logstash-*

logstash-*


Question: attempt

Question: completion

Question: type.keyword:"CitrixHoneypot"

CitrixHoneypot Attacks Histogram


Attacks Bar - Dynamic


Attacks - Dynamic


Attack Map - Dynamic


Attacks Histogram - Dynamic


Attacker Src IP Reputation - Dynamic


Question: type : Endlessh

Endlessh - Reason


Attacks by Country - Dynamic


Attacks by Country Histogram - Dynamic


Attacker AS/N - Top 10 - Dynamic


Src IP - Top 10 - Dynamic


Endlessh Dashboard

Question: type : Endlessh

Endlessh


Question: type.keyword:"Dicompot"

Dicompot Level


Question: type : NGINX

NGINX Countries - Top 10


Question: type.keyword:"Dicompot"

Dicompot Identifier

Dicompot Identifier


Question: type.keyword:"Endlessh"

Endlessh Duration and Bytes - Top 10

Endlessh Duration and Bytes - Top 10


Question: type : Tanner

Tanner URI - Top 10


Go-pot - User Agent - Top 10


Question: type : Go-pot

Go-pot - OS Distribution - Top 10


Question: type.keyword:"ConPot"

Conpot Input - Top 10


Question: type : Fatt

Fatt Attacks Histogram

Fatt Attacks Histogram

Timestamp

Attacks


Protocols - Dynamic


Question: type : Beelzebub Cowrie Dionaea Heralding Wordpot

Username Tagcloud


Question: type : Fatt

Fatt Request URI - Top 10


Beelzebub

Beelzebub


Question: type.keyword:"Cowrie"

Cowrie - Top Downloads


Question: type.keyword:"Heralding"

Heralding Top Credentials Per Protocol

Heralding Top Credentials Per Protocol


Question: type : Adbhoney Beelzebub Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Galah Go-pot Glutton H0neytr4p Hellpot Heralding Honeyaml Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Miniprint Redishoneypot Sentrypeer Tanner Wordpot

Attacker AS/N - Top 10


Sentrypeer - Attacker Number Relation - Vega

{
  $schema: https://vega.github.io/schema/vega/v3.0.json
  data: [
    {
      // query ES based on the currently selected time range and filter string
      name: rawData
      url: {
        %context%: true
        %timefield%: @timestamp
        index: logstash-*
        body: {
          size: 0
          aggs: {
            table: {
              composite: {
                size: 10000
                sources: [
                  {
                    stk1: {
                      terms: {
                        field: src_ip.keyword
                      }
                    }
                  }
                  {
                    stk2: {
                      terms: {
                        field: called_number.keyword
                      }
                    }
                  }
                ]
              }
            }
          }
        }
      }
      // From the result, take just the data we are interested in
      format: {
        property: aggregations.table.buckets
      }
      // Convert key.stk1 -> stk1 for simpler access below
      transform: [
        {
          type: formula
          expr: datum.key.stk1
          as: stk1
        }
        {
          type: formula
          expr: datum.key.stk2
          as: stk2
        }
        {
          type: formula
          expr: datum.doc_count
          as: size
        }
      ]
    }
    {
      name: nodes
      source: rawData
      transform: [
        // when a country is selected, filter out unrelated data
        {
          type: filter
          expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2
        }
        // Set new key for later lookups - identifies each node
        {
          type: formula
          expr: datum.stk1+datum.stk2
          as: key
        }
        // instead of each table row, create two new rows,
        // one for the source (stack=stk1) and one for destination node (stack=stk2).
        // The country code stored in stk1 and stk2 fields is placed into grpId field.
        {
          type: fold
          fields: [
            stk1
            stk2
          ]
          as: [
            stack
            grpId
          ]
        }
        // Create a sortkey, different for stk1 and stk2 stacks.
        // Space separator ensures proper sort order in some corner cases.
        {
          type: formula
          expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1
          as: sortField
        }
        // Calculate y0 and y1 positions for stacking nodes one on top of the other,
        // independently for each stack, and ensuring they are in the proper order,
        // alphabetical from the top (reversed on the y axis)
        {
          type: stack
          groupby: [
            stack
          ]
          sort: {
            field: sortField
            order: descending
          }
          field: size
        }
        // calculate vertical center point for each node, used to draw edges
        {
          type: formula
          expr: (datum.y0+datum.y1)/2
          as: yc
        }
      ]
    }
    {
      name: groups
      source: nodes
      transform: [
        // combine all nodes into country groups, summing up the doc counts
        {
          type: aggregate
          groupby: [
            stack
            grpId
          ]
          fields: [
            size
          ]
          ops: [
            sum
          ]
          as: [
            total
          ]
        }
        // re-calculate the stacking y0,y1 values
        {
          type: stack
          groupby: [
            stack
          ]
          sort: {
            field: grpId
            order: descending
          }
          field: total
        }
        // project y0 and y1 values to screen coordinates
        // doing it once here instead of doing it several times in marks
        {
          type: formula
          expr: scale('y', datum.y0)
          as: scaledY0
        }
        {
          type: formula
          expr: scale('y', datum.y1)
          as: scaledY1
        }
        // boolean flag if the label should be on the right of the stack
        {
          type: formula
          expr: datum.stack == 'stk1'
          as: rightLabel
        }
        // Calculate traffic percentage for this country using "y" scale
        // domain upper bound, which represents the total traffic
        {
          type: formula
          expr: datum.total/domain('y')[1]
          as: percentage
        }
      ]
    }
    {
      // This is a temp lookup table with all the 'stk2' stack nodes
      name: destinationNodes
      source: nodes
      transform: [
        {
          type: filter
          expr: datum.stack == 'stk2'
        }
      ]
    }
    {
      name: edges
      source: nodes
      transform: [
        // we only want nodes from the left stack
        {
          type: filter
          expr: datum.stack == 'stk1'
        }
        // find corresponding node from the right stack, keep it as "target"
        {
          type: lookup
          from: destinationNodes
          key: key
          fields: [
            key
          ]
          as: [
            target
          ]
        }
        // calculate SVG link path between stk1 and stk2 stacks for the node pair
        {
          type: linkpath
          orient: horizontal
          shape: diagonal
          sourceY: {
            expr: scale('y', datum.yc)
          }
          sourceX: {
            expr: scale('x', 'stk1') + bandwidth('x')
          }
          targetY: {
            expr: scale('y', datum.target.yc)
          }
          targetX: {
            expr: scale('x', 'stk2')
          }
        }
        // A little trick to calculate the thickness of the line.
        // The value needs to be the same as the hight of the node, but scaling
        // size to screen's height gives inversed value because screen's Y
        // coordinate goes from the top to the bottom, whereas the graph's Y=0
        // is at the bottom. So subtracting scaled doc count from screen height
        // (which is the "lower" bound of the "y" scale) gives us the right value
        {
          type: formula
          expr: range('y')[0]-scale('y', datum.size)
          as: strokeWidth
        }
        // Tooltip needs individual link's percentage of all traffic
        {
          type: formula
          expr: datum.size/domain('y')[1]
          as: percentage
        }
      ]
    }
  ]
  scales: [
    {
      // calculates horizontal stack positioning
      name: x
      type: band
      range: width
      domain: [
        stk1
        stk2
      ]
      paddingOuter: 0.05
      paddingInner: 0.95
    }
    {
      // this scale goes up as high as the highest y1 value of all nodes
      name: y
      type: linear
      range: height
      domain: {
        data: nodes
        field: y1
      }
    }
    {
      // use rawData to ensure the colors stay the same when clicking.
      name: color
      type: ordinal
      range: category
      domain: {
        data: rawData
        fields: [
          stk1
          stk2
        ]
      }
    }
    {
      // this scale is used to map internal ids (stk1, stk2) to stack names
      name: stackNames
      type: ordinal
      range: [
        Source IP
        Phone Number
      ]
      domain: [
        stk1
        stk2
      ]
    }
  ]
  axes: [
    {
      // x axis should use custom label formatting to print proper stack names
      orient: bottom
      scale: x
      encode: {
        labels: {
          update: {
            text: {
              scale: stackNames
              field: value
            }
          }
        }
      }
    }
    {
      orient: left
      scale: y
    }
  ]
  marks: [
    {
      // draw the connecting line between stacks
      type: path
      name: edgeMark
      from: {
        data: edges
      }
      // this prevents some autosizing issues with large strokeWidth for paths
      clip: true
      encode: {
        update: {
          // By default use color of the left node, except when showing traffic
          // from just one country, in which case use destination color.
          stroke: [
            {
              test: groupSelector && groupSelector.stack=='stk1'
              scale: color
              field: stk2
            }
            {
              scale: color
              field: stk1
            }
          ]
          strokeWidth: {
            field: strokeWidth
          }
          path: {
            field: path
          }
          // when showing all traffic, and hovering over a country,
          // highlight the traffic from that country.
          strokeOpacity: {
            signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3
          }
          // Ensure that the hover-selected edges show on top
          zindex: {
            signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0
          }
          // format tooltip string
          tooltip: {
            signal: datum.stk1 + ' → ' + datum.stk2 + '    ' + format(datum.size, ',.0f') + '   (' + format(datum.percentage, '.1%') + ')'
          }
        }
        // Simple mouseover highlighting of a single line
        hover: {
          strokeOpacity: {
            value: 1
          }
        }
      }
    }
    {
      // draw stack groups (countries)
      type: rect
      name: groupMark
      from: {
        data: groups
      }
      encode: {
        enter: {
          fill: {
            scale: color
            field: grpId
          }
          width: {
            scale: x
            band: 1
          }
        }
        update: {
          x: {
            scale: x
            field: stack
          }
          y: {
            field: scaledY0
          }
          y2: {
            field: scaledY1
          }
          fillOpacity: {
            value: 0.6
          }
          tooltip: {
            signal: datum.grpId + '   ' + format(datum.total, ',.0f') + '   (' + format(datum.percentage, '.1%') + ')'
          }
        }
        hover: {
          fillOpacity: {
            value: 1
          }
        }
      }
    }
    {
      // draw country code labels on the inner side of the stack
      type: text
      from: {
        data: groups
      }
      // don't process events for the labels - otherwise line mouseover is unclean
      interactive: false
      encode: {
        update: {
          // depending on which stack it is, position x with some padding
          x: {
            signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)
          }
          // middle of the group
          yc: {
            signal: (datum.scaledY0 + datum.scaledY1)/2
          }
          align: {
            signal: datum.rightLabel ? 'left' : 'right'
          }
          baseline: {
            value: middle
          }
          fontWeight: {
            value: bold
          }
          // only show text label if the group's height is large enough
          text: {
            signal: abs(datum.scaledY0-datum.scaledY1) > 13 ? datum.grpId : ''
          }
        }
      }
    }
    {
      // Create a "show all" button. Shown only when a country is selected.
      type: group
      data: [
        // We need to make the button show only when groupSelector signal is true.
        // Each mark is drawn as many times as there are elements in the backing data.
        // Which means that if values list is empty, it will not be drawn.
        // Here I create a data source with one empty object, and filter that list
        // based on the signal value. This can only be done in a group.
        {
          name: dataForShowAll
          values: [
            {
            }
          ]
          transform: [
            {
              type: filter
              expr: groupSelector
            }
          ]
        }
      ]
      // Set button size and positioning
      encode: {
        enter: {
          xc: {
            signal: width/2
          }
          y: {
            value: 30
          }
          width: {
            value: 80
          }
          height: {
            value: 30
          }
        }
      }
      marks: [
        {
          // This group is shown as a button with rounded corners.
          type: "group"
          // mark name allows signal capturing
          name: "groupReset"
          // Only shows button if dataForShowAll has values.
          from: {
            data: dataForShowAll
          }
          encode: {
            enter: {
              cornerRadius: {
                value: 6
              }
              fill: {
                value: "#f5f5f5"
              }
              stroke: {
                value: "#c1c1c1"
              }
              strokeWidth: {
                value: 2
              }
              // use parent group's size
              height: {
                field: {
                  group: height
                }
              }
              width: {
                field: {
                  group: width
                }
              }
            }
            update: {
              // groups are transparent by default
              opacity: {
                value: 1
              }
            }
            hover: {
              opacity: {
                value: 0.7
              }
            }
          }
          marks: [
            {
              type: "text"
              // if true, it will prevent clicking on the button when over text.
              interactive: false
              encode: {
                enter: {
                  // center text in the paren group
                  xc: {
                    field: {
                      group: width
                    }
                    mult: 0.5
                  }
                  yc: {
                    field: {
                      group: height
                    }
                    mult: 0.5
                    offset: 2
                  }
                  align: {
                    value: center
                  }
                  baseline: {
                    value: middle
                  }
                  fontWeight: {
                    value: bold
                  }
                  text: {
                    value: Show All
                  }
                }
              }
            }
          ]
        }
      ]
    }
  ]
  signals: [
    {
      // used to highlight traffic to/from the same country
      name: groupHover
      value: {
      }
      on: [
        {
          events: @groupMark:mouseover
          update: "{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}"
        }
        {
          events: mouseout
          update: "{}"
        }
      ]
    }
    // used to filter only the data related to the selected country
    {
      name: groupSelector
      value: false
      on: [
        {
          // Clicking groupMark sets this signal to the filter values
          events: @groupMark:click!
          update: "{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}"
        }
        {
          // Clicking "show all" button, or double-clicking anywhere resets it
          events: [
            {
              type: click
              markname: groupReset
            }
            {
              type: dblclick
            }
          ]
          update: "false"
        }
      ]
    }
  ]
}


