Track Internet Exposure Weekly with Censys and Google Sheets

PromptCreate

Every Monday at 6am, take a snapshot of my organization's internet-exposed services using Censys and log it to a Google Sheets tracking tab so I can watch how our external exposure changes week over week. This workflow is fully deterministic: run the aggregations, format the results into rows, and append them. No reasoning, judgement, or summarization is needed.

Use the Censys 'Aggregate Search Results' operation (the Report Builder aggregation) to produce the counts. Run it twice against the same CenQL scope query that defines my organization's internet-facing assets (my domains and IP ranges): the first aggregation buckets results by port/protocol, and the second buckets results by software/product. Each aggregation returns a set of buckets, where every bucket has a label (the field value) and a count. The CenQL scope query, the two aggregation field names, and the number of buckets to return are inputs I provide.

My Censys connection includes the Organization ID, which the aggregation requires. Pass it on every call to Censys.

Compute the run date once as the date the workflow runs, formatted as YYYY-MM-DD. For each bucket returned by both aggregations, build one spreadsheet row containing: the run date, which breakdown it came from ('port/protocol' or 'software/product'), the bucket label, and the bucket count. Stamping every row with the run date is what turns the sheet into a time series.

Append all of those rows to my Google Sheets tracking tab using the 'Append Values' operation, adding them after the last existing row so previous weeks are preserved. The target spreadsheet, the tab name, and the column layout (Run Date, Breakdown, Label, Count) are inputs I provide.

What does this prompt do?

Runs automatically every Monday morning and takes a fresh inventory of the services your organization exposes to the internet.
Breaks that inventory down two ways: by open port and protocol, and by the software or product each service runs.
Adds every bucket, its count, and the run date to a Google Sheets tab so each week appends a new set of rows.
Turns your spreadsheet into a running time series you can chart to spot new, growing, or shrinking exposure over time.

What do I need to use this?

A Censys account with a personal access token and your Censys Organization ID.
A Google account with edit access to the spreadsheet you want to log to.
A search that describes your organization's internet-facing assets, such as your domains and IP ranges.
A destination spreadsheet and tab name to append the results into.

How can I customize it?

Change the schedule from Monday at 6am to whatever review cadence fits your team.
Adjust the search that defines which domains and IP ranges count as yours.
Swap the two breakdown fields, for example grouping by certificate issuer or country instead of software.
Point it at a different spreadsheet or tracking tab.

FAQs

What does 'internet exposure' mean here?

It refers to the services your organization runs that are reachable from the public internet, such as web servers, mail servers, and remote-access endpoints. Censys scans the internet and reports what it can see facing outward, which is a close approximation of what an outside attacker would find.

Will this overwrite my spreadsheet every week?

No. Each run appends new rows after the last existing row and stamps every row with the run date, so previous weeks are preserved and the tab builds up into a time series you can chart.

Do I need a paid Censys plan?

You need a Censys account with a personal access token, and this workflow uses your Censys Organization ID on the connection. Aggregations consume Censys credits, so check that your plan covers the volume you expect from a weekly run.

Can I change how the results are grouped?

Yes. The two breakdowns default to port and protocol and to software and product, but you can point them at other fields Censys tracks, such as certificate issuer, service name, or country.

How often does it run?

By default it runs every Monday at 6am, and you can change that to any schedule that matches how often you want to review your external exposure.

Related templates

Call overdue Xero customers with an AI collections agent

Every weekday at 10am, an AI voice agent phones your most overdue Xero accounts, logs what each customer promised, and reports back to finance in Slack.