misp-objects/objects/cowrie/definition.json

{
  "requiredOneOf": [
    "session"
  ],
  "attributes": {
    "eventid": {
      "description": "Eventid of the session in the cowrie honeypot",
      "disable_correlation": true,
      "ui-priority": 1,
      "misp-attribute": "text"
    },
    "system": {
      "description": "System origin in cowrie honeypot",
      "disable_correlation": true,
      "ui-priority": 1,
      "misp-attribute": "text"
    },
    "username": {
      "description": "Username related to the password(s)",
      "ui-priority": 1,
      "misp-attribute": "text"
    },
    "password": {
      "description": "Password",
      "multiple": true,
      "ui-priority": 1,
      "misp-attribute": "text"
    },
    "session": {
      "description": "Session id",
      "ui-priority": 1,
      "misp-attribute": "text"
    },
    "timestamp": {
      "description": "When the event happened",
      "ui-priority": 1,
      "misp-attribute": "datetime",
      "disable_correlation": true
    },
    "message": {
      "description": "Message of the cowrie honeypot",
      "ui-priority": 1,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "protocol": {
      "description": "Protocol used in the cowrie honeypot",
      "ui-priority": 1,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "sensor": {
      "description": "Cowrie sensor name",
      "ui-priority": 1,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "src_ip": {
      "description": "Source IP address of the session",
      "ui-priority": 1,
      "misp-attribute": "ip-src"
    },
    "dst_ip": {
      "description": "Destination IP address of the session",
      "ui-priority": 1,
      "misp-attribute": "ip-dst",
      "disable_correlation": true
    },
    "src_port": {
      "description": "Source port of the session",
      "ui-priority": 1,
      "misp-attribute": "port",
      "disable_correlation": true
    },
    "dst_port": {
      "description": "Destination port of the session",
      "ui-priority": 1,
      "misp-attribute": "port",
      "disable_correlation": true
    },
    "isError": {
      "description": "isError",
      "ui-priority": 1,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "input": {
      "description": "Input of the session",
      "ui-priority": 1,
      "misp-attribute": "text"
    },
    "macCS": {
      "description": "SSH MAC supported in the sesssion",
      "multiple": true,
      "disable_correlation": true,
      "ui-priority": 1,
      "misp-attribute": "text"
    },
    "keyAlgs": {
      "description": "SSH public-key algorithm supported in the session",
      "multiple": true,
      "disable_correlation": true,
      "ui-priority": 1,
      "misp-attribute": "text"
    },
    "encCS": {
      "description": "SSH symmetric encryption algorithm supported in the session",
      "multiple": true,
      "disable_correlation": true,
      "ui-priority": 1,
      "misp-attribute": "text"
    },
    "compCS": {
      "description": "SSH compression algorithm supported in the session",
      "multiple": true,
      "ui-priority": 1,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "hassh": {
      "description": "HASSH of the client SSH session following Salesforce algorithm",
      "misp-attribute": "hassh-md5",
      "ui-priority": 1
    }
  },
  "version": 3,
  "description": "Cowrie honeypot object template",
  "meta-category": "network",
  "uuid": "ae085d32-6534-4d52-b3eb-063fccb753e7",
  "name": "cowrie"
}