Attacks by Destination Ports Histogram - Dynamic


Attacks by Port - Dynamic


Username Tagcloud - Dynamic


Password Tagcloud - Dynamic


Heralding Dashboard

Question: type : Heralding

Attacks - Dynamic

Heralding


Question: type : Adbhoney Beelzebub Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Galah Go-pot Glutton H0neytr4p Hellpot Heralding Honeyaml Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Miniprint Redishoneypot Sentrypeer Tanner Wordpot

Attacks by Country


Question: type.keyword:"Beelzebub"

Beelzebub Version Pie - Top 10


Question: type.keyword:"ConPot"

Conpot Protocol


Security Solution

Security Solution auto-generated tag


Question: type.keyword:"Cowrie"

Cowrie - Attacks by Port


Heatmap Destination Ports - Dynamic


Question: type.keyword:"Honeypots"

qHoneypots Event Type - Top 10

qHoneypots Event Type - Top 10


Country Protocol Relation - Vega

Country Protocol Relation - Vega

{
  $schema: https://vega.github.io/schema/vega/v3.0.json
  data: [
    {
      // query ES based on the currently selected time range and filter string
      name: rawData
      url: {
        %context%: true
        %timefield%: @timestamp
        index: logstash-*
        body: {
          size: 0
          aggs: {
            table: {
              composite: {
                size: 10000
                sources: [
                  {
                    stk1: {
                      terms: {
                        field: geoip.country_name.keyword
                      }
                    }
                  }
                  {
                    stk2: {
                      terms: {
                        field: protocol.keyword
                      }
                    }
                  }
                ]
              }
            }
          }
        }
      }
      // From the result, take just the data we are interested in
      format: {
        property: aggregations.table.buckets
      }
      // Convert key.stk1 -> stk1 for simpler access below
      transform: [
        {
          type: formula
          expr: datum.key.stk1
          as: stk1
        }
        {
          type: formula
          expr: datum.key.stk2
          as: stk2
        }
        {
          type: formula
          expr: datum.doc_count
          as: size
        }
      ]
    }
    {
      name: nodes
      source: rawData
      transform: [
        // when a country is selected, filter out unrelated data
        {
          type: filter
          expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2
        }
        // Set new key for later lookups - identifies each node
        {
          type: formula
          expr: datum.stk1+datum.stk2
          as: key
        }
        // instead of each table row, create two new rows,
        // one for the source (stack=stk1) and one for destination node (stack=stk2).
        // The country code stored in stk1 and stk2 fields is placed into grpId field.
        {
          type: fold
          fields: [
            stk1
            stk2
          ]
          as: [
            stack
            grpId
          ]
        }
        // Create a sortkey, different for stk1 and stk2 stacks.
        // Space separator ensures proper sort order in some corner cases.
        {
          type: formula
          expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1
          as: sortField
        }
        // Calculate y0 and y1 positions for stacking nodes one on top of the other,
        // independently for each stack, and ensuring they are in the proper order,
        // alphabetical from the top (reversed on the y axis)
        {
          type: stack
          groupby: [
            stack
          ]
          sort: {
            field: sortField
            order: descending
          }
          field: size
        }
        // calculate vertical center point for each node, used to draw edges
        {
          type: formula
          expr: (datum.y0+datum.y1)/2
          as: yc
        }
      ]
    }
    {
      name: groups
      source: nodes
      transform: [
        // combine all nodes into country groups, summing up the doc counts
        {
          type: aggregate
          groupby: [
            stack
            grpId
          ]
          fields: [
            size
          ]
          ops: [
            sum
          ]
          as: [
            total
          ]
        }
        // re-calculate the stacking y0,y1 values
        {
          type: stack
          groupby: [
            stack
          ]
          sort: {
            field: grpId
            order: descending
          }
          field: total
        }
        // project y0 and y1 values to screen coordinates
        // doing it once here instead of doing it several times in marks
        {
          type: formula
          expr: scale('y', datum.y0)
          as: scaledY0
        }
        {
          type: formula
          expr: scale('y', datum.y1)
          as: scaledY1
        }
        // boolean flag if the label should be on the right of the stack
        {
          type: formula
          expr: datum.stack == 'stk1'
          as: rightLabel
        }
        // Calculate traffic percentage for this country using "y" scale
        // domain upper bound, which represents the total traffic
        {
          type: formula
          expr: datum.total/domain('y')[1]
          as: percentage
        }
      ]
    }
    {
      // This is a temp lookup table with all the 'stk2' stack nodes
      name: destinationNodes
      source: nodes
      transform: [
        {
          type: filter
          expr: datum.stack == 'stk2'
        }
      ]
    }
    {
      name: edges
      source: nodes
      transform: [
        // we only want nodes from the left stack
        {
          type: filter
          expr: datum.stack == 'stk1'
        }
        // find corresponding node from the right stack, keep it as "target"
        {
          type: lookup
          from: destinationNodes
          key: key
          fields: [
            key
          ]
          as: [
            target
          ]
        }
        // calculate SVG link path between stk1 and stk2 stacks for the node pair
        {
          type: linkpath
          orient: horizontal
          shape: diagonal
          sourceY: {
            expr: scale('y', datum.yc)
          }
          sourceX: {
            expr: scale('x', 'stk1') + bandwidth('x')
          }
          targetY: {
            expr: scale('y', datum.target.yc)
          }
          targetX: {
            expr: scale('x', 'stk2')
          }
        }
        // A little trick to calculate the thickness of the line.
        // The value needs to be the same as the hight of the node, but scaling
        // size to screen's height gives inversed value because screen's Y
        // coordinate goes from the top to the bottom, whereas the graph's Y=0
        // is at the bottom. So subtracting scaled doc count from screen height
        // (which is the "lower" bound of the "y" scale) gives us the right value
        {
          type: formula
          expr: range('y')[0]-scale('y', datum.size)
          as: strokeWidth
        }
        // Tooltip needs individual link's percentage of all traffic
        {
          type: formula
          expr: datum.size/domain('y')[1]
          as: percentage
        }
      ]
    }
  ]
  scales: [
    {
      // calculates horizontal stack positioning
      name: x
      type: band
      range: width
      domain: [
        stk1
        stk2
      ]
      paddingOuter: 0.05
      paddingInner: 0.95
    }
    {
      // this scale goes up as high as the highest y1 value of all nodes
      name: y
      type: linear
      range: height
      domain: {
        data: nodes
        field: y1
      }
    }
    {
      // use rawData to ensure the colors stay the same when clicking.
      name: color
      type: ordinal
      range: category
      domain: {
        data: rawData
        fields: [
          stk1
          stk2
        ]
      }
    }
    {
      // this scale is used to map internal ids (stk1, stk2) to stack names
      name: stackNames
      type: ordinal
      range: [
        Country
        Protocol
      ]
      domain: [
        stk1
        stk2
      ]
    }
  ]
  axes: [
    {
      // x axis should use custom label formatting to print proper stack names
      orient: bottom
      scale: x
      encode: {
        labels: {
          update: {
            text: {
              scale: stackNames
              field: value
            }
          }
        }
      }
    }
    {
      orient: left
      scale: y
    }
  ]
  marks: [
    {
      // draw the connecting line between stacks
      type: path
      name: edgeMark
