HoneyLabs

Search Events Tool

Return individual raw honeypot events with all fields. Use when the user wants to see actual records: 'show me events from this IP', 'what hit port 443 last week', 'events from Russia yesterday'. Filters: source_ip, country (2-letter code), asn (e.g. 'AS12345'), dest_port, protocol ('tls' or '' = the coarse TLS/raw-TCP signal), app_protocol (nDPI L7 protocol label: 'bittorrent', 'ssh', 'rdp', 'mssql-tds', 'mining', 'rtsp', 'smbv1', ... — find everything speaking a protocol regardless of port), h

Top Attackers Tool

Ranked leaderboard of attack sources. Use for: 'who is attacking the most?', 'top attacking countries', 'most targeted ports', 'most common user agents', 'top ASNs by attack volume', 'top IPs from China', 'top attackers hitting port 22'. 'by' controls grouping: ip, asn, country, port, user_agent, ja4, url_path, domain, cve. by='cve' answers 'what CVEs are being mass-scanned right now' and returns value (the CVE id), title, severity, actively_exploited and counts; drill into any of them with cve_

Ioc Lookup Tool

Look up any IP address, CIDR network, set of networks, or domain in the honeypot dataset. Use this FIRST whenever the user asks: 'is this IP malicious?', 'is this a known scanner?', 'have you seen this IP?', 'what does this IP do?', 'when was it last seen?', 'is this IP in your data?'. Returns: total_events (0 = never observed), first_seen, last_seen, country, ASN, the 50 most-hit ports plus ports_targeted_count for the true total, top user agents, top URL paths, TLS/HTTP/SSH

Cve Lookup Tool

Who is probing a specific CVE. Use whenever the user names a CVE: 'is CVE-2024-4577 being exploited in the wild?', 'who is scanning for this CVE?', 'show me actors probing CVE-2023-1389'. Returns severity, KEV (actively_exploited), event and unique-IP counts, the top probing IPs with country/ASN/scanner tag, top ASNs, exploiter fingerprints, sample request paths and a daily timeline. window: 24h, 7d, 30d or 90d. `observed: false` with a note means we hold no detection pattern for that CVE, which

Payload Search Tool

Literal substring search over captured request text: URL path, request body, request headers and event summary. Use for: 'find attacks targeting /wp-admin', 'find requests with this user agent string', 'what payloads hit port 80 last week'. It matches text that literally appeared in the request, and nothing else. These do NOT work and will return an empty list: - a CVE id ('CVE-2024-4577'), which is our tag for a pattern, never payload text. Use cve_lookup instead. This tool rejects them

Attack Timeline Tool

Attack volume over time, bucketed by hour or day. Use for: 'show attack trends this week', 'was there a spike on port 22?', 'how has SSH scanning changed?', 'attack volume from China over 30 days'. bucket: 'hour' or 'day'. Optional filters: filter_protocol ('tls'/'''), filter_country (2-letter code), filter_dest_port. since/until ISO-8601 UTC.

Asn Enrich Tool

Full honeypot profile for an ASN (autonomous system / hosting provider). Use for: 'tell me about AS202425', 'what is Vultr doing in my honeypots?', 'attacks from this hosting provider', 'attribute this IP to its network'. asn format: 'AS12345'. Returns: total events, unique IPs, top targeted ports, top source countries, top user agents, org name. since/until are ISO-8601 UTC strings.

Fingerprint Search Tool

Search honeypot activity by TLS, HTTP, or SSH fingerprint. Use when a user asks: 'have you seen this JA4 fingerprint?', 'which IPs share this TLS fingerprint?', 'how common is this HASSH?', 'find all scanners with this SSH client fingerprint'. fp_type: 'ja4' (TLS client), 'ja3' (legacy TLS client, MD5 — still keyed by many TI feeds), 'ja4h' (HTTP client), 'hassh' (SSH client). since/until are ISO-8601 UTC strings.

Fingerprint Population Tool

The population behind a single client fingerprint: how many source IPs carry it, across how many networks (ASNs) and countries, the ports they hit, the top networks and a sample of the IPs, plus a read on its shape: concentrated (many IPs on few networks), dispersed (many networks but one short burst on one or two ports, which is a coordinated operation buying one address per network), spread (a common client) or mixed. Concentrated and dispersed are both coordinated operations. Use when a user