SANS ISC guest diary details batch.py tool for consolidating DShield Honeypot-Omaha logs and enriching IOCs

The only substantive item in this batch is a SANS Internet Storm Center guest diary describing batch.py, a Python tool that consolidates honeypot logs (web, firewall, and Cowrie) from the DShield Honeypot-Omaha sensor and enriches indicators with MITRE, CVE,…

A SANS Internet Storm Center guest diary titled 'Honeypot-Omaha and batch.py' (feed timestamp 2026-09-03T02:02:56Z, labeled Wed, Sep 2nd), written by a SANS.edu BACS intern, describes analysis of the DShield Honeypot-Omaha sensor. The sensor uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline that consolidates JSON and log files (web, firewall, and Cowrie logs) into a single analysis workflow, correlates data via external APIs, and produces MITRE, CVE, geolocation, threat-score, and fingerprint enrichment for investigated indicators. The tool generates SHA-256 master and guest authentication tokens and supports least-privilege access. The remaining four reports in this batch — ISC Stormcast daily podcast episodes for Wednesday September 2, Thursday September 3, Friday September 4, and Tuesday September 8, 2026 — contain only podcast links and licensing boilerplate, with no incidents, vulnerabilities, or advisories described. The reports do not conflict with one another; they simply vary in the level of detail available.

• SANS ISC guest diary 'Honeypot-Omaha and batch.py' was authored by a SANS.edu BACS intern (feed timestamp 2026-09-03T02:02:56Z, dated Wed, Sep 2nd).
• The DShield Honeypot-Omaha sensor uses Cowrie to emulate SSH and Telnet and log attacker activity.
• batch.py is a Python tool implementing a four-phase pipeline that consolidates web, firewall, and Cowrie logs (JSON and log files) into a single analysis pipeline.
• The tool correlates data via external APIs and generates MITRE, CVE, geolocation, threat-score, and fingerprint enrichment for investigated indicators.
• batch.py generates SHA-256 master and guest authentication tokens and supports least-privilege access.
• No specific CVE IDs, software versions, incident counts, or victim/attacker identifiers are stated in any of the five reports.
• ISC Stormcast daily podcast episodes for September 2, 3, 4, and 8, 2026 (podcast IDs 10078, 10080, 10082, 10084) contain only licensing and URL metadata with no substantive threat details.