      from: {
        data: edges
      }
      // this prevents some autosizing issues with large strokeWidth for paths
      clip: true
      encode: {
        update: {
          // By default use color of the left node, except when showing traffic
          // from just one country, in which case use destination color.
          stroke: [
            {
              test: groupSelector && groupSelector.stack=='stk1'
              scale: color
              field: stk2
            }
            {
              scale: color
              field: stk1
            }
          ]
          strokeWidth: {
            field: strokeWidth
          }
          path: {
            field: path
          }
          // when showing all traffic, and hovering over a country,
          // highlight the traffic from that country.
          strokeOpacity: {
            signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3
          }
          // Ensure that the hover-selected edges show on top
          zindex: {
            signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0
          }
          // format tooltip string
          tooltip: {
            signal: datum.stk1 + ' → ' + datum.stk2 + '    ' + format(datum.size, ',.0f') + '   (' + format(datum.percentage, '.1%') + ')'
          }
        }
        // Simple mouseover highlighting of a single line
        hover: {
          strokeOpacity: {
            value: 1
          }
        }
      }
    }
    {
      // draw stack groups (countries)
      type: rect
      name: groupMark
      from: {
        data: groups
      }
      encode: {
        enter: {
          fill: {
            scale: color
            field: grpId
          }
          width: {
            scale: x
            band: 1
          }
        }
        update: {
          x: {
            scale: x
            field: stack
          }
          y: {
            field: scaledY0
          }
          y2: {
            field: scaledY1
          }
          fillOpacity: {
            value: 0.6
          }
          tooltip: {
            signal: datum.grpId + '   ' + format(datum.total, ',.0f') + '   (' + format(datum.percentage, '.1%') + ')'
          }
        }
        hover: {
          fillOpacity: {
            value: 1
          }
        }
      }
    }
    {
      // draw country code labels on the inner side of the stack
      type: text
      from: {
        data: groups
      }
      // don't process events for the labels - otherwise line mouseover is unclean
      interactive: false
      encode: {
        update: {
          // depending on which stack it is, position x with some padding
          x: {
            signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)
          }
          // middle of the group
          yc: {
            signal: (datum.scaledY0 + datum.scaledY1)/2
          }
          align: {
            signal: datum.rightLabel ? 'left' : 'right'
          }
          baseline: {
            value: middle
          }
          fontWeight: {
            value: bold
          }
          // only show text label if the group's height is large enough
          text: {
            signal: abs(datum.scaledY0-datum.scaledY1) > 13 ? datum.grpId : ''
          }
        }
      }
    }
    {
      // Create a "show all" button. Shown only when a country is selected.
      type: group
      data: [
        // We need to make the button show only when groupSelector signal is true.
        // Each mark is drawn as many times as there are elements in the backing data.
        // Which means that if values list is empty, it will not be drawn.
        // Here I create a data source with one empty object, and filter that list
        // based on the signal value. This can only be done in a group.
        {
          name: dataForShowAll
          values: [
            {
            }
          ]
          transform: [
            {
              type: filter
              expr: groupSelector
            }
          ]
        }
      ]
      // Set button size and positioning
      encode: {
        enter: {
          xc: {
            signal: width/2
          }
          y: {
            value: 30
          }
          width: {
            value: 80
          }
          height: {
            value: 30
          }
        }
      }
      marks: [
        {
          // This group is shown as a button with rounded corners.
          type: "group"
          // mark name allows signal capturing
          name: "groupReset"
          // Only shows button if dataForShowAll has values.
          from: {
            data: dataForShowAll
          }
          encode: {
            enter: {
              cornerRadius: {
                value: 6
              }
              fill: {
                value: "#f5f5f5"
              }
              stroke: {
                value: "#c1c1c1"
              }
              strokeWidth: {
                value: 2
              }
              // use parent group's size
              height: {
                field: {
                  group: height
                }
              }
              width: {
                field: {
                  group: width
                }
              }
            }
            update: {
              // groups are transparent by default
              opacity: {
                value: 1
              }
            }
            hover: {
              opacity: {
                value: 0.7
              }
            }
          }
          marks: [
            {
              type: "text"
              // if true, it will prevent clicking on the button when over text.
              interactive: false
              encode: {
                enter: {
                  // center text in the paren group
                  xc: {
                    field: {
                      group: width
                    }
                    mult: 0.5
                  }
                  yc: {
                    field: {
                      group: height
                    }
                    mult: 0.5
                    offset: 2
                  }
                  align: {
                    value: center
                  }
                  baseline: {
                    value: middle
                  }
                  fontWeight: {
                    value: bold
                  }
                  text: {
                    value: Show All
                  }
                }
              }
            }
          ]
        }
      ]
    }
  ]
  signals: [
    {
      // used to highlight traffic to/from the same country
      name: groupHover
      value: {
      }
      on: [
        {
          events: @groupMark:mouseover
          update: "{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}"
        }
        {
          events: mouseout
          update: "{}"
        }
      ]
    }
    // used to filter only the data related to the selected country
    {
      name: groupSelector
      value: false
      on: [
        {
          // Clicking groupMark sets this signal to the filter values
          events: @groupMark:click!
          update: "{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}"
        }
        {
          // Clicking "show all" button, or double-clicking anywhere resets it
          events: [
            {
              type: click
              markname: groupReset
            }
            {
              type: dblclick
            }
          ]
          update: "false"
        }
      ]
    }
  ]
}


Honeypots Protocol

Dashboard for qeeqbox's Honeypots

Question: type : Honeypots

qHoneypots


Question: type : Miniprint

Miniprint - Directories - Top 10


Galah

Galah


Question: type.keyword:"Galah"

Galah HTTP Request URI - Top 10


Question: type.keyword:"ConPot"

Conpot Event Type


Question: type : Suricata

Suricata Events Bar


Question: type : Medpot

Medpot Data - Top 10


Question: type : Honeytrap

Honeytrap Heatmap


Question: type : Tanner

Tanner HTTP Method Pie - Top 10


Question: type : Suricata

Suricata Events by Country Histogram


Question: type : Adbhoney Beelzebub Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Galah Go-pot Glutton H0neytr4p Hellpot Heralding Honeyaml Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Miniprint Redishoneypot Sentrypeer Tanner Wordpot

Honeypot Attacks Histogram


Question: type : Hellpot

Hellpot - Reason


Question: type : ElasticPot

ElasticPot - Event Types


Question: type:"Ciscoasa"

Question: type:"Ciscoasa"

Ciscoasa-Logs


Question: type.keyword:"Dicompot"

Dicompot Input - Top 10


Question: type : NGINX

NGINX Events Bar


Question: type.keyword:"Dionaea"

Dionaea Protocol


Question: type.keyword:"Dionaea"

