Login attempts from various honeypots included. Fixes #470 #911
Login attempts from various honeypots included. Fixes #470 #911regulartim merged 2 commits intointelowlproject:developfrom
Conversation
There was a problem hiding this comment.
Pull request overview
Extends IOC login-attempt counting to cover all honeypots that capture credentials by detecting normalized username/password fields in Elasticsearch hits, addressing the gap described in #470 and avoiding Cowrie double-counting.
Changes:
- Update
iocs_from_hits()to count login attempts based on presence ofusernameorpasswordfields (instead of Heralding-only logic). - Remove Cowrie session-level increment that could double-count login attempts.
- Expand and adjust tests to cover credential-based login-attempt counting scenarios.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
greedybear/cronjobs/extraction/utils.py |
Switch login-attempt calculation to field-based credential detection across all hit types. |
greedybear/cronjobs/extraction/strategies/cowrie.py |
Remove per-session increment to prevent double-counting now that IOC-level counting is credential-based. |
tests/test_extraction_utils.py |
Add username/password support in hit factory and new tests for credential-based counting. |
tests/test_cowrie_extraction.py |
Update Cowrie session hit test expectation to match removed increment behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ip_reputation=correct_ip_reputation(ip, hits[0].get("ip_rep", "")), | ||
| asn=hits[0].get("geoip", {}).get("asn"), | ||
| destination_ports=sorted(set(dest_ports)), | ||
| login_attempts=len(hits) if hits[0].get("type", "") == "Heralding" else 0, | ||
| login_attempts=sum(1 for h in hits if h.get("username") or h.get("password")), | ||
| firehol_categories=firehol_categories, |
There was a problem hiding this comment.
login_attempts is computed with an additional full pass over hits. iocs_from_hits() already iterates over hits multiple times (dest ports, sensors, timestamps), so this adds another O(n) pass per IP. Consider accumulating login_attempts during an existing loop over hits to avoid extra iteration when processing large hit batches.
|
Can you please review all these, @regulartim |
regulartim
left a comment
There was a problem hiding this comment.
Very nice, thank you! :)
I’m genuinely delighted to have written a piece of code that required no review. |
…#470 (intelowlproject#911) * fix * COPILOT CHANGES --------- Co-authored-by: rootp1 <rootp1@github.com>
Description
Previously, login attempts were only counted for two honeypots: Cowrie (via specific event IDs in session processing) and Heralding (via a hardcoded name check). All other honeypots such as Mailoney, Dionaea, CitrixHoneypot, Sentrypeer, Glutton etc. had their login attempts silently ignored.
The fix replaces the Heralding-specific hardcode in
iocs_from_hits()with a generic field-based check: a hit is counted as a login attempt if the Elasticsearch document contains a non-emptyusernameorpasswordfield. Since T-Pot's logstash pipeline normalizes credentials to these standard fields across all honeypots, this covers every current and future credential-capturing honeypot automatically without needing to enumerate them by name.The redundant
session_record.source.login_attempts += 1in Cowrie's_process_session_hit()was also removed to prevent double-counting, since Cowrie only populatesusername/passwordfields oncowrie.login.failedandcowrie.login.successevents exactly matching what the session-level increment was counting before.Related issues
Closes #470
Type of change
Checklist
Please complete this checklist carefully. It helps guide your contribution and lets maintainers verify that all requirements are met.
Formalities
<feature name>. Closes #999develop.develop.Docs and tests
Ruff) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.GUI changes
Ignore this section if you did not make any changes to the GUI.
Review process