splunk/DECEIVE
1
0
Fork 0
mirror of https://github.com/splunk/DECEIVE.git synced 2025-07-02 00:57:26 -04:00
Code Issues Packages Projects Releases Wiki Activity

Compare commits

base: splunk:wildcard-passwords
Branches Tags
splunk:main splunk:conversation-history splunk:temperature splunk:command-line-options splunk:wildcard-passwords splunk:ssh-execute-arg splunk:multiplatform-compat splunk:config-files splunk:user-system-prompt
splunk:deceive-1.1 splunk:deceive-1.0
...
compare: splunk:deceive-1.0
Branches Tags
splunk:main splunk:conversation-history splunk:temperature splunk:command-line-options splunk:wildcard-passwords splunk:ssh-execute-arg splunk:multiplatform-compat splunk:config-files splunk:user-system-prompt
splunk:deceive-1.1 splunk:deceive-1.0

2 Commits
wildcard-p ... deceive-1.

Author SHA1 Message Date
DavidJBianco
fd0d8a78fc Update README.md 
Added more info about the `details` and `interactive` fields to logging section.
 2025-02-05 06:41:16 -05:00
David J. Bianco
dba537c58f removed debug statements 2025-02-04 16:11:48 -05:00
2 changed files with 6 additions and 6 deletions
Expand all files Collapse all files

4
README.md
View File

@ -93,8 +93,8 @@ Things to note:
* `Session summary`
* `SSH connection closed`
* Several of these message types also feature a `details` field with additional information
* `User input` messages contain a base64-encoded copy of the entire user input
* `LLM response` messages contain a base64-encoded copy of the entire simulated response
* `User input` messages contain a base64-encoded copy of the entire user input in the `details` field, as well as an `interactive` field (true/false) that tells you whether this was an interactive or non-interactive command (i.e., whether they logged in with a terminal session or provided a command on the SSH command-line).
* `LLM response` messages contain a base64-encoded copy of the entire simulated response in the `details` field.
* `Session summary` messages contain not only a summary of the commands, but also a guess as to what they might have been intended to accomplish. There will also be a `judgement` field that contains one of "BENIGN", "SUSPICIOUS", or "MALICIOUS"
* Since this is a honeypot and not intended for use by real users, IT WILL LOG USERNAMES AND PASSWORDS! These are found in the `Authentication success` messages, in the `username` and `password` fields.

6
SSH/ssh_server.py
View File

@ -195,7 +195,7 @@ async def handle_client(process: asyncssh.SSHServerProcess, server: MySSHServer)
config=llm_config
)
process.stdout.write(f"{llm_response.content}")
logger.info("LLM response 1", extra={"details": b64encode(llm_response.content.encode('utf-8')).decode('utf-8'), "interactive": False})
logger.info("LLM response", extra={"details": b64encode(llm_response.content.encode('utf-8')).decode('utf-8'), "interactive": False})
await session_summary(process, llm_config, with_message_history, server)
process.exit(0)
else:
@ -210,7 +210,7 @@ async def handle_client(process: asyncssh.SSHServerProcess, server: MySSHServer)
)
process.stdout.write(f"{llm_response.content}")
logger.info("LLM response 2", extra={"details": b64encode(llm_response.content.encode('utf-8')).decode('utf-8'), "interactive": True})
logger.info("LLM response", extra={"details": b64encode(llm_response.content.encode('utf-8')).decode('utf-8'), "interactive": True})
async for line in process.stdin:
line = line.rstrip('\n')
@ -231,7 +231,7 @@ async def handle_client(process: asyncssh.SSHServerProcess, server: MySSHServer)
return
else:
process.stdout.write(f"{llm_response.content}")
logger.info("LLM response 3", extra={"details": b64encode(llm_response.content.encode('utf-8')).decode('utf-8'), "interactive": True})
logger.info("LLM response", extra={"details": b64encode(llm_response.content.encode('utf-8')).decode('utf-8'), "interactive": True})
except asyncssh.BreakReceived:
pass