1{ 2 "attributes": { 3 "compCS": { 4 "description": "SSH compression algorithm supported in the session", 5 "disable_correlation": true, 6 "misp-attribute": "text", 7 "multiple": true, 8 "ui-priority": 1 9 }, 10 "dst_ip": { 11 "description": "Destination IP address of the session", 12 "disable_correlation": true, 13 "misp-attribute": "ip-dst", 14 "ui-priority": 1 15 }, 16 "dst_port": { 17 "description": "Destination port of the session", 18 "disable_correlation": true, 19 "misp-attribute": "port", 20 "ui-priority": 1 21 }, 22 "encCS": { 23 "description": "SSH symmetric encryption algorithm supported in the session", 24 "disable_correlation": true, 25 "misp-attribute": "text", 26 "multiple": true, 27 "ui-priority": 1 28 }, 29 "eventid": { 30 "description": "Eventid of the session in the cowrie honeypot", 31 "disable_correlation": true, 32 "misp-attribute": "text", 33 "ui-priority": 1 34 }, 35 "hassh": { 36 "description": "HASSH of the client SSH session following Salesforce algorithm", 37 "misp-attribute": "hassh-md5", 38 "ui-priority": 1 39 }, 40 "input": { 41 "description": "Input of the session", 42 "misp-attribute": "text", 43 "ui-priority": 1 44 }, 45 "isError": { 46 "description": "isError", 47 "disable_correlation": true, 48 "misp-attribute": "text", 49 "ui-priority": 1 50 }, 51 "keyAlgs": { 52 "description": "SSH public-key algorithm supported in the session", 53 "disable_correlation": true, 54 "misp-attribute": "text", 55 "multiple": true, 56 "ui-priority": 1 57 }, 58 "macCS": { 59 "description": "SSH MAC supported in the sesssion", 60 "disable_correlation": true, 61 "misp-attribute": "text", 62 "multiple": true, 63 "ui-priority": 1 64 }, 65 "message": { 66 "description": "Message of the cowrie honeypot", 67 "disable_correlation": true, 68 "misp-attribute": "text", 69 "ui-priority": 1 70 }, 71 "password": { 72 "description": "Password", 73 "misp-attribute": "text", 74 "multiple": true, 75 "ui-priority": 1 76 }, 77 "protocol": { 78 "description": "Protocol used in the cowrie honeypot", 79 "disable_correlation": true, 80 "misp-attribute": "text", 81 "ui-priority": 1 82 }, 83 "sensor": { 84 "description": "Cowrie sensor name", 85 "disable_correlation": true, 86 "misp-attribute": "text", 87 "ui-priority": 1 88 }, 89 "session": { 90 "description": "Session id", 91 "misp-attribute": "text", 92 "ui-priority": 1 93 }, 94 "src_ip": { 95 "description": "Source IP address of the session", 96 "misp-attribute": "ip-src", 97 "ui-priority": 1 98 }, 99 "src_port": { 100 "description": "Source port of the session", 101 "disable_correlation": true, 102 "misp-attribute": "port", 103 "ui-priority": 1 104 }, 105 "system": { 106 "description": "System origin in cowrie honeypot", 107 "disable_correlation": true, 108 "misp-attribute": "text", 109 "ui-priority": 1 110 }, 111 "timestamp": { 112 "description": "When the event happened", 113 "disable_correlation": true, 114 "misp-attribute": "datetime", 115 "ui-priority": 1 116 }, 117 "username": { 118 "description": "Username related to the password(s)", 119 "misp-attribute": "text", 120 "ui-priority": 1 121 } 122 }, 123 "description": "Cowrie honeypot object template", 124 "meta-category": "network", 125 "name": "cowrie", 126 "requiredOneOf": [ 127 "session" 128 ], 129 "uuid": "ae085d32-6534-4d52-b3eb-063fccb753e7", 130 "version": 3 131}