1{
2  "attributes": {
3    "compCS": {
4      "description": "SSH compression algorithm supported in the session",
5      "disable_correlation": true,
6      "misp-attribute": "text",
7      "multiple": true,
8      "ui-priority": 1
9    },
10    "dst_ip": {
11      "description": "Destination IP address of the session",
12      "disable_correlation": true,
13      "misp-attribute": "ip-dst",
14      "ui-priority": 1
15    },
16    "dst_port": {
17      "description": "Destination port of the session",
18      "disable_correlation": true,
19      "misp-attribute": "port",
20      "ui-priority": 1
21    },
22    "encCS": {
23      "description": "SSH symmetric encryption algorithm supported in the session",
24      "disable_correlation": true,
25      "misp-attribute": "text",
26      "multiple": true,
27      "ui-priority": 1
28    },
29    "eventid": {
30      "description": "Eventid of the session in the cowrie honeypot",
31      "disable_correlation": true,
32      "misp-attribute": "text",
33      "ui-priority": 1
34    },
35    "hassh": {
36      "description": "HASSH of the client SSH session following Salesforce algorithm",
37      "misp-attribute": "hassh-md5",
38      "ui-priority": 1
39    },
40    "input": {
41      "description": "Input of the session",
42      "misp-attribute": "text",
43      "ui-priority": 1
44    },
45    "isError": {
46      "description": "isError",
47      "disable_correlation": true,
48      "misp-attribute": "text",
49      "ui-priority": 1
50    },
51    "keyAlgs": {
52      "description": "SSH public-key algorithm supported in the session",
53      "disable_correlation": true,
54      "misp-attribute": "text",
55      "multiple": true,
56      "ui-priority": 1
57    },
58    "macCS": {
59      "description": "SSH MAC supported in the sesssion",
60      "disable_correlation": true,
61      "misp-attribute": "text",
62      "multiple": true,
63      "ui-priority": 1
64    },
65    "message": {
66      "description": "Message of the cowrie honeypot",
67      "disable_correlation": true,
68      "misp-attribute": "text",
69      "ui-priority": 1
70    },
71    "password": {
72      "description": "Password",
73      "misp-attribute": "text",
74      "multiple": true,
75      "ui-priority": 1
76    },
77    "protocol": {
78      "description": "Protocol used in the cowrie honeypot",
79      "disable_correlation": true,
80      "misp-attribute": "text",
81      "ui-priority": 1
82    },
83    "sensor": {
84      "description": "Cowrie sensor name",
85      "disable_correlation": true,
86      "misp-attribute": "text",
87      "ui-priority": 1
88    },
89    "session": {
90      "description": "Session id",
91      "misp-attribute": "text",
92      "ui-priority": 1
93    },
94    "src_ip": {
95      "description": "Source IP address of the session",
96      "misp-attribute": "ip-src",
97      "ui-priority": 1
98    },
99    "src_port": {
100      "description": "Source port of the session",
101      "disable_correlation": true,
102      "misp-attribute": "port",
103      "ui-priority": 1
104    },
105    "system": {
106      "description": "System origin in cowrie honeypot",
107      "disable_correlation": true,
108      "misp-attribute": "text",
109      "ui-priority": 1
110    },
111    "timestamp": {
112      "description": "When the event happened",
113      "disable_correlation": true,
114      "misp-attribute": "datetime",
115      "ui-priority": 1
116    },
117    "username": {
118      "description": "Username related to the password(s)",
119      "misp-attribute": "text",
120      "ui-priority": 1
121    }
122  },
123  "description": "Cowrie honeypot object template",
124  "meta-category": "network",
125  "name": "cowrie",
126  "requiredOneOf": [
127    "session"
128  ],
129  "uuid": "ae085d32-6534-4d52-b3eb-063fccb753e7",
130  "version": 3
131}