Dionaea Transport


Ipphoney - Query - Top 10


Question: type.keyword:"NGINX"

NGINX HTTP User Agent Pie - Top 10


Question: type:"Suricata" OR type:"p0f"

Question: type:"Suricata" OR type:"p0f"

NSM-Logs


Question: type.keyword:"ElasticPot"

ElasticPot - Request Method - Top 5


Question: type.keyword:"Ddospot"

Ddospot - Ntpot Mode


Question: type : NGINX

NGINX Top Users Histogram


Question: type.keyword:"Adbhoney"

Adbhoney Input - Top 10


Question: type:"Glutton"

Question: type:"Glutton"

Glutton-Logs


Question: type:"Adbhoney"

Adbhoney Samples - Top 10


Question: type : Adbhoney Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Glutton Hellpot Heralding Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Redishoneypot Sentrypeer Tanner Wordpot

Honeypots - Query


Question: type.keyword:("Adbhoney" OR "Beelzebub" OR  "Ciscoasa" OR "CitrixHoneypot" OR "ConPot" OR "Cowrie" OR "Ddospot" OR "Dicompot" OR "Dionaea" OR "ElasticPot" OR "Endlessh" OR "Galah" OR "Glutton" OR "Go-pot" OR "H0neytr4p" OR "Hellpot" OR "Heralding" OR "Honeyaml" OR "Honeytrap" OR "Honeypots" OR "Log4pot" OR "Ipphoney" OR "Mailoney" OR "Medpot" OR "Miniprint" OR "Redishoneypot" OR "Sentrypeer" OR "Tanner" OR "Wordpot")

Question: type.keyword:("Adbhoney" OR "Beelzebub" OR  "Ciscoasa" OR "CitrixHoneypot" OR "ConPot" OR "Cowrie" OR "Ddospot" OR "Dicompot" OR "Dionaea" OR "ElasticPot" OR "Endlessh" OR "Galah" OR "Glutton" OR "Go-pot" OR "H0neytr4p" OR "Hellpot" OR "Heralding" OR "Honeyaml" OR "Honeytrap" OR "Honeypots" OR "Log4pot" OR "Ipphoney" OR "Mailoney" OR "Medpot" OR "Miniprint" OR "Redishoneypot" OR "Sentrypeer" OR "Tanner" OR "Wordpot")

Honeypot-Logs


Honeypot Attacks Country Tagcloud

Honeypot Attacks Country Tagcloud


Question: type.keyword:"Beelzebub"

Beelzebub - Attacks by Protocols Histogram Incoming


Question: type.keyword:"Beelzebub"

Beelzebub - Attacks by Protocols


Question: type.keyword:"Beelzebub"

Beelzebub SSH Input - Top 10


Question: type.keyword:"Beelzebub"

Beelzebub HTTP Request URI - Top 10


Beelzebub Dashboard

Question: type : Beelzebub

Beelzebub


Question: type : Adbhoney Beelzebub Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Galah Go-pot Glutton H0neytr4p Hellpot Heralding Honeyaml Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Miniprint Redishoneypot Sentrypeer Tanner Wordpot

Attacker Src IP Reputation


Question: type : Suricata

Suricata HTTP User Agent Pie - Top 10


Question: type.keyword:"NGINX"

NGINX - AS/N - Top 10


Question: type : Suricata

Suricata HTTP Content Type - Top 10


Question: type.keyword:"Cowrie"

Cowrie Attacks

Cowrie Attacks


Question: type : Beelzebub Cowrie Dionaea Heralding Wordpot

Password Tagcloud


Medpot Dashboard

Question: type : Medpot

Medpot


Question: type : Suricata

Suricata Destination Ports Histogram


Question: type : Suricata

Suricata Events

Suricata Events


Question: type : Miniprint

Miniprint - Upload Stats


Question: type : Redishoneypot

Redishoneypot Duration and Bytes - Top 10


Redishoneypot Dashboard

Question: type : Redishoneypot

Redishoneypot


Question: type : ElasticPot

ElasticPot Query - Top 10


Question: type:"Cowrie"

