Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)
A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.
Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.
- Cowrie emulates SSH and Telnet on the DShield sensor to log attacker activity.
- batch.py consolidates web, firewall and Cowrie logs into a single analysis pipeline.
- Tool generates SHA-256 master/guest tokens and supports least-privilege access.
- Organizations
- SANS
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 2ec37a7cc8daf20b10e1ad6221061ca5 | the malicious actor’s secure shell client hash fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5 showing an established session. Attempt number 6 shows a fa |
From the original article
11 min read at isc.sans.edu
[This is a Guest Diary by Frank Igbokwe, an ISC intern as part of the SANS. edu BACS program]
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.