From 4c259c3cad36d24639f5b67fe359cc358fec7ae4 Mon Sep 17 00:00:00 2001 From: "sekoia-io-cross-repo-comm-app[bot]" <99295792+sekoia-io-cross-repo-comm-app[bot]@users.noreply.github.com> Date: Thu, 21 May 2026 16:20:22 +0000 Subject: [PATCH] Refresh intakes documentation --- .../1a1502f5-5a93-44b4-b0b5-359bbcb14902.md | 693 ++++++++++++++++++ ...02f5-5a93-44b4-b0b5-359bbcb14902_sample.md | 338 +++++++++ 2 files changed, 1031 insertions(+) create mode 100644 _shared_content/operations_center/integrations/generated/1a1502f5-5a93-44b4-b0b5-359bbcb14902.md create mode 100644 _shared_content/operations_center/integrations/generated/1a1502f5-5a93-44b4-b0b5-359bbcb14902_sample.md diff --git a/_shared_content/operations_center/integrations/generated/1a1502f5-5a93-44b4-b0b5-359bbcb14902.md b/_shared_content/operations_center/integrations/generated/1a1502f5-5a93-44b4-b0b5-359bbcb14902.md new file mode 100644 index 0000000000..05581b04a2 --- /dev/null +++ b/_shared_content/operations_center/integrations/generated/1a1502f5-5a93-44b4-b0b5-359bbcb14902.md @@ -0,0 +1,693 @@ + +### Event Categories + + +The following table lists the data source offered by this integration. + +| Data Source | Description | +| ----------- | ------------------------------------ | +| `Authentication logs` | MokN captures login attempts observed on bait services | + + + + + +In details, the following table denotes the type of events produced by this integration. + +| Name | Values | +| ---- | ------ | +| Kind | `alert` | +| Category | `authentication`, `intrusion_detection` | +| Type | `info` | + + + + +### Transformed Events Samples after Ingestion + +This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the [built-in detection rules](/xdr/features/detect/rules_catalog.md) and hunting activities in the [events page](/xdr/features/investigate/events.md). Understanding these transformations is essential for analysts to create effective detection mechanisms with [custom detection rules](/xdr/features/detect/sigma.md) and to leverage the full potential of the collected data. + +=== "mokn_bait_high_severity.json" + + ```json + + { + "message": "{\"event_type\":\"mokn_bait_attempt\",\"id\":4,\"date\":\"2026-04-17T14:20:00+00:00\",\"updated_time\":\"2026-04-17T14:20:00+00:00\",\"bait_name\":\"SSH Honeypot\",\"username\":\"root@example.com\",\"password\":\"toor\",\"is_targeted\":true,\"comment\":\"\",\"type\":\"Targeted\",\"identification\":\"SSH\",\"status\":9,\"threat_level\":\"HIGH\",\"attack\":{\"ip\":\"192.0.2.20\",\"country\":\"Russia\",\"country_code\":\"RU\",\"ja4h\":\"ja4h-ssh-1\",\"user_agent\":\"GenericBrowser/1.0\",\"headers\":[[\"Host\",\"example.com\"],[\"Referer\",\"https://example.com/ssh\"]],\"opportunistic_patterns\":[{\"name\":\"brute_force\",\"threat_level_setting\":\"HIGH\"}],\"reputation\":\"Malicious\",\"total_attempts\":200,\"total_targeted_attempts\":200},\"leaks\":[{\"site\":\"darkweb_dump.txt\",\"date\":\"2025-03-01T00:00:00+00:00\"}]}", + "event": { + "action": "bait login attempt", + "category": [ + "authentication", + "intrusion_detection" + ], + "dataset": "mokn.bait_attempt", + "kind": "alert", + "module": "mokn", + "reason": "Targeted", + "severity": 8, + "type": [ + "info" + ] + }, + "@timestamp": "2026-04-17T14:20:00Z", + "http": { + "request": { + "referrer": "https://example.com/ssh" + } + }, + "mokn": { + "attacker_reputation": "Malicious", + "attacker_total_attempts": 200, + "attacker_total_targeted_attempts": 200, + "first_leak_date": "2025-03-01T00:00:00+00:00", + "first_leak_site": "darkweb_dump.txt", + "id": 4, + "identification": "SSH", + "is_targeted": true, + "ja4h": "ja4h-ssh-1", + "leaks": [ + { + "date": "2025-03-01T00:00:00+00:00", + "site": "darkweb_dump.txt" + } + ], + "opportunistic_pattern_names": "brute_force", + "opportunistic_patterns": [ + { + "name": "brute_force", + "threat_level_setting": "HIGH" + } + ], + "status": 9, + "threat_level": "HIGH" + }, + "observer": { + "product": "Baits", + "type": "honeypot", + "vendor": "MokN" + }, + "related": { + "hosts": [ + "example.com" + ], + "ip": [ + "192.0.2.20" + ], + "user": [ + "root" + ] + }, + "rule": { + "name": "SSH Honeypot" + }, + "source": { + "address": "192.0.2.20", + "geo": { + "country_iso_code": "RU", + "country_name": "Russia" + }, + "ip": "192.0.2.20" + }, + "url": { + "domain": "example.com", + "registered_domain": "example.com", + "top_level_domain": "com" + }, + "user": { + "email": "root@example.com", + "name": "root" + }, + "user_agent": { + "device": { + "name": "Generic Feature Phone" + }, + "name": "Other", + "original": "GenericBrowser/1.0", + "os": { + "name": "Other" + } + } + } + + ``` + + +=== "mokn_bait_login.json" + + ```json + + { + "message": "{\"event_type\":\"mokn_bait_attempt\",\"id\":1,\"date\":\"2026-04-14T12:45:54+00:00\",\"updated_time\":\"2026-04-14T12:45:54+00:00\",\"bait_name\":\"App Portal\",\"username\":\"User3@example.com\",\"password\":\"password-example-3\",\"is_targeted\":true,\"comment\":\"\",\"type\":\"Targeted\",\"identification\":\"App Connector\",\"status\":9,\"threat_level\":\"LOW\",\"attack\":{\"ip\":\"198.51.100.42\",\"country\":\"Germany\",\"country_code\":\"DE\",\"ja4h\":\"sample-ja4h\",\"user_agent\":\"GenericBrowser/1.0\",\"headers\":[[\"Host\",\"example.com\"],[\"Origin\",\"https://example.com\"],[\"Referer\",\"https://example.com/login\"],[\"X-Forwarded-For\",\"198.51.100.42\"]],\"opportunistic_patterns\":[{\"name\":\"has_leaked\",\"threat_level_setting\":\"HIGH\"}],\"reputation\":\"Malicious\",\"total_attempts\":12,\"total_targeted_attempts\":12},\"leaks\":[{\"site\":\"random_source_a.txt\",\"date\":\"2024-07-18T00:00:00+00:00\"},{\"site\":\"random_source_b.zip\",\"date\":\"2023-11-02T00:00:00+00:00\"}]}", + "event": { + "action": "bait login attempt", + "category": [ + "authentication", + "intrusion_detection" + ], + "dataset": "mokn.bait_attempt", + "kind": "alert", + "module": "mokn", + "reason": "Targeted", + "severity": 3, + "type": [ + "info" + ] + }, + "@timestamp": "2026-04-14T12:45:54Z", + "http": { + "request": { + "referrer": "https://example.com/login" + } + }, + "mokn": { + "attacker_reputation": "Malicious", + "attacker_total_attempts": 12, + "attacker_total_targeted_attempts": 12, + "first_leak_date": "2023-11-02T00:00:00+00:00", + "first_leak_site": "random_source_b.zip", + "id": 1, + "identification": "App Connector", + "is_targeted": true, + "ja4h": "sample-ja4h", + "leaks": [ + { + "date": "2024-07-18T00:00:00+00:00", + "site": "random_source_a.txt" + }, + { + "date": "2023-11-02T00:00:00+00:00", + "site": "random_source_b.zip" + } + ], + "opportunistic_pattern_names": "has_leaked", + "opportunistic_patterns": [ + { + "name": "has_leaked", + "threat_level_setting": "HIGH" + } + ], + "status": 9, + "threat_level": "LOW" + }, + "observer": { + "product": "Baits", + "type": "honeypot", + "vendor": "MokN" + }, + "related": { + "hosts": [ + "example.com" + ], + "ip": [ + "198.51.100.42" + ], + "user": [ + "User3" + ] + }, + "rule": { + "name": "App Portal" + }, + "source": { + "address": "198.51.100.42", + "geo": { + "country_iso_code": "DE", + "country_name": "Germany" + }, + "ip": "198.51.100.42" + }, + "url": { + "domain": "example.com", + "registered_domain": "example.com", + "top_level_domain": "com" + }, + "user": { + "email": "User3@example.com", + "name": "User3" + }, + "user_agent": { + "device": { + "name": "Generic