cowrie*

labelTemplate: VirustotalIP

type: a

title: cowrie*

type: index-pattern


description: DShield Honeypot logs

title: DShield Logs

type: search


description: The DShield Honeypot is a low interaction honeypot that allows us to collect data for research purposes. The honeypot by default runs the following clients: - Collecting SSH and Telnet usernames and passwords via Cowrie - An HTTP honeypot collecting full http requests - We also collect firewall logs from the honeypot

type: lens

visualizationType: lnsDatatable

alignment: center

layerType: data

label: Source IPs

dataType: ip

operationType: terms

scale: ordinal

type: column

orderDirection: desc

label: Country

dataType: string

label: Total

dataType: number

operationType: count

scale: ratio

title: IP by Country

direction: desc

label: Username

label: Password

title: Top Username & Password

type: visualization

type: markdown

markdown: ![Dshield](data:image/png;base64,[encoded data, 4100 characters])

title: Honeypot

visualizationType: lnsXY

position: right

valueLabels: hide

preferredSeriesType: line

position: top

seriesType: line

dataType: date

scale: interval

interval: auto

title: Cowrie Activity over Time

visualizationType: lnsPie

shape: pie

numberDisplay: percent

categoryDisplay: default

legendDisplay: show

label: Top 10 values of version

sourceField: version

title: Top 10 SSH Keys

label: Top 10 values of source.geo.country_code2

title: Top 10 Source Countries

title: Top 10 Usename

title: Top 10 Password

title: Top 10 Ports

title: Log Type

title: Login Result

query: event.dataset : "sqlite"

title: Activity by Sessions

title: [Logs DShield Sensor] Overview