Weekly internet exposure tracker with Censys and Sheets
Every Monday, log a snapshot of your internet-exposed services to a spreadsheet and watch how your external attack surface shifts week over week.
Censys
Google SheetsEngineeringOperationsResearch & MonitoringData SyncEvery Monday at 6am, take a snapshot of my organization's internet-exposed services using Censys and log it to a Google Sheets tracking tab so I can watch how our external exposure changes week over week. This workflow is fully deterministic: run the aggregations, format the results into rows, and append them. No reasoning, judgement, or summarization is needed.
Use the Censys 'Aggregate Search Results' operation (the Report Builder aggregation) to produce the counts. Run it twice against the same CenQL scope query that defines my organization's internet-facing assets (my domains and IP ranges): the first aggregation buckets results by port/protocol, and the second buckets results by software/product. Each aggregation returns a set of buckets, where every bucket has a label (the field value) and a count. The CenQL scope query, the two aggregation field names, and the number of buckets to return are inputs I provide.
My Censys connection includes the Organization ID, which the aggregation requires. Pass it on every call to Censys.
Compute the run date once as the date the workflow runs, formatted as YYYY-MM-DD. For each bucket returned by both aggregations, build one spreadsheet row containing: the run date, which breakdown it came from ('port/protocol' or 'software/product'), the bucket label, and the bucket count. Stamping every row with the run date is what turns the sheet into a time series.
Append all of those rows to my Google Sheets tracking tab using the 'Append Values' operation, adding them after the last existing row so previous weeks are preserved. The target spreadsheet, the tab name, and the column layout (Run Date, Breakdown, Label, Count) are inputs I provide.
Additional information
What does this prompt do?
- Runs automatically every Monday morning and takes a fresh inventory of the services your organization exposes to the internet.
- Breaks that inventory down two ways: by open port and protocol, and by the software or product each service runs.
- Adds every bucket, its count, and the run date to a Google Sheets tab so each week appends a new set of rows.
- Turns your spreadsheet into a running time series you can chart to spot new, growing, or shrinking exposure over time.
What do I need to use this?
- A Censys account with a personal access token and your Censys Organization ID.
- A Google account with edit access to the spreadsheet you want to log to.
- A search that describes your organization's internet-facing assets, such as your domains and IP ranges.
- A destination spreadsheet and tab name to append the results into.
How can I customize it?
- Change the schedule from Monday at 6am to whatever review cadence fits your team.
- Adjust the search that defines which domains and IP ranges count as yours.
- Swap the two breakdown fields, for example grouping by certificate issuer or country instead of software.
- Point it at a different spreadsheet or tracking tab.
Frequently asked questions
What does 'internet exposure' mean here?
Will this overwrite my spreadsheet every week?
Do I need a paid Censys plan?
Can I change how the results are grouped?
How often does it run?
Related templates
Stop guessing how your attack surface is changing.
Set up an automated weekly exposure log and watch your internet footprint trend in one spreadsheet.