Summary

This PR fixes the 'DatabaseDefault' object has no attribute 'date' error that crashes the extraction pipeline during Cowrie (and potentially
other honeypot) processing. The issue was introduced after #887 switched IOC.last_seen from default=datetime.now to db_default=Now().

With db_default, unsaved IOC instances no longer get a real datetime in memory — they get a DatabaseDefault sentinel instead. When
_update_days_seen() tries to call .date() on that, it blows up.

I traced this to three code paths where last_seen never gets explicitly set:

• cowrie.py — payload hostname IOC creation
• cowrie.py — download URL IOC creation
• utils.py — iocs_from_hits() when hits lack timestamp fields (this one affects all honeypot strategies, not just Cowrie)

Fix

Rather than patching each of the three creation sites individually, I went with a chokepoint approach — every IOC flows through
_update_days_seen() in ioc_processor.py regardless of which strategy created it, so guarding there covers all current and future cases in one
place.

• In _update_days_seen(), I added an isinstance check before calling .date(). If last_seen isn't a real datetime, it falls back to
  datetime.now().
• In _merge_iocs(), I added a guard to skip overwriting existing.last_seen when the incoming IOC carries a DatabaseDefault. Without this, a
  DatabaseDefault from a new unsaved IOC would silently corrupt a perfectly valid timestamp on an existing DB record.

Closes #908
Based on the PR details provided, here are the checked items:

Formalities

• I have read and understood the rules about how to Contribute to this project.
• I chose an appropriate title for the pull request in the form: <feature name>. Closes #999
• My branch is based on develop.
• The pull request is for the branch develop.
• I have reviewed and verified any LLM-generated code included in this PR.

Docs and tests

• I documented my code changes with docstrings and/or comments.
• I have checked if my changes affect user-facing behavior that is described in the docs. If so, I also created a pull request in the docs repository.
• Linter (Ruff) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.
• I have added tests for the feature/bug I solved.
• All the tests gave 0 errors.

GUI changes

• I have provided a screenshot of the result in the PR.
• I have created new frontend tests for the new component or updated existing ones.

Review process

• We encourage you to create a draft PR first, even when your changes are incomplete. This way you refine your code while we can track your progress and actively review and help.
• If you think your draft PR is ready to be reviewed by the maintainers, click the corresponding button. Your draft PR will become a real PR.
• If your changes decrease the overall tests coverage (you will know after the Codecov CI job is done), you should add the required tests to fix the problem.
• Every time you make changes to the PR and you think the work is done, you should explicitly ask for a review. After receiving a "change request", address the feedback and click "request re-review" next to the reviewer's profile picture at the top right.