Vega Test

Vega Test

{
  $schema: https://vega.github.io/schema/vega/v3.0.json
  data: [
    {
      // query ES based on the currently selected time range and filter string
      name: rawData
      url: {
        %context%: true
        %timefield%: @timestamp
        index: logstash-*
        body: {
          size: 0
          aggs: {
            table: {
              composite: {
                size: 10000
                sources: [
                  {
                    stk1: {
                      terms: {
                        field: src_ip.keyword
                      }
                    }
                  }
                  {
                    stk2: {
                      terms: {
                        field: dest_ip.keyword
                      }
                    }
                  }
                ]
              }
            }
          }
        }
      }
      // From the result, take just the data we are interested in
      format: {
        property: aggregations.table.buckets
      }
      // Convert key.stk1 -> stk1 for simpler access below
      transform: [
        {
          type: formula
          expr: datum.key.stk1
          as: stk1
        }
        {
          type: formula
          expr: datum.key.stk2
          as: stk2
        }
        {
          type: formula
          expr: datum.doc_count
          as: size
        }
      ]
    }
    {
      name: nodes
      source: rawData
      transform: [
        // when a country is selected, filter out unrelated data
        {
          type: filter
          expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2
        }
        // Set new key for later lookups - identifies each node
        {
          type: formula
          expr: datum.stk1+datum.stk2
          as: key
        }
        // instead of each table row, create two new rows,
        // one for the source (stack=stk1) and one for destination node (stack=stk2).
        // The country code stored in stk1 and stk2 fields is placed into grpId field.
        {
          type: fold
          fields: [
            stk1
            stk2
          ]
          as: [
            stack
            grpId
          ]
        }
        // Create a sortkey, different for stk1 and stk2 stacks.
        // Space separator ensures proper sort order in some corner cases.
        {
          type: formula
          expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1
          as: sortField
        }
        // Calculate y0 and y1 positions for stacking nodes one on top of the other,
        // independently for each stack, and ensuring they are in the proper order,
        // alphabetical from the top (reversed on the y axis)
        {
          type: stack
          groupby: [
            stack
          ]
          sort: {
            field: sortField
            order: descending
          }
          field: size
        }
        // calculate vertical center point for each node, used to draw edges
        {
          type: formula
          expr: (datum.y0+datum.y1)/2
          as: yc
        }
      ]
    }
    {
      name: groups
      source: nodes
      transform: [
        // combine all nodes into country groups, summing up the doc counts
        {
          type: aggregate
          groupby: [
            stack
            grpId
          ]
          fields: [
            size
          ]
          ops: [
            sum
          ]
          as: [
            total
          ]
        }
        // re-calculate the stacking y0,y1 values
        {
          type: stack
          groupby: [
            stack
          ]
          sort: {
            field: grpId
            order: descending
          }
          field: total
        }
        // project y0 and y1 values to screen coordinates
        // doing it once here instead of doing it several times in marks
        {
          type: formula
          expr: scale('y', datum.y0)
          as: scaledY0
        }
        {
          type: formula
          expr: scale('y', datum.y1)
          as: scaledY1
        }
        // boolean flag if the label should be on the right of the stack
        {
          type: formula
          expr: datum.stack == 'stk1'
          as: rightLabel
        }
        // Calculate traffic percentage for this country using "y" scale
        // domain upper bound, which represents the total traffic
        {
          type: formula
          expr: datum.total/domain('y')[1]
          as: percentage
        }
      ]
    }
    {
      // This is a temp lookup table with all the 'stk2' stack nodes
      name: destinationNodes
      source: nodes
      transform: [
        {
          type: filter
          expr: datum.stack == 'stk2'
        }
      ]
    }
    {
      name: edges
      source: nodes
      transform: [
        // we only want nodes from the left stack
        {
          type: filter
          expr: datum.stack == 'stk1'
        }
        // find corresponding node from the right stack, keep it as "target"
        {
          type: lookup
          from: destinationNodes
          key: key
          fields: [
            key
          ]
          as: [
            target
          ]
        }
        // calculate SVG link path between stk1 and stk2 stacks for the node pair
        {
          type: linkpath
          orient: horizontal
          shape: diagonal
          sourceY: {
            expr: scale('y', datum.yc)
          }
          sourceX: {
            expr: scale('x', 'stk1') + bandwidth('x')
          }
          targetY: {
            expr: scale('y', datum.target.yc)
          }
          targetX: {
            expr: scale('x', 'stk2')
          }
        }
        // A little trick to calculate the thickness of the line.
        // The value needs to be the same as the hight of the node, but scaling
        // size to screen's height gives inversed value because screen's Y
        // coordinate goes from the top to the bottom, whereas the graph's Y=0
        // is at the bottom. So subtracting scaled doc count from screen height
        // (which is the "lower" bound of the "y" scale) gives us the right value
        {
          type: formula
          expr: range('y')[0]-scale('y', datum.size)
          as: strokeWidth
        }
        // Tooltip needs individual link's percentage of all traffic
        {
          type: formula
          expr: datum.size/domain('y')[1]
          as: percentage
        }
      ]
    }
  ]
  scales: [
    {
      // calculates horizontal stack positioning
      name: x
      type: band
      range: width
      domain: [
        stk1
        stk2
      ]
      paddingOuter: 0.05
      paddingInner: 0.95
    }
    {
      // this scale goes up as high as the highest y1 value of all nodes
      name: y
      type: linear
      range: height
      domain: {
        data: nodes
        field: y1
      }
    }
    {
      // use rawData to ensure the colors stay the same when clicking.
      name: color
      type: ordinal
      range: category
      domain: {
        data: rawData
        fields: [
          stk1
          stk2
        ]
      }
    }
    {
      // this scale is used to map internal ids (stk1, stk2) to stack names
      name: stackNames
      type: ordinal
      range: [
        Source
        Destination
      ]
      domain: [
        stk1
        stk2
      ]
    }
  ]
  axes: [
    {
      // x axis should use custom label formatting to print proper stack names
      orient: bottom
      scale: x
      encode: {
        labels: {
          update: {
            text: {
              scale: stackNames
              field: value
            }
          }
        }
      }
    }
    {
      orient: left
      scale: y
    }
  ]
  marks: [
    {
      // draw the connecting line between stacks
      type: path
      name: edgeMark
      from: {
        data: edges
      }
      // this prevents some autosizing issues with large strokeWidth for paths
      clip: true
      encode: {
        update: {
          // By default use color of the left node, except when showing traffic
          // from just one country, in which case use destination color.
          stroke: [
            {
              test: groupSelector && groupSelector.stack=='stk1'
              scale: color
              field: stk2
            }
            {
              scale: color
              field: stk1
            }
          ]
          strokeWidth: {
            field: strokeWidth
          }
          path: {
            field: path
          }
          // when showing all traffic, and hovering over a country,
          // highlight the traffic from that country.
          strokeOpacity: {
            signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3
          }
          // Ensure that the hover-selected edges show on top
          zindex: {
            signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0
          }
          // format tooltip string
          tooltip: {
            signal: datum.stk1 + ' → ' + datum.stk2 + '    ' + format(datum.size, ',.0f') + '   (' + format(datum.percentage, '.1%') + ')'
          }
        }
        // Simple mouseover highlighting of a single line
        hover: {
          strokeOpacity: {
            value: 1
          }
        }
      }
    }
    {
      // draw stack groups (countries)
      type: rect
      name: groupMark
      from: {
        data: groups
      }
      encode: {
        enter: {
          fill: {
            scale: color
            field: grpId
          }
          width: {
            scale: x
            band: 1
          }
        }
        update: {
          x: {
            scale: x
            field: stack
          }
          y: {
            field: scaledY0
          }
          y2: {
            field: scaledY1
          }
          fillOpacity: {
            value: 0.6
          }
          tooltip: {
            signal: datum.grpId + '   ' + format(datum.total, ',.0f') + '   (' + format(datum.percentage, '.1%') + ')'
          }
        }
        hover: {
          fillOpacity: {
            value: 1
          }
        }
      }
    }
    {
      // draw country code labels on the inner side of the stack
      type: text
      from: {
        data: groups
      }
      // don't process events for the labels - otherwise line mouseover is unclean
      interactive: false
      encode: {
        update: {
          // depending on which stack it is, position x with some padding
          x: {
            signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)
          }
          // middle of the group
          yc: {
            signal: (datum.scaledY0 + datum.scaledY1)/2
          }
          align: {
            signal: datum.rightLabel ? 'left' : 'right'
          }
          baseline: {
            value: middle
          }
          fontWeight: {
            value: bold
          }
          // only show text label if the group's height is large enough
          text: {
            signal: abs(datum.scaledY0-datum.scaledY1) > 13 ? datum.grpId : ''
          }
        }
      }
    }
    {
      // Create a "show all" button. Shown only when a country is selected.
      type: group
      data: [
        // We need to make the button show only when groupSelector signal is true.
        // Each mark is drawn as many times as there are elements in the backing data.
        // Which means that if values list is empty, it will not be drawn.
        // Here I create a data source with one empty object, and filter that list
        // based on the signal value. This can only be done in a group.
        {
          name: dataForShowAll
          values: [
            {
            }
          ]
          transform: [
            {
              type: filter
              expr: groupSelector
            }
          ]
        }
      ]
      // Set button size and positioning
      encode: {
        enter: {
          xc: {
            signal: width/2
          }
          y: {
            value: 30
          }
          width: {
            value: 80
          }
          height: {
            value: 30
          }
        }
      }
      marks: [
        {
          // This group is shown as a button with rounded corners.
          type: "group"
          // mark name allows signal capturing
          name: "groupReset"
          // Only shows button if dataForShowAll has values.
          from: {
            data: dataForShowAll
          }
          encode: {
            enter: {
              cornerRadius: {
                value: 6
              }
              fill: {
                value: "#f5f5f5"
              }
              stroke: {
                value: "#c1c1c1"
              }
              strokeWidth: {
                value: 2
              }
              // use parent group's size
              height: {
                field: {
                  group: height
                }
              }
              width: {
                field: {
                  group: width
                }
              }
            }
            update: {
              // groups are transparent by default
              opacity: {
                value: 1
              }
            }
            hover: {
              opacity: {
                value: 0.7
              }
            }
          }
          marks: [
            {
              type: "text"
              // if true, it will prevent clicking on the button when over text.
              interactive: false
              encode: {
                enter: {
                  // center text in the paren group
                  xc: {
                    field: {
                      group: width
                    }
                    mult: 0.5
                  }
                  yc: {
                    field: {
                      group: height
                    }
                    mult: 0.5
                    offset: 2
                  }
                  align: {
                    value: center
                  }
                  baseline: {
                    value: middle
                  }
                  fontWeight: {
                    value: bold
                  }
                  text: {
                    value: Show All
                  }
                }
              }
            }
          ]
        }
      ]
    }
  ]
  signals: [
    {
      // used to highlight traffic to/from the same country
      name: groupHover
      value: {
      }
      on: [
        {
          events: @groupMark:mouseover
          update: "{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}"
        }
        {
          events: mouseout
          update: "{}"
        }
      ]
    }
    // used to filter only the data related to the selected country
    {
      name: groupSelector
      value: false
      on: [
        {
          // Clicking groupMark sets this signal to the filter values
          events: @groupMark:click!
          update: "{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}"
        }
        {
          // Clicking "show all" button, or double-clicking anywhere resets it
          events: [
            {
              type: click
              markname: groupReset
            }
            {
              type: dblclick
            }
          ]
          update: "false"
        }
      ]
    }
  ]
}


Question: type : Fatt

Fatt - IP / SSH HASSH - Pie


Question: type : Suricata

Suricata Events Histogram


Question: type.keyword:"Cowrie"

Cowrie - Attacks by Destination Ports Histogram Incoming


Question: type : Miniprint

Miniprint - Event Types - Top 10


Question: type.keyword:"Cowrie"

Cowrie Attacks Histogram


Question: type : Sentrypeer

Sentrypeer - SIP Method Pie - Top 10


Question: type.keyword:"Glutton"

Glutton Method


Question: type.keyword:"Ddospot"

Ddospot - DNS Name


Question: type:"Ddospot"

Ddospot Request Packet - Top 10


Ddospot Dashboard

Question: type : Ddospot

Attacks - Dynamic

Ddospot


Question: type:"CitrixHoneypot"

Question: type:"CitrixHoneypot"

CitrixHoneypot-Logs


Question: type : Suricata

Suricata Alert Signature - Top 10


Question: type : Tanner

Tanner HTTP Language Pie - Top 10


Question: type : H0neytr4p

H0neytr4p Payload Printable - Top 10


Question: type : Ciscoasa

Ciscoasa Attacks Histogram


Ciscoasa Dashboard

Question: type : Ciscoasa

Ciscoasa


Question: type:"Adbhoney"

Question: type:"Adbhoney"

Adbhoney-Logs


Question: type:"Dicompot"

Question: type:"Dicompot"

