Content
- Log parsers2
- Attack scenarios1
SSHesame - Honeypot ProtectionParent3 items
SSHesame - Honeypot Protection
Collection
- By
- thespad
- Version
- 0.2
- Name
- thespad/sshesame
Collection for sshesame SSH honeypot
Installation
sudo cscli collections install thespad/sshesameThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: thespad/sshesameparsers:- thespad/sshesame-logs- crowdsecurity/dateparse-enrichscenarios:- thespad/sshesame-honeypotdescription: "Collection for sshesame SSH honeypot"labels:label: "SSHesame - Honeypot Protection"author: thespadtags:- security_engine- sshesame- ssh
Installed on
Know where it runs
Sign in to see the Security Engines that run this collection, the version they run and whether it was modified locally.
Documentation
sshesame collection
A collection to parse sshesame honeypot logs.
- sshesame log parser
- sshesame login and command scenarios
Acquisition template
Example acquisition for this collection:
1filenames:2 - /var/log/sshesame.log3labels:4 type: sshesame
Notes
- The parser expects sshesame log timestamps to be enabled
- The command scenario will immediately overflow on any command received from a remote client