HoneyLabs App

HoneyLabs runs open-source honeypot sensors on the public internet. Every connection they receive is unsolicited, so every observation is a scan, a probe, a brute-force attempt or an exploit. This app puts that telemetry in reach of your searches. A search command annotates any event that carries an IPv4 address: index=firewall | honeylabs field=src_ip | where honeylabs_events > 0 | table _time src_ip honeylabs_verdict honeylabs_events honeylabs_asn_org It writes back verdict, verdict_key, network_type, events, first_seen, last_seen, country, asn, asn_org, rdns, top_port, ports, exploit_hits and reference. Every field is prefixed honeylabs_, and you can change that prefix with prefix=. Two modular inputs, shipped disabled, index active exploiter addresses and captured malware staging URLs on a schedule. They need no credentials. An overview dashboard summarises what the feeds are carrying, and includes a search that matches your own traffic against them without calling the API at all. What leaves your deployment is stated exactly. The search command sends the values of the one field you name, de-duplicated, over HTTPS. Nothing else goes with them: not the raw event, not any other field, not your index, host, source or sourcetype names, not your Splunk version, not the search string. Private, loopback, link-local, multicast and reserved addresses are filtered out locally before the request is built, so a search over an index full of RFC1918 traffic sends only the public addresses in it. The feed inputs are ordinary HTTPS downloads of a public file and disclose nothing about you. An account is optional. The command works anonymously at a lower daily cap, and a free API key raises it. The key is stored through Splunk's storage/passwords, encrypted at rest, and never written to a .conf file. If you run Enterprise Security, use its own threat intelligence framework for the indicator lists, so they reach correlation searches and risk scoring rather than only being searchable, and keep this command for on-demand enrichment. Walkthrough: https://honeylabs.net/integrations/splunk-es