Dicompot-Logs


Question: type : Suricata

Suricata Alert Category Histogram


Country Port Relation - Vega

Country Port Relation - Vega

{
  $schema: https://vega.github.io/schema/vega/v3.0.json
  data: [
    {
      // query ES based on the currently selected time range and filter string
      name: rawData
      url: {
        %context%: true
        %timefield%: @timestamp
        index: logstash-*
        body: {
          size: 0
          aggs: {
            table: {
              composite: {
                size: 10000
                sources: [
                  {
                    stk1: {
                      terms: {
                        field: geoip.country_name.keyword
                      }
                    }
                  }
                  {
                    stk2: {
                      terms: {
                        field: dest_port
                      }
                    }
                  }
                ]
              }
            }
          }
        }
      }
      // From the result, take just the data we are interested in
      format: {
        property: aggregations.table.buckets
      }
      // Convert key.stk1 -> stk1 for simpler access below
      transform: [
        {
          type: formula
          expr: datum.key.stk1
          as: stk1
        }
        {
          type: formula
          expr: datum.key.stk2
          as: stk2
        }
        {
          type: formula
          expr: datum.doc_count
          as: size
        }
      ]
    }
    {
      name: nodes
      source: rawData
      transform: [
        // when a country is selected, filter out unrelated data
        {
          type: filter
          expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2
        }
        // Set new key for later lookups - identifies each node
        {
          type: formula
          expr: datum.stk1+datum.stk2
          as: key
        }
        // instead of each table row, create two new rows,
        // one for the source (stack=stk1) and one for destination node (stack=stk2).
        // The country code stored in stk1 and stk2 fields is placed into grpId field.
        {
          type: fold
          fields: [
            stk1
            stk2
          ]
          as: [
            stack
            grpId
          ]
        }
        // Create a sortkey, different for stk1 and stk2 stacks.
        // Space separator ensures proper sort order in some corner cases.
        {
          type: formula
          expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1
          as: sortField
        }
        // Calculate y0 and y1 positions for stacking nodes one on top of the other,
        // independently for each stack, and ensuring they are in the proper order,
        // alphabetical from the top (reversed on the y axis)
        {
          type: stack
          groupby: [
            stack
          ]
          sort: {
            field: sortField
            order: descending
          }
          field: size
        }
        // calculate vertical center point for each node, used to draw edges
        {
          type: formula
          expr: (datum.y0+datum.y1)/2
          as: yc
        }
      ]
    }
    {
      name: groups
      source: nodes
      transform: [
        // combine all nodes into country groups, summing up the doc counts
        {
          type: aggregate
          groupby: [
            stack
            grpId
          ]
          fields: [
            size
          ]
          ops: [
            sum
          ]
          as: [
            total
          ]
        }
        // re-calculate the stacking y0,y1 values
        {
          type: stack
          groupby: [
            stack
          ]
          sort: {
            field: grpId
            order: descending
          }
          field: total
        }
        // project y0 and y1 values to screen coordinates
        // doing it once here instead of doing it several times in marks
        {
          type: formula
          expr: scale('y', datum.y0)
          as: scaledY0
        }
        {
          type: formula
          expr: scale('y', datum.y1)
          as: scaledY1
        }
        // boolean flag if the label should be on the right of the stack
        {
          type: formula
          expr: datum.stack == 'stk1'
          as: rightLabel
        }
        // Calculate traffic percentage for this country using "y" scale
        // domain upper bound, which represents the total traffic
        {
          type: formula
          expr: datum.total/domain('y')[1]
          as: percentage
        }
      ]
    }
    {
      // This is a temp lookup table with all the 'stk2' stack nodes
      name: destinationNodes
      source: nodes
      transform: [
        {
          type: filter
          expr: datum.stack == 'stk2'
        }
      ]
    }
    {
      name: edges
      source: nodes
      transform: [
        // we only want nodes from the left stack
        {
          type: filter
          expr: datum.stack == 'stk1'
        }
        // find corresponding node from the right stack, keep it as "target"
        {
          type: lookup
          from: destinationNodes
          key: key
          fields: [
            key
          ]
          as: [
            target
          ]
        }
        // calculate SVG link path between stk1 and stk2 stacks for the node pair
        {
          type: linkpath
          orient: horizontal
          shape: diagonal
          sourceY: {
            expr: scale('y', datum.yc)
          }
          sourceX: {
            expr: scale('x', 'stk1') + bandwidth('x')
          }
          targetY: {
            expr: scale('y', datum.target.yc)
          }
          targetX: {
            expr: scale('x', 'stk2')
          }
        }
        // A little trick to calculate the thickness of the line.
        // The value needs to be the same as the hight of the node, but scaling
        // size to screen's height gives inversed value because screen's Y
        // coordinate goes from the top to the bottom, whereas the graph's Y=0
        // is at the bottom. So subtracting scaled doc count from screen height
        // (which is the "lower" bound of the "y" scale) gives us the right value
        {
          type: formula
          expr: range('y')[0]-scale('y', datum.size)
          as: strokeWidth
        }
        // Tooltip needs individual link's percentage of all traffic
        {
          type: formula
          expr: datum.size/domain('y')[1]
          as: percentage
        }
      ]
    }
  ]
  scales: [
    {
      // calculates horizontal stack positioning
      name: x
      type: band
      range: width
      domain: [
        stk1
        stk2
      ]
      paddingOuter: 0.05
      paddingInner: 0.95
    }
    {
      // this scale goes up as high as the highest y1 value of all nodes
      name: y
      type: linear
      range: height
      domain: {
        data: nodes
        field: y1
      }
    }
    {
      // use rawData to ensure the colors stay the same when clicking.
      name: color
      type: ordinal
      range: category
      domain: {
        data: rawData
        fields: [
          stk1
          stk2
        ]
      }
    }
    {
      // this scale is used to map internal ids (stk1, stk2) to stack names
      name: stackNames
      type: ordinal
      range: [
        Country
        Protocol
      ]
      domain: [
        stk1
        stk2
      ]
    }
  ]
  axes: [
    {
      // x axis should use custom label formatting to print proper stack names
      orient: bottom
      scale: x
      encode: {
        labels: {
          update: {
            text: {
              scale: stackNames
              field: value
            }
          }
        }
      }
    }
    {
      orient: left
      scale: y
    }
  ]
  marks: [
    {
      // draw the connecting line between stacks
      type: path
      name: edgeMark
      from: {
        data: edges
      }
      // this prevents some autosizing issues with large strokeWidth for paths
      clip: true
      encode: {
        update: {
          // By default use color of the left node, except when showing traffic
          // from just one country, in which case use destination color.
          stroke: [
            {
              test: groupSelector && groupSelector.stack=='stk1'
              scale: color
              field: stk2
            }
            {
              scale: color
              field: stk1
            }
          ]
          strokeWidth: {
            field: strokeWidth
          }
          path: {
            field: path
          }
          // when showing all traffic, and hovering over a country,
          // highlight the traffic from that country.
          strokeOpacity: {
            signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3
          }
          // Ensure that the hover-selected edges show on top
          zindex: {
            signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0
          }
          // format tooltip string
          tooltip: {
            signal: datum.stk1 + ' → ' + datum.stk2 + '    ' + format(datum.size, ',.0f') + '   (' + format(datum.percentage, '.1%') + ')'
          }
        }
        // Simple mouseover highlighting of a single line
        hover: {
          strokeOpacity: {
            value: 1
          }
        }
      }
    }
    {
      // draw stack groups (countries)
      type: rect
      name: groupMark
      from: {
        data: groups
      }
      encode: {
        enter: {
          fill: {
            scale: color
            field: grpId
          }
          width: {
            scale: x
            band: 1
          }
        }
        update: {
          x: {
            scale: x
            field: stack
          }
          y: {
            field: scaledY0
          }
          y2: {
            field: scaledY1
          }
          fillOpacity: {
            value: 0.6
          }
          tooltip: {
            signal: datum.grpId + '   ' + format(datum.total, ',.0f') + '   (' + format(datum.percentage, '.1%') + ')'
          }
        }
        hover: {
          fillOpacity: {
            value: 1
          }
        }
      }
    }
    {
      // draw country code labels on the inner side of the stack
      type: text
      from: {
        data: groups
      }
      // don't process events for the labels - otherwise line mouseover is unclean
      interactive: false
      encode: {
        update: {
          // depending on which stack it is, position x with some padding
          x: {
            signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)
          }
          // middle of the group
          yc: {
            signal: (datum.scaledY0 + datum.scaledY1)/2
          }
          align: {
            signal: datum.rightLabel ? 'left' : 'right'
          }
          baseline: {
            value: middle
          }
          fontWeight: {
            value: bold
          }
          // only show text label if the group's height is large enough
          text: {
            signal: abs(datum.scaledY0-datum.scaledY1) > 13 ? datum.grpId : ''
          }
        }
      }
    }
    {
      // Create a "show all" button. Shown only when a country is selected.
      type: group
      data: [
        // We need to make the button show only when groupSelector signal is true.
        // Each mark is drawn as many times as there are elements in the backing data.
        // Which means that if values list is empty, it will not be drawn.
        // Here I create a data source with one empty object, and filter that list
        // based on the signal value. This can only be done in a group.
        {
          name: dataForShowAll
          values: [
            {
            }
          ]
          transform: [
            {
              type: filter
              expr: groupSelector
            }
          ]
        }
      ]
      // Set button size and positioning
      encode: {
        enter: {
          xc: {
            signal: width/2
          }
          y: {
            value: 30
          }
          width: {
            value: 80
          }
          height: {
            value: 30
          }
        }
      }
      marks: [
        {
          // This group is shown as a button with rounded corners.
          type: "group"
          // mark name allows signal capturing
          name: "groupReset"
          // Only shows button if dataForShowAll has values.
          from: {
            data: dataForShowAll
          }
          encode: {
            enter: {
              cornerRadius: {
                value: 6
              }
              fill: {
                value: "#f5f5f5"
              }
              stroke: {
                value: "#c1c1c1"
              }
              strokeWidth: {
                value: 2
              }
              // use parent group's size
              height: {
                field: {
                  group: height
                }
              }
              width: {
                field: {
                  group: width
                }
              }
            }
            update: {
              // groups are transparent by default
              opacity: {
                value: 1
              }
            }
            hover: {
              opacity: {
                value: 0.7
              }
            }
          }
          marks: [
            {
              type: "text"
              // if true, it will prevent clicking on the button when over text.
              interactive: false
              encode: {
                enter: {
                  // center text in the paren group
                  xc: {
                    field: {
                      group: width
                    }
                    mult: 0.5
                  }
                  yc: {
                    field: {
                      group: height
                    }
                    mult: 0.5
                    offset: 2
                  }
                  align: {
                    value: center
                  }
                  baseline: {
                    value: middle
                  }
                  fontWeight: {
                    value: bold
                  }
                  text: {
                    value: Show All
                  }
                }
              }
            }
          ]
        }
      ]
    }
  ]
  signals: [
    {
      // used to highlight traffic to/from the same country
      name: groupHover
      value: {
      }
      on: [
        {
          events: @groupMark:mouseover
          update: "{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}"
        }
        {
          events: mouseout
          update: "{}"
        }
      ]
    }
    // used to filter only the data related to the selected country
    {
      name: groupSelector
      value: false
      on: [
        {
          // Clicking groupMark sets this signal to the filter values
          events: @groupMark:click!
          update: "{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}"
        }
        {
          // Clicking "show all" button, or double-clicking anywhere resets it
          events: [
            {
              type: click
              markname: groupReset
            }
            {
              type: dblclick
            }
          ]
          update: "false"
        }
      ]
    }
  ]
}


