Censys module.
Censys enriches your organization's IP and domain IOCs with exposed services and certificate data. Saving a key validates it against Censys and consumes API quota (250 lookups/month on the free tier). It is a bring-your-own-key integration: create a Censys account, generate an API token, and paste it into the module once for the whole billing account. Every new IP indicator that arrives after that is looked up automatically.
You need a Censys account and an API token generated from it. Saving the token spends quota, because Liberty91 validates it with a real lookup rather than a free test call. On the free tier you have 250 lookups a month, so save once and check the banner rather than saving repeatedly.
How to connect Censys
- Sign in to Censys, or create an account if you do not have one, and generate an API token.
- In Liberty91, go to Modules, open the Analysis Modules section, and click the Censys tile.
- Paste the token into the API token field.
- Turn on Active and click update.
Checking the connection
There is no separate Test button, because saving is the health check. When you save, Liberty91 calls Censys with the token you pasted and reports what came back. A green Connected banner means the credential works, and a red banner means it does not. If you leave the page and return later, a blue Status banner shows the result of the last save rather than re-testing, which is also why returning to the page costs you nothing.
| Message | What it means |
|---|---|
API key validated | The token works and the module is ready to enrich |
Invalid API key | Censys rejected the token. Generate a new one and paste it again |
Censys rate limit reached, try again later | Your Censys plan is out of requests for the moment. Nothing is wrong with the token |
Could not reach Censys | Liberty91 got no response at all, usually a transient network problem |
Censys returned HTTP <code> | Censys answered with something unexpected, and the code says what |
Leave the API token field blank when you save and the stored token is kept. That is how you turn Active off and on again without retyping it, and it avoids spending another lookup. Tokens are encrypted at rest and never sent back to the browser, so the field looks empty even when a token is stored.
The module also shows IOCs enriched as a running total, which is the quickest way to confirm that indicators really are being processed.
What you get from Censys enrichment
Censys lookups run against host data, so it is IP indicators that get enriched. Each one that arrives after the token is saved is looked up, and what Censys knows about the host, when host data is available for that address, becomes a verdict and a score from 0 to 100.
| What Censys reports about the host | Verdict | Score |
|---|---|---|
| Known malware families on the host | Malicious | 85 |
| Anything else, including a host it knows well and finds nothing on | Unknown | Not set |
Censys never returns Benign, and that is deliberate. A host with no known malware families on it has produced no signal, which is a different claim from the host being known good. Do not build allow-listing on Unknown. The same rule applies to AbuseIPDB below its reporting threshold, and both are covered on IOC enrichment and decay scoring.
In the platform you see a Censys chip on the indicator's row and in its panel, showing the
number of services on the host and then up to six of the service names, so you can read what
the host is running at a glance. In an IOC CSV export, CENSYS appears in the
enrichment_providers column, and over the API the same value comes back in the
enrichment_providers and enrichments fields on the IOC endpoints, where
you can also filter for it with ?enrichment_provider=CENSYS.
Censys and Shodan both describe what a host exposes and they draw on different scan data, so running both gives you two independent readings of the same address rather than the same reading twice.
Permissions and limits
Any member of the billing account can configure this module. There is no Owner or Admin gate on it, unlike the ransomware domain alerts, which are restricted.
- One token per billing account, shared by everyone on it.
- Saving is rate-limited to 12 attempts a minute per user, so repeated retries pause briefly.
- Enrichment runs in batches of up to 100 indicators.
- Every validation and every lookup counts against your Censys quota.
Frequently asked questions
Does saving a Censys token cost me anything?
Yes. Saving validates the token against Censys with a live lookup, which consumes API quota. The free tier allows 250 lookups a month, so avoid saving repeatedly to test.
Why does Censys never return Benign?
Because a host with no known malware families on it has produced no signal, not a clean bill of health. Censys writes Malicious when it finds malware and Unknown otherwise.
Do I have to retype the token to turn the module off and on?
No. Leave the API token field blank when you save and the stored token is kept, so you can flip Active off or on without it.