HoneyLabs Intelligence

HoneyLabs runs open-source honeypot sensors on the public internet. Nothing reaches them by accident, so every connection they record is a scan, a probe, a brute-force attempt or an exploit. There are no false positives to filter out, because there is no legitimate traffic to confuse them with. This app puts that dataset inside Splunk. Two search commands. The first enriches addresses you already have. Point it at any field holding a public IPv4 address and it annotates every event: index=firewall | honeylabs field=src_ip | where honeylabs_events > 0 It writes back verdict, verdict_key, network_type, events, first_seen, last_seen, country, asn, asn_org, rdns, top_port, ports, exploit_hits and reference, each prefixed honeylabs_ so nothing collides with your own fields. Addresses are de-duplicated per search, so an index carrying the same scanner across ten thousand events costs one lookup. The second queries the honeypot dataset directly, with no local data required. Nine modes cover raw events, captured request payloads, top attackers, timelines, ASN profiles, TLS and HTTP fingerprints, IOC and CIDR lookups, CVE exploitation, and fingerprint population counts. Use it to answer questions your own logs cannot: who else is exercising this CVE, what payload is being sent, which other sources share this JA4 fingerprint. Two modular inputs, shipped disabled, index active exploiter addresses and captured malware staging URLs on an hourly schedule. Neither needs credentials. Two dashboards ship with the app: an overview of what the feeds currently carry, and an explorer for querying the dataset without writing SPL by hand. About the API key. The app installs and runs with no account and no setup, but anonymous use is capped at 10 lookups a day, which is enough to try the commands and not enough to work with. A free key raises that to 500 a day and takes about a minute to create at https://honeylabs.net/dashboard. Paste it into the app's setup page; it is stored through Splunk's storage/passwords, encrypted at rest, and never written to a .conf file. Paid plans go to 50,000 a day. On privacy: a lookup sends only the public IP addresses in your search. Not your index, host, source or sourcetype names, not your Splunk version, not the search string. Private, loopback, link-local, multicast and reserved addresses are filtered out locally before the request is built. The feed inputs are ordinary HTTPS downloads of a public file and disclose nothing at all. Running Enterprise Security? Load the indicator feeds through its own threat intelligence framework so they reach correlation searches and risk scoring rather than only being searchable, and keep these commands for on-demand investigation. Walkthrough: https://honeylabs.net/integrations/splunk-es