(regextract(json_extract(filters,"$.ip"),"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0)
+| alter
+    xdm.alert.name = name,
+    xdm.session_context_id = id,
+    xdm.event.description = filters,
+    xdm.alert.description = object_merge(triggers_obj,has_triggers_obj,expires_obj,expiration_obj),
+    xdm.target.host.ipv4_addresses = arraycreate(internal_ipv4),
+    xdm.event.type = "NETWORK";

Packs/Shodan/ModelingRules/Shodan/Shodan.yml

@@ -0,0 +1,6 @@
+fromversion: 8.6.0  # Will be updated with XSIAM version updates
+id: Shodan_Banner_ModelingRule
+name: Shodan Banner Modeling Rule
+rules: ''
+schema: ''
+tags: ''

Packs/Shodan/ModelingRules/Shodan/Shodan_schema.json

@@ -0,0 +1,44 @@
+{
+    "shodan_banner_raw": {
+        "name": {
+            "type": "string",
+            "is_array": false
+        },
+        "expiration": {
+            "type": "string",
+            "is_array": false
+        },
+        "id": {
+            "type": "string",
+            "is_array": false
+        },
+        "size": {
+            "type": "int",
+            "is_array": false
+        },
+        "created": {
+            "type": "datetime",
+            "is_array": false
+        },
+        "expires": {
+            "type": "int",
+            "is_array": false
+        },
+        "filters": {
+            "type": "string",
+            "is_array": false
+        },
+        "triggers": {
+            "type": "string",
+            "is_array": false
+        },
+        "notifiers": {
+            "type": "string",
+            "is_array": false
+        },
+        "has_triggers": {
+            "type": "boolean",
+            "is_array": false
+        }
+    }
+}

Packs/Shodan/README.md

@@ -0,0 +1,26 @@
+# Shodan Banner
+ Shodan is a search engine for Internet-connected devices. Unlike traditional search engines that index websites, Shodan indexes information about the devices connected to the internet, such as servers, routers, webcams, and other IoT devices.
+<~XSIAM>
+
+This pack includes Cortex XSIAM content.
+
+## Configuration on Server Side
+To enable the Shodan integration you need to have an API key, 
+which you can get for free by creating a Shodan account https://account.shodan.io/register 
+Once you have an API key you insert it into the API Key field and click the Test button.
+
+## Configuration on Cortex XSIAM 
+&rarr;
+1. Navigate to **settings** &rarr; **Configurations** &rarr; **Automation & Feeds**.
+2. Search for Shodan v2.
+3. Click **Add instance** to create and configure a new integration instance.
+
+    | **Parameter** | **Description** | **Required** |
+    | --- | --- | --- |
+    | API Key |  | False |
+    | Base URL to Shodan API |  | True |
+    | Trust any certificate (not secure) |  | False |
+    | Use system proxy settings |  | False |
+    | Source Reliability | Reliability of the source providing the intelligence data. | False |
+    | The maximum number of events per fetch |  | False |
+</~XSIAM>

Packs/Shodan/ReleaseNotes/1_2_2.md

@@ -0,0 +1,6 @@
+
+#### Modeling Rules
+
+##### New: Shodan Banner Modeling Rule
+
+<~XSIAM> Created Modeling Rules for Shodan Banner (Available from Cortex XSIAM v2.4).</~XSIAM>

Packs/Shodan/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Shodan",
     "description": "A search engine used for searching Internet-connected devices",
     "support": "xsoar",
-    "currentVersion": "1.2.1",
+    "currentVersion": "1.2.2",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",
@@ -14,7 +14,10 @@
         "Free Enricher"
     ],
     "useCases": [],
-    "keywords": [],
+    "keywords": [
+        "Shodan",
+        "Banner"
+    ],
     "marketplaces": [
         "xsoar",
         "marketplacev2"