Main Attack empty (Terraform on AWS), but Kibana dashboards show attacks

[claudiopolis]

A few weeks ago (21-May to be exact) I tested out the Terraform scripts and spun up a Honeypot I could use to demo in an Intro To Cybersecurity class I teach a few times a year. It worked brilliantly, and I was looking forward to using it as a demo during class. My profound thanks to everyone who has contributed to this project.

Yesterday and today, when I follow the same steps, the attack map is blank, even after waiting hours. I tried all the status/health checks I could find, confirmed firewall rules on AWS, even tried some fake logins on well known ports/services, and nothing shows up. I even tried using another AWS region in case .

Then I went to look some more at the latest instance, and saw the individual maps in Kibana, and they DO show attacks. So, it's a clue. Please see the linked screenshots. Any pointers for me to help troubleshoot this and inform the community? TIA!

Attack Map

Cowrie Dashboard

[t3chn0m4g3]

I only see a clue, the Honeypot Stats in the upper left usually show the stats after 10 seconds, in the screenshot they are empty. This shows the connection between the DataServer and ES is broken.

Works fine in a test VM.

@shaderecker Do you have an idea?

[shaderecker]

No, sorry not from the first glance.