Integrating T-POT Cowrie JSON Logs with AbuseIPDB

Introduction In today’s digital landscape, security is more crucial than ever. Honeypots like Cowrie provide valuable insights into malicious activities by capturing and analyzing attacks on your network. Integrating Cowrie’s JSON logs with AbuseIPDB, a powerful IP reputation service, can significantly enhance your security posture. This article will walk you through the advantages of this integration and provide a step-by-step guide on how to set it up.

Advantages of Integrating Cowrie with AbuseIPDB

1. Enhanced Threat Detection
   • Real-time Insights: Integrating Cowrie with AbuseIPDB allows you to automatically report malicious IP addresses detected by your honeypot. This ensures that your threat intelligence is up-to-date and actionable.
   • Improved Accuracy: By leveraging AbuseIPDB’s extensive database, you gain access to a wider range of IP reputation data, improving the accuracy of threat identification.
2. Automated Incident Response
   • Streamlined Reporting: Automating the reporting of suspicious IPs saves time and reduces the risk of human error. This ensures that potential threats are reported swiftly and efficiently.
   • Centralized Management: Consolidate threat data in one place. AbuseIPDB’s platform provides a centralized view of reported IPs, making it easier to manage and analyze threats.
3. Enhanced Visibility and Protection
   • Up-to-date Threat Intelligence: Regularly reporting IPs helps keep AbuseIPDB’s database current. This contributes to the overall effectiveness of the IP blacklist, benefiting the wider security community.
   • Strengthened Defenses: By proactively reporting and managing threats, you can better protect your network from future attacks and improve overall security posture.

How to Integrate Cowrie JSON Logs with AbuseIPDB

1. Prepare Your Environment

Obtain an AbuseIPDB API Key: Sign up for an AbuseIPDB account and obtain your API key from the AbuseIPDB website.

Ensure Cowrie is Installed: Verify that Cowrie is properly set up and running on your server.

2. Create the Reporting Script

• Script Overview: The script will extract IP addresses from Cowrie’s JSON logs and report them to AbuseIPDB.
• Script Code:

#!/bin/bash

# Configuration
API_KEY="YOUR_ABUSEIPDB_API_KEY"  # Replace with your AbuseIPDB API key
LOG_FILE="/home/user1/tpotce/data/cowrie/log/cowrie.json"  # default path for cowrie in latest T-POT (Kindly adjust user1 with actual)  
REPORTED_IPS_LOG="/var/log/reported_ips.log"  # Log file to keep track of reported IPs  (File needs to be created)
CATEGORIES="18,22"  # Set the appropriate AbuseIPDB categories
COMMENT="Malicious activity detected by T-POT honeypot. Reported by [Your Name]."

# AbuseIPDB API URL
API_URL="https://api.abuseipdb.com/api/v2/report"

# Check if the reported IPs log exists, create it if not
if [ ! -f "$REPORTED_IPS_LOG" ]; then
    touch "$REPORTED_IPS_LOG"
fi

# Extract IPs from the JSON logs using jq
extract_ips() {
    jq -r '.src_ip' "$LOG_FILE" | sort | uniq
}

# Report IP to AbuseIPDB
report_ip() {
    local ip="$1"
    
    # Check if the IP has already been reported
    if grep -q "$ip" "$REPORTED_IPS_LOG"; then
        echo "IP $ip has already been reported."
        return
    fi

    # Report to AbuseIPDB using POST method
    response=$(curl -s -X POST --data-urlencode "ip=$ip" \
                                --data-urlencode "categories=$CATEGORIES" \
                                --data-urlencode "comment=$COMMENT" \
                                -H "Key: $API_KEY" \
                                -H "Accept: application/json" \
                                "$API_URL")

    # Print the response for debugging
    echo "Response from AbuseIPDB: $response"

    # Check if the report was successful
    if echo "$response" | grep -q '"success":true'; then
        echo "IP $ip reported successfully."
        echo "$ip" >> "$REPORTED_IPS_LOG"  # Log the IP to avoid duplicate reports
    else
        echo "Failed to report IP $ip."
    fi
}

# Main function to extract and report IPs
main() {
    offending_ips=$(extract_ips)
    
    for ip in $offending_ips; do
        report_ip "$ip"
    done
}

# Run the main function
main

3. Set Up Automation

• Schedule the Script: Use cron to schedule the script to run at regular intervals. Add a cron job with:

crontab -e 

• Add the following line to run the script every hour:

0 * * * * /path/to/report_to_abuseipdb.sh

4. Monitor and Maintain

• Check Logs: Regularly review your logs to ensure the script is running correctly and reporting IPs as expected.
• Update and Adapt: Make adjustments to the script as needed based on changes in your logging format or AbuseIPDB API updates.

Conclusion Integrating Cowrie JSON logs with AbuseIPDB is a powerful way to enhance your network security by automating the reporting of malicious IPs. By following the steps outlined above, you can improve threat detection, streamline incident response, and contribute to a safer digital environment.

Feel free to share this article with your community or use it as a reference for your security practices. For any questions or feedback, please leave a comment below!

Credit and Acknowledgements:

This article demonstrates the integration of Cowrie JSON logs with AbuseIPDB. Special thanks to the T-POT developer team for their outstanding work on the T-POT honeypot framework, which provides valuable security insights.

We also extend our gratitude to AbuseIPDB for their invaluable service in providing IP reputation data. Their platform plays a crucial role in helping cybersecurity professionals manage and respond to threats effectively.

Our heartfelt thanks go out to all open-source developers who have contributed to the development and design of honeypots. Your innovation and dedication in creating these tools are instrumental in advancing network security and protecting digital environments.

Additionally, we recognize and appreciate all the developers and contributors in the open-source community. Your expertise and commitment are vital in advancing cybersecurity and technology. Without your contributions, many of the tools and solutions we rely on today would not be possible.

For more information about T-POT and its contributors, visit the T-POT website. To learn more about AbuseIPDB and its services, visit their website. To explore the open-source community, check out resources like Open Source Initiative.