splunk/DECEIVE
1
0
Fork 0
mirror of https://github.com/splunk/DECEIVE.git synced 2025-07-02 00:57:26 -04:00
Code Issues Packages Projects Releases Wiki Activity

Added 'sensor_name' and 'sensor_protocol' to logs

Browse Source 
* 'sensor_name` is an arbitrary string that identifies the specific honeypot sensor that generated the log. Set it in the config.ini file. If not set, it will default to the honeypot system's hostname.
* 'sensor_protocol' identifies the specific protocol this honeypot sensor uses. For SSH, it's always "ssh" but as other protocols are added to DECEIVE in the future, this will have different values for their logs.
This commit is contained in:
David J. Bianco
2025-02-06 10:16:42 -05:00
parent fd0d8a78fc
commit 1d0e046924
2 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
SSH/config.ini.TEMPLATE
View File

@ -6,6 +6,10 @@
# The name of the file you wish to write the honeypot log to.
log_file = ssh_log.log
# The name of the sensor, used to identify this honeypot in the logs.
# If you leave this blank, the honeypot will use the system's hostname.
sensor_name = deceive
# Settings for the SSH honeypot
[ssh]
# The port the SSH honeypot will listen on. You will probably want to set