Question: type : Miniprint

Miniprint - Unknown Commands - Top 10


Miniprint Dashboard

Question: type : Miniprint

Miniprint


Question: type : NGINX

NGINX Events


Top 10 values of header_user-agent.keyword

Question: type : H0neytr4p

H0neytr4p HTTP User Agent Pie - Top 10


Question: type : Galah

Galah Method Pie - Top 10


Galah - User Agent - Top 10


Galah Dashboard

Question: type : Galah

Galah


Empty XY chart

T-Pot Attacks Destination Port Sparkline


Question: type:"Ipphoney"

Question: type:"Ipphoney"

Ipphoney-Logs


Question: type : NGINX

NGINX Events by Country Histogram


Question: type.keyword:"Adbhoney"

Adbhoney Input - Top 10

Adbhoney Input - Top 10


Question: type : Fatt

Fatt SSH Client - Top 10


Question: mail from

Question: rcpt to

Mailoney eMails - Top 10


Question: type : Tanner

Tanner HTTP Hostname Pie - Top 10


Question: type : Sentrypeer

Sentrypeer - SIP User Agent Pie - Top 10


Sentrypeer Dashboard

Question: type : Sentrypeer

Question: type : Sentrypeer

Sentrypeer


HTTP Request - Top 10 - Dynamic


Question: type : H0neytr4p

H0neytr4p Trapped Pie


Question: type.keyword:"Go-pot"

Go-pot - HTTP Request Path - Top 10


Attacks per T-Pot

Attacks per T-Pot


Question: type : Honeyaml

Honeyaml - Method Pie - Top 10


Question: type.keyword:"Beelzebub"

Beelzebub Output- Top 10


Question: type : Suricata

Suricata CVE - Top 10


Question: type : Wordpot

Wordpot Attack Type Pie


Question: type : ConPot

Conpot Response - Top 10


Question: type.keyword:"Honeyaml"

Honeyaml - HTTP Request Path - Top 10


Question: type.keyword:"Tanner"

Tanner Detection Type Pie - Top 10


Question: type:"Endlessh"

Question: type:"Endlessh"

Endlessh-Logs


Endlessh - Dnspot Name

Endlessh - Dnspot Name


Question: type : ElasticPot

ElasticPot - User Agent - Top 10


Question: type : P0f

P0f OS Distribution


Question: type:"Sentrypeer"

Question: type:"Sentrypeer"

Sentrypeer-Logs


Question: type : H0neytr4p

H0neytr4p HTTP Hostname Pie - Top 10


Top 10 values of header_content-type.keyword

Question: type : H0neytr4p

H0neytr4p Content Type Pie - Top 10


Top 3 values of trapped_risk_rating.keyword

Question: type : H0neytr4p

H0neytr4p Trap Reason Pie - Top 10


Question: type : H0neytr4p

H0neytr4p HTTP Method Pie - Top 10


Question: type : H0neytr4p

H0neytr4p HTTP Protocol Pie


Top 10 values of header_accept-language.keyword

Question: type : H0neytr4p

H0neytr4p HTTP Language Pie - Top 10


Question: type : H0neytr4p

H0neytr4p URI - Top 10


Question: type : H0neytr4p

H0neytr4p Payload Filename - Top 10


H0neytr4p Dashboard

Question: type : H0neytr4p

Src IP - Top 10 - Dynamic

H0neytr4p


T-Pot Attacks Sparkline


Glutton Flow Direction

Glutton Flow Direction


Question: type : Suricata

Suricata Countries - Top 10


T-Pot Attack Map


logstash-*

Honeypot Attacks - Total (converted)


Top values of geoip.country_name.keyword

Empty XY chart

T-Pot Attacks by Country Sparkline


T-Pot Attack Log


T-Pot Live Attack Map

Question: type : Adbhoney Beelzebub Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Galah Go-pot Glutton Hellpot Heralding Honeyaml Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Miniprint Redishoneypot Sentrypeer Tanner Wordpot

Honeypot Attacks - Total (converted)

logstash-*

Attacks

Ports

Countries

>T-Pot Live Attack Map


Question: type : Glutton

Glutton Heatmap


Question: type : Glutton

Glutton Handler


Question: type.keyword:"Glutton"

Glutton Payload Hex - Top 10

Glutton Payload Hex - Top 10


Question: type : Glutton

Glutton Msg - Top 10


Glutton Dashboard

Question: type : Glutton

Glutton


Question: type.keyword:"Cowrie"

Cowrie Input - Top 10


Question: type : Adbhoney Beelzebub Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Galah Go-pot Glutton H0neytr4p Hellpot Heralding Honeyaml Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Miniprint Redishoneypot Sentrypeer Tanner Wordpot

Attacks by Honeypot


Question: type : Log4Pot

Log4Pot - HTTP Hostname Pie - Top 10

Log4Pot - HTTP Hostname Pie - Top 10


Question: type : Tanner

Tanner HTTP User Agent Pie - Top 10


Question: type.keyword:"Cowrie"

Cowrie - HASSH / IP - Pie


Adbhoney Dashboard

Question: type : Adbhoney

Attacks Dynamic

Adbhoney


Payload - Top 10 - Dynamic

Payload - Top 10 - Dynamic


Question: type : Honeyaml

Honeyaml - Device Info - Top 10


Honeyaml - User Agent - Top 10


Question: type : Honeyaml

Honeyaml - Body Top 10 - Tagcloud


Honeyaml Dashboard

Question: type : Honeyaml

Honeyaml - Body Top 10 - Tagcloud

Question: type : Honeyaml

Honeyaml


Question: type : Adbhoney Beelzebub Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Galah Go-pot Glutton H0neytr4p Hellpot Heralding Honeyaml Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Miniprint Redishoneypot Sentrypeer Tanner Wordpot

Honeypot Attacks Bar


Question: type : Adbhoney Beelzebub Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Galah Go-pot Glutton H0neytr4p Hellpot Heralding Honeyaml Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Miniprint Redishoneypot Sentrypeer Tanner Wordpot

Attacks by Honeypot Histogram


Question: type : Adbhoney Beelzebub Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Galah Go-pot Glutton H0neytr4p Hellpot Heralding Honeyaml Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Miniprint Redishoneypot Sentrypeer Tanner Wordpot

Attacker Source IP - Top 10


Attacks by Country and Port

Attacks by Country and Port


T-Pot Dashboard

P0f OS Distribution (converted)

Question: type : P0f

Attacks by Destination Port Histogram

Question: type : Adbhoney Beelzebub Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Galah Go-pot Glutton H0neytr4p Hellpot Heralding Honeyaml Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Miniprint Redishoneypot Sentrypeer Tanner Wordpot

Honeypot Attacks Bar (converted)

Question: type.keyword:"Adbhoney" OR type.keyword:"Ciscoasa" OR type.keyword:"CitrixHoneypot" OR type.keyword:"ConPot" OR type.keyword:"Cowrie" OR type.keyword:"Ddospot" OR type.keyword:"Dicompot" OR type.keyword:"Dionaea" OR type.keyword:"ElasticPot" OR type.keyword:"Endlessh" OR type.keyword:"Glutton" OR type.keyword:"Hellpot" OR type.keyword:"Heralding" OR type.keyword:"Honeytrap" OR type.keyword:"Honeypots" OR type.keyword:"Log4pot" OR type.keyword:"Ipphoney" OR type.keyword:"Mailoney" OR type.keyword:"Medpot" OR type.keyword:"Redishoneypot" OR type.keyword:"Sentrypeer" OR type.keyword:"Tanner" OR type.keyword:"Wordpot"

Honeypot Attacks Histogram

Question: type : Adbhoney Beelzebub Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Galah Go-pot Glutton H0neytr4p Hellpot Heralding Honeyaml Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Miniprint Redishoneypot Sentrypeer Tanner Wordpot

Attacks by Country Histogram

Question: type : Adbhoney Beelzebub Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Galah Go-pot Glutton H0neytr4p Hellpot Heralding Honeyaml Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Miniprint Redishoneypot Sentrypeer Tanner Wordpot

