Overview
The purpose of this is app is to provide dashboards and metrics to aid in increasing the engagement of attackers on your SSH honeypot. The goal of the metrics is to allow you to observe the behavioral changes of the attackers when configuration changes are made to the honeypot. By increasing the engagement level of your attackers you should be able to obtain higher quality threat intelligence than a default installation while still remaining low-interaction.
Details
In order to fully utilize the visualizations in Engaged Threat you will need to install the "Sankey Diagram - Custom Visualization” App located here -
https://splunkbase.splunk.com/app/3112
Next install the “Virustotal Checker” Splunk app by following the link below. This will allow you to pull in Virus Total information for the files downloaded on your honeypot.
https://splunkbase.splunk.com/app/2671/
Restart Splunk after you’ve installed the above apps.
Key Notes
The Engaged Threat Splunk App is built using the JSON logging from Cowrie SSH Honeypot. Cowrie is an SSH honeypot that was forked from Kippo by Michael Oosterhof and can be found here.
https://github.com/micheloosterhof/cowrie
For Cowrie JSON logs to be indexed by Splunk it is suggested that you install the Splunk Universal Forwarder script for Engaged Threat by following the installation instructions here.
https://github.com/jamesbower/EngagedThreat
Using the Engaged Threat Splunk App
When you open up the Engaged Threat Splunk App you’ll be taken to the “Overview” section of the app by default. You will see that the app contains three other sections. The second section is “Session Analysis” and the third is “Session Engagement”. The fourth and final section of the app is the typical Splunk “Search” section. An synopsis of each section is provided below.
Overview
The “Overview” section provides some key analytics consisting of the following.
Session Analysis
Session Engagement
To-Do
Known Issues
Depending on the time frame used the “Average Session Duration” query takes a long time to calculate. I’m hoping to speed this up in the future.
Credits
Added the specific search index for each query.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.