Feature Phone" + }, + "name": "Other", + "original": "GenericBrowser/1.0", + "os": { + "name": "Other" + } + } + } + + ``` + + +=== "mokn_bait_medium_severity.json" + + ```json + + { + "message": "{\"event_type\":\"mokn_bait_attempt\",\"id\":5,\"date\":\"2026-04-18T11:15:00+00:00\",\"updated_time\":\"2026-04-18T11:15:00+00:00\",\"bait_name\":\"VPN Portal\",\"username\":\"user1@example.com\",\"password\":\"VpnPass123\",\"is_targeted\":true,\"comment\":\"\",\"type\":\"Targeted\",\"identification\":\"VPN\",\"status\":7,\"threat_level\":\"MEDIUM\",\"attack\":{\"ip\":\"192.0.2.30\",\"country\":\"China\",\"country_code\":\"CN\",\"ja4h\":\"ja4h-vpn-1\",\"user_agent\":\"GenericBrowser/1.0\",\"headers\":[[\"Host\",\"example.com\"],[\"Referer\",\"https://example.com/vpn\"]],\"opportunistic_patterns\":[{\"name\":\"credential_stuffing\",\"threat_level_setting\":\"MEDIUM\"}],\"reputation\":\"Suspicious\",\"total_attempts\":30,\"total_targeted_attempts\":30},\"leaks\":[{\"site\":\"combo_list.txt\",\"date\":\"2024-06-15T00:00:00+00:00\"}]}", + "event": { + "action": "bait login attempt", + "category": [ + "authentication", + "intrusion_detection" + ], + "dataset": "mokn.bait_attempt", + "kind": "alert", + "module": "mokn", + "reason": "Targeted", + "severity": 5, + "type": [ + "info" + ] + }, + "@timestamp": "2026-04-18T11:15:00Z", + "http": { + "request": { + "referrer": "https://example.com/vpn" + } + }, + "mokn": { + "attacker_reputation": "Suspicious", + "attacker_total_attempts": 30, + "attacker_total_targeted_attempts": 30, + "first_leak_date": "2024-06-15T00:00:00+00:00", + "first_leak_site": "combo_list.txt", + "id": 5, + "identification": "VPN", + "is_targeted": true, + "ja4h": "ja4h-vpn-1", + "leaks": [ + { + "date": "2024-06-15T00:00:00+00:00", + "site": "combo_list.txt" + } + ], + "opportunistic_pattern_names": "credential_stuffing", + "opportunistic_patterns": [ + { + "name": "credential_stuffing", + "threat_level_setting": "MEDIUM" + } + ], + "status": 7, + "threat_level": "MEDIUM" + }, + "observer": { + "product": "Baits", + "type": "honeypot", + "vendor": "MokN" + }, + "related": { + "hosts": [ + "example.com" + ], + "ip": [ + "192.0.2.30" + ], + "user": [ + "user1" + ] + }, + "rule": { + "name": "VPN Portal" + }, + "source": { + "address": "192.0.2.30", + "geo": { + "country_iso_code": "CN", + "country_name": "China" + }, + "ip": "192.0.2.30" + }, + "url": { + "domain": "example.com", + "registered_domain": "example.com", + "top_level_domain": "com" + }, + "user": { + "email": "user1@example.com", + "name": "user1" + }, + "user_agent": { + "device": { + "name": "Generic Feature Phone" + }, + "name": "Other", + "original": "GenericBrowser/1.0", + "os": { + "name": "Other" + } + } + } + + ``` + + +=== "mokn_bait_no_leaks.json" + + ```json + + { + "message": "{\"event_type\":\"mokn_bait_attempt\",\"id\":2,\"date\":\"2026-04-15T10:00:00+00:00\",\"updated_time\":\"2026-04-15T10:00:00+00:00\",\"bait_name\":\"DB Admin\",\"username\":\"admin@example.com\",\"password\":\"Summer2024!\",\"is_targeted\":true,\"comment\":\"\",\"type\":\"Targeted\",\"identification\":\"Database\",\"status\":5,\"threat_level\":\"LOW\",\"attack\":{\"ip\":\"192.0.2.10\",\"country\":\"France\",\"country_code\":\"FR\",\"ja4h\":\"ja4h-db-1\",\"user_agent\":\"GenericBrowser/1.0\",\"headers\":[[\"Host\",\"example.com\"],[\"Referer\",\"https://example.com/admin\"]],\"opportunistic_patterns\":[{\"name\":\"sql_injection\",\"threat_level_setting\":\"MEDIUM\"}],\"reputation\":\"Suspicious\",\"total_attempts\":3,\"total_targeted_attempts\":3},\"leaks\":[]}", + "event": { + "action": "bait login attempt", + "category": [ + "authentication", + "intrusion