TPOT's Cowrie to ISC Logs
Last year I did a post about a great tool; TPOT https://github.com/dtag-dev-sec/tpotce. In short, it is a collection of different honeypots put together by Docker and Elastic stack. I promised to cover setting up cowrie to report to SANS ISC, and here it is. If you are not familiar with Docker, this config would take a while to figure out.
Copy the cowrie config from the Docker and store it on the host for persistence in /data/cowrie/config
# mkdir /data/cowrie/config
#docker cp cowrie:/home/cowrie/cowrie/cowrie.cfg /data/cowrie/config
Now we need to map the local folder where we are creating the custom config into the Docker so that it will use ours.
#vi /opt/tpot/etc/tpot.yml
Look for the section #Cowrie Service. Add the below in a similar section.
- /data/cowrie/config/cowrie.cfg:/home/cowrie/cowrie/cowrie.cfg
Then we need to enable the Dshield portion. You need to remove ‘#’ from the part starting with the plugin name. You’ll also need your account info.
To get your ISC Dshield key:
Log into ISC, go to My Accounts -> My reports.
Select Update info, and you’ll see your auth_key.
#vi /data/cowrie/config/cowrie.cfg
[output_dshield]
enabled = true
userid = 0123456789
auth_key = mysuperawesomekeycode
batch_size = 100
Once you saved the changes, restart tpot.
#systemctl restart tpot
You use to be able to search for dshield in the logs to make sure it was working. In the current version the Docker is using, this is not working. I would still check the log for errors in /data/cowrie/log/cowrie.log.
The best way to check to make sure this is working is by going to https://isc.sans.edu/myreports.html. Check the last report section and see what the time stamp is. It may take a day to populate this data, so you might want to check the next day after setup.
ssh/kippo reports: 2020-03-28 17:54:12
Also dont forget about ISC own honeypot for Pi https://isc.sans.edu/honeypot.html
--
Tom Webb
@twsecblog
Comments
www
Nov 17th 2022
6 months ago
EEW
Nov 17th 2022
6 months ago
qwq
Nov 17th 2022
6 months ago
mashood
Nov 17th 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Dec 3rd 2022
5 months ago
isc.sans.edu
Dec 3rd 2022
5 months ago
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.
<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
isc.sans.edu
Dec 26th 2022
5 months ago
isc.sans.edu
Dec 26th 2022
5 months ago