Honeypot part 2: Visualizing the logs using the Elastic Stack

Introduction

Previous tutorial: Setting up Cowrie and Dionaea

A visualization tool, in terms of logs, is designed to process imported logs and present the data in a more structured manner, allowing a manager to easily create a visual representation of the logs. These visual representations can come in the range of tables to graphs.

The Elastic stack is a stack of three software components (Elastic Search, Logstash and Kibana) from the same developer, Elastic. They are designed to work together in order to make up a complete log handling and visualization tool. They are also free to use, with the exception of hosting services and premium features.

In this tutorial we will be using the Elastic stack to set up a centralized log server that can monitor malicious activities in real time. We will also configure both Cowrie and Dionaea so that Kibana can be used to create visual representations from events such as downloads and command inputs.

Our goal

Our goal in this tutorial is to set up a centralized log server that can receive logs from the Cowrie- and Dionaea -honeypots, which can process and create a database out of the log entries. This database will be used by Kibana to set up visual representations of the logs, such as tables and graphs.

This setup consists of the following four software components:

1. Logstash: A service that will receive logs from Cowrie and Dionaea, processes them depending on given configurations and then give the output directly to Elastic Search.
2. Elastic Search: A database which will store and index the results received from Logstash.
3. Kibana: A management GUI for visual representations that will query Elastic Search in order to provide data to the configured visual representations.
4. Filebeat: A software installed on the honeypot that will monitor the logs from Cowrie and Dionaea, and then send (beat) any new entry to Logstash.

Honeypot part 1: Setting up Cowrie and Dionaea

Introduction

Honeypots are a great way to learn more information about how different services are being exploited, to monitor malicious activity in an isolated environment and to gather information about subjects such as usernames, passwords, shell commands, etc. Some honeypots are also equipped with the ability to capture binaries transferred to the server, and further analysis of these can reveal undetected malware.

In this tutorial we will go over the installation and configuration of Cowrie and Dionaea – two powerful honeypots that complements each other nicely. Dionaea is a honeypot designed to emulate vulnerable services ranging from the network file sharing protocol for Windows (SMB) to SQL servers. Cowrie is designed to emulate a vulnerable SSH and Telnet server. Both of these honeypots are designed to capture the behavior of the attacker and to collect binaries transferred to the server by intruders.

Our goal

The goal of this tutorial is to set up a honeypot server that can capture the behavior of an attacker as well as binaries such as ransomware worms. The setup will consist of the following two components:

1. Dionaea: A honeypot designed to capture malware.
2. Cowrie: A SSH and Telnet honeypot designed to log brute force attempts and the behavior of an attacker.