Model extensions. Closes #405 . #407
Conversation
…y relation with GeneralHoneypot
… and add cowrie session data extraction
|
GUI change: "Times Seen" renamed |
| class CowrieSession(models.Model): | ||
| session_id = models.BigIntegerField(primary_key=True) | ||
| start_time = models.DateTimeField(blank=True, null=True) | ||
| duration = models.FloatField(blank=True, null=True) | ||
| login_attempt = models.BooleanField(blank=False, null=False, default=False) | ||
| credentials = pg_fields.ArrayField(models.CharField(max_length=256, blank=True), blank=False, null=False, default=list) | ||
| command_execution = models.BooleanField(blank=False, null=False, default=False) | ||
| interaction_count = models.IntegerField(blank=False, null=False, default=0) | ||
| source = models.ForeignKey(IOC, on_delete=models.CASCADE, blank=False, null=False) | ||
|
|
||
|
|
There was a problem hiding this comment.
it could be useful to create a visualization with search options in the Django Admin interface. It should be pretty straightforward and would allow to analyze data without having to create a complex interface in the frontend
There was a problem hiding this comment.
in that case also some indexes for the search fields could be useful addition
There was a problem hiding this comment.
Ok, I'll have to read into that and would like to implement it in a different branch, if that's fine for you?
You mean DB indexes, right?
| ip_reputation = models.CharField(max_length=32, blank=True) | ||
| asn = models.IntegerField(blank=True, null=True) | ||
| destination_ports = pg_fields.ArrayField(models.IntegerField(), blank=False, null=False, default=list) | ||
| login_attempts = models.IntegerField(blank=False, null=False, default=0) | ||
|
|
There was a problem hiding this comment.
I also just noticed that there is not index here too. This could be helpful for the Django visualization too.
Plus, the already existing Enrichment API would be affected incredibily positively :) If you don't have time, I'll try to add this later myself
Description
Several changes to the IOC model are introduced:
days_seennow has the list function as a default value (for convenience)times_seenand add interaction countTo populate these new fields, the attack data extraction process had to be rewritten. I did not touch the extraction process of log4pot yet, as I don't have one running. However, this should definitely be done at some point. I'll open an issue after this is merged.
I also added a model for CowrieSessions to eventually create a specialised feed for Cowrie.
Related issues
Type of change
Please delete options that are not relevant.
Checklist
develop.Black,Flake,Isort) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.Important Rules