Utilising the honeypot

[rxerium]

Hi there,

Quick 2 questions:

1. Other than the dashboards on Kibana are there ways to see the exact requests/attacks being targeted at the honeypot? If so where can I find this?
2. Do you have any guides on how to fully utilise the honeypot?

Thanks all

Rishi

[rxerium]

Hey, does anyone have any insight into this?

[dmille6]

i use it in a few ways:

• i've built a python script that runs every hour, it queries the elasticsearch server and pulls all the data from the last hour.. parses and consolidates it, then submits it to alienvault otx and some other open source threat communities.

• i have another script the uses scp to pull the malware from each honeypot every day then runs the hashes through virustotal.com if the hashes are in virustotal, i dont do anything, if its new and not in the virus total db i submit it.

• i have another python script that also runs once an hour that pulls data from the ES index, consolidates it and puts the ip addresses, web addresses, file hashes into another opensource project called OpenCTI.

[wizhardhacker1]

do you have a way to extract the IPs from attackers and put in a text file that can be updated constantly??