Weekly internet exposure tracker with Censys and Sheets

Every Monday, log a snapshot of your internet-exposed services to a spreadsheet and watch how your external attack surface shifts week over week.

Deterministic Code
CensysGoogle SheetsEngineeringOperationsResearch & MonitoringData Sync
PromptCreate

Every Monday at 6am, take a snapshot of my organization's internet-exposed services using Censys and log it to a Google Sheets tracking tab so I can watch how our external exposure changes week over week. This workflow is fully deterministic: run the aggregations, format the results into rows, and append them. No reasoning, judgement, or summarization is needed.

Use the Censys 'Aggregate Search Results' operation (the Report Builder aggregation) to produce the counts. Run it twice against the same CenQL scope query that defines my organization's internet-facing assets (my domains and IP ranges): the first aggregation buckets results by port/protocol, and the second buckets results by software/product. Each aggregation returns a set of buckets, where every bucket has a label (the field value) and a count. The CenQL scope query, the two aggregation field names, and the number of buckets to return are inputs I provide.

My Censys connection includes the Organization ID, which the aggregation requires. Pass it on every call to Censys.

Compute the run date once as the date the workflow runs, formatted as YYYY-MM-DD. For each bucket returned by both aggregations, build one spreadsheet row containing: the run date, which breakdown it came from ('port/protocol' or 'software/product'), the bucket label, and the bucket count. Stamping every row with the run date is what turns the sheet into a time series.

Append all of those rows to my Google Sheets tracking tab using the 'Append Values' operation, adding them after the last existing row so previous weeks are preserved. The target spreadsheet, the tab name, and the column layout (Run Date, Breakdown, Label, Count) are inputs I provide.

Additional information

What does this prompt do?
  • Runs automatically every Monday morning and takes a fresh inventory of the services your organization exposes to the internet.
  • Breaks that inventory down two ways: by open port and protocol, and by the software or product each service runs.
  • Adds every bucket, its count, and the run date to a Google Sheets tab so each week appends a new set of rows.
  • Turns your spreadsheet into a running time series you can chart to spot new, growing, or shrinking exposure over time.
What do I need to use this?
  • A Censys account with a personal access token and your Censys Organization ID.
  • A Google account with edit access to the spreadsheet you want to log to.
  • A search that describes your organization's internet-facing assets, such as your domains and IP ranges.
  • A destination spreadsheet and tab name to append the results into.
How can I customize it?
  • Change the schedule from Monday at 6am to whatever review cadence fits your team.
  • Adjust the search that defines which domains and IP ranges count as yours.
  • Swap the two breakdown fields, for example grouping by certificate issuer or country instead of software.
  • Point it at a different spreadsheet or tracking tab.

FAQs

What does 'internet exposure' mean here?
It refers to the services your organization runs that are reachable from the public internet, such as web servers, mail servers, and remote-access endpoints. Censys scans the internet and reports what it can see facing outward, which is a close approximation of what an outside attacker would find.
Will this overwrite my spreadsheet every week?
No. Each run appends new rows after the last existing row and stamps every row with the run date, so previous weeks are preserved and the tab builds up into a time series you can chart.
Do I need a paid Censys plan?
You need a Censys account with a personal access token, and this workflow uses your Censys Organization ID on the connection. Aggregations consume Censys credits, so check that your plan covers the volume you expect from a weekly run.
Can I change how the results are grouped?
Yes. The two breakdowns default to port and protocol and to software and product, but you can point them at other fields Censys tracks, such as certificate issuer, service name, or country.
How often does it run?
By default it runs every Monday at 6am, and you can change that to any schedule that matches how often you want to review your external exposure.

Related templates

Log daily Mercury balances and alert when cash runs low

Every weekday morning, every account balance is logged to a spreadsheet, and you only hear about it in Slack when one drops below the limit you set.

Mercury
Google Sheets
Slack
Deterministic Code
Log Netlify form submissions to Sheets and email the team

Every contact and demo request from your Netlify site lands as a row in your tracking spreadsheet and as an email to your shared team inbox.

Netlify
Google Sheets
Gmail
Deterministic Code
Auto-file completed Documenso contracts in Box and Sheets

When a contract finishes signing, the signed PDF and its certificate land in Box by quarter, your register updates and your ops channel hears about it.

Documenso
Box
Google Sheets
+1
Deterministic Code
Weekly Netlify build health report across every site

Every Monday, get one email that reads build health across all of your Netlify sites, flags which ones got flakier, and logs a running history.

Netlify
Gmail
Google Sheets
Agentic Task
Weekly social performance digest to Slack and Sheets

Every Monday, see which posts actually worked across every social platform, what the winners have in common, and what to publish more of this week.

bundle.social
Slack
Google Sheets
Agentic Task
Auto-write and localize Shopify product copy in four languages

Every new Shopify product gets an SEO description written for you, plus French, German and Spanish copy ready for your team to load.

Shopify
Mistral AI
Google Sheets
+1
Agentic Task

Stop guessing how your attack surface is changing.

Set up an automated weekly exposure log and watch your internet footprint trend in one spreadsheet.

Explore more promptsCreate