Attacks by Country and Port

Honeypot Attacks

Question: type : Adbhoney Beelzebub Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Galah Go-pot Glutton H0neytr4p Hellpot Heralding Honeyaml Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Miniprint Redishoneypot Sentrypeer Tanner Wordpot

Honeypot Attacks - Top 10

Question: type : Adbhoney Beelzebub Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Galah Go-pot Glutton H0neytr4p Hellpot Heralding Honeyaml Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Miniprint Redishoneypot Sentrypeer Tanner Wordpot

>T-Pot


Question: type:"Beelzebub"

Question: type:"Beelzebub"

Beelzebub-Logs


Question: type : Wordpot

Wordpot URL - Top 10


Question: type : Hellpot

Hellpot - User Agent


User Agent - Top 10 - Dynamic


Question: type : Suricata

Suricata SSH Client Software Version Pie - Top 10


Question: type.keyword:"Cowrie"

Cowrie - Top URI Downloads


Question: type : Fatt

Fatt RDP Client Name - Top 10

Fatt RDP Client Name - Top 10


Question: type : Log4Pot

Log4Pot - HTTP Reason Pie - Top 10


Payload - Top 10 - Dynamic


Log4Pot Dashboard

Question: type : Log4Pot

Log4Pot


Question: type : Suricata

Suricata - IP / JA3 - Pie


Wordpot UserAgent - Top 5


Wordpot Dashboard

Question: type : Wordpot

Attacks Dynamic

Wordpot


Question: type : Fatt

Fatt HTTP User Agent - Top 10


Question: type:"Mailoney"

Question: type:"Mailoney"

Mailoney-Logs


Question: type.keyword:"NGINX"

NGINX Source IP - Top 10


Conpot Dashboard

Question: type : ConPot

Conpot


Question: type:"ConPot"

Question: type:"ConPot"

ConPot-Logs


Question: type.keyword:"Cowrie"

Cowrie Version Pie - Top 10


Question: type:"Cowrie"

Cowrie Attacks Bar


Cowrie Dashboard

Question: type : Cowrie

Cowrie


Question: type:"Cowrie"

Question: type:"Cowrie"

Cowrie-Logs


Question: type.keyword:"Dionaea"

Dionaea Type


Dionaea Dashboard

Question: type : Dionaea

Dionaea


Question: type:"Dionaea"

Question: type:"Dionaea"

Dionaea-Logs


ElasticPot Dashboard

Question: type : ElasticPot

ElasticPot


Question: type:"ElasticPot"

Question: type:"ElasticPot"

ElasticPot-Logs


Honeytrap Dashboard

Question: type : Honeytrap

Honeytrap


Question: type:"Honeytrap"

Question: type:"Honeytrap"

Honeytrap-Logs


Question: type : NGINX

NGINX Events Histogram


Question: type : NGINX

NGINX HTTP Method Pie - Top 10


Question: type.keyword:"NGINX"

NGINX HTTP Status Code Pie - Top 10


Question: type : NGINX

NGINX Username Tagcloud


NGINX Dashboard

Question: type : NGINX

NGINX


Question: type:"NGINX"

Question: type:"NGINX"

NGINX-Logs


P0f-Logs


Question: type : Suricata

Suricata Fileinfo Magic - Top 10


Question: type : Suricata

Suricata HTTP Hostname Pie - Top 10


Question: type : Suricata

Suricata HTTP Method Pie - Top 10


Question: type : Suricata

Suricata Source IP - Top 10


Question: type : Suricata

Suricata - AS/N - Top 10


Question: type : Suricata

Suricata - Attacker Src IP Reputation


Question: type : Suricata

Suricata - IP / JA4 - Pie


Suricata Dashboard

Question: type : Suricata

Suricata HTTP Method Pie - Top 10

Question: type : Suricata

Suricata Events Bar

Question: type : Suricata

Suricata Events

Suricata


Question: type:"Suricata"

Question: type:"Suricata"

Suricata-Logs


Question: type : Ipphoney

Ipphoney - Request Method - Top 5


Question: type : Go-pot

Go-pot - Method Pie - Top 10


Question: type.keyword:"Go-pot"

Go-pot - HTTP Request Path Duration - Top 10


Go-pot Dashboard

Question: type : Go-pot

Go-pot - User Agent - Top 10

Country Port Relation - Vega

Go-pot - HTTP Request Path - Top 10

Question: type.keyword:"Go-pot"

Go-pot


Question: type : CitrixHoneypot

CitrixHoneypot Event Type


Attacks per T-Pot Histogram

Attacks per T-Pot Histogram

Timestamp

Attacks


Question: type : Ipphoney

Ipphoney - Event Types


Ipphoney Dashboard

Question: type : Ipphoney

Ipphoney


HTTP Request - Top 10 - Dynamic

HTTP Request - Top 10 - Dynamic


Question: type:"Medpot"

Question: type:"Medpot"

Medpot-Logs


Question: type:"Ddospot"

Question: type:"Ddospot"

Ddospot-Logs


Log4Pot-Logs


Question: type:"Heralding"

Question: type:"Heralding"

Heralding-Logs


Question: type:"Adbhoney" OR type:"Ciscoasa" OR type:"CitrixHoneypot" OR type:"ConPot" OR type:"Cowrie" OR type:"Ddospot" OR type:"Dicompot" OR type:"Dionaea" OR type:"ElasticPot" OR type:"Endlessh" OR type:"Glutton" OR type:"Hellpot" OR type:"Heralding" OR type:"Honeypots" OR type:"Honeytrap" OR type: "Ipphoney" OR type:"Log4pot" OR type:"Mailoney" OR type:"Medpot" OR type:"Redishoneypot" OR type:"Sentrypeer" OR type:"Tanner" OR type:"Wordpot"

Question: type:"Adbhoney" OR type:"Ciscoasa" OR type:"CitrixHoneypot" OR type:"ConPot" OR type:"Cowrie" OR type:"Ddospot" OR type:"Dicompot" OR type:"Dionaea" OR type:"ElasticPot" OR type:"Endlessh" OR type:"Glutton" OR type:"Hellpot" OR type:"Heralding" OR type:"Honeypots" OR type:"Honeytrap" OR type: "Ipphoney" OR type:"Log4pot" OR type:"Mailoney" OR type:"Medpot" OR type:"Redishoneypot" OR type:"Sentrypeer" OR type:"Tanner" OR type:"Wordpot"

T-Pot-Logs


Heatmap Destination Ports - Dynamic

Heatmap Destination Ports - Dynamic


Question: type.keyword:"Dicompot"

Dicompot - Message


Question: type : Fatt

Fatt - IP / HTTP Client Header Hash - Pie


Question: type.keyword:"CitrixHoneypot"

CitrixHoneypot Filenames - Top 10


CitrixHoneypot Dashboard

Question: type : CitrixHoneypot

CitrixHoneypot


Question: type.keyword:"Hellpot"

Hellpot Duration and Bytes - Top 10

Hellpot Duration and Bytes - Top 10


Question: type:"Fatt"

Fatt Attacks

Fatt Attacks


Question: type : Fatt

Fatt - IP / TLS-JA3 - Pie


Question: type : Fatt

Fatt HTTP Request Method - Top 10


Fatt Dashboard

Question: type : Fatt

Fatt


Question: type : Adbhoney Beelzebub Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Galah Go-pot Glutton H0neytr4p Hellpot Heralding Honeyaml Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Miniprint Redishoneypot Sentrypeer Tanner Wordpot

Attacks by Country Histogram


Question: type:"Galah"

Question: type:"Galah"

Galah-Logs


Hellpot Dashboard

Question: type : Hellpot

Hellpot


Question: type : Adbhoney Beelzebub Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Galah Go-pot Glutton H0neytr4p Hellpot Heralding Honeyaml Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Miniprint Redishoneypot Sentrypeer Tanner Wordpot

Attacks by Destination Port Histogram


Question: type:"Tanner"

Question: type:"Tanner"

Tanner-Logs


Question: type:"Redishoneypot"

Question: type:"Redishoneypot"

Redishoneypot-Logs


Question: type : Adbhoney Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Glutton Hellpot Heralding Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Redishoneypot Sentrypeer Tanner Wordpot

Honeypot Attacks - Top 10


Question: type.keyword:"Mailoney"

Mailoney Data - Top 20


Mailoney Dashboard

Question: type : Mailoney

Mailoney


Question: type:"Hellpot"

Question: type:"Hellpot"

Hellpot-Logs


Question: type:"Fatt"

Question: type:"Fatt"

Fatt-Logs


Question: type : Adbhoney Ciscoasa CitrixHoneypot ConPot Cowrie Ddospot Dicompot Dionaea ElasticPot Endlessh Glutton Hellpot Heralding Honeytrap Honeypots Log4pot Ipphoney Mailoney Medpot Redishoneypot Sentrypeer Tanner Wordpot

Honeypot Attacks


Dicompot Dashboard

Question: type : Dicompot

Dicompot


Question: type : Tanner

Tanner HTTP Encoding Pie - Top 10


Question: type:"Honeypots"

Question: type:"Honeypots"

Honeypots-Logs


Question: type:"Adbhoney"

Adbhoney Samples - Top 10

Adbhoney Samples - Top 10


Tanner Dashboard

Question: type : Tanner

Tanner