ShadowSight runs without an error but I see no sightings in vulnerability lookup.

[matpanel]

Hi!
I would like some help as ShadowSight appears to run without a problem, but I see nothing in vulnerability lookup.

So, I run this command (and the export command previously) and there were no complaints or errors ...
$ ShadowSight --since 2025-01-01
Querying for 2025-01-01…
Querying for 2025-01-02…
Querying for 2025-01-03…
Querying for 2025-01-04…
...
Querying for 2025-08-26…
Querying for 2025-08-27…
Querying for 2025-08-28…
Querying for 2025-08-29…
Querying for 2025-08-30…
Querying for 2025-08-31…
Querying for 2025-09-01…
Querying for 2025-09-02…
Querying for 2025-09-03…

Did it simply query and not find something?
Because, all the lines were the same.

The shadowserver api key and my vulnerability_auth_token seem to be just fine... The same auth_token works on the other sighting tools (nucleivuln and exploitdbsighting).

How can I troubleshoot it?

The above queries give 0 results
sightings/?query=honeypot%2Fexploited-vulnerabilities
sightings/?query=honeypot%2Fcommon-vulnerabilities
sightings/?query=Shadowserver

Thank you for all your help.

--Panos

[matpanel]

Ok. I logged in and in the /admin/monitoring/processes page it says:
honeypot_exploited_vulnerabilities: Error from Shadowserver API.
So, most likely it has to do with my API key? hmm
I will try to find some way to test my key with some curl command...

[matpanel]

So...
I read this https://github.com/The-Shadowserver-Foundation/api_utils/wiki/call_api-Documentation
Downloaded this https://github.com/The-Shadowserver-Foundation/api_utils/blob/main/call-api.py
wget https://github.com/The-Shadowserver-Foundation/api_utils/raw/refs/heads/main/call-api.py
created this file in my home directory ~/.shadowserver.api

[api]
key = <<API-KEY>>
secret = <<SECRET>>
uri = https://transform.shadowserver.org/api2/

and then run
$ python3 call-api.py honeypot/exploited-vulnerabilities '{"limit":10}' binary
and I got ...
API Exception: HTTP Error 401: Unauthorized

So there is a problem with my API key after all.

[cedricbonhomme]

Hello,
I will be surprised that you can have access to this data via API for free. Do you pay to have access to the data ?

[matpanel]

We do have a Shadowserver API key as a CERT in order to get the daily reports.
I assumed I could use the same key for accessing this data as well.

[cedricbonhomme]

From what I know, a single API key do not necessary give access to all the datasets from Shadowserver. We have several API keys and for the sighting tool running in production we are using a specific one. So that might be the problem.

[matpanel]

Yes, I guess you are right.
It mentions the following in this link https://github.com/The-Shadowserver-Foundation/api_utils/wiki/API:-Honeypot

Access to methods in this module are limited to members of the honeypot group.

[matpanel]

Confirmed. It requires another API key which we cannot have.

[P-T-I]

I'm running into the same issue.... @cedricbonhomme Do you use a paid subscription of some kind?

[cedricbonhomme]

I am almost sure, yes. @adulau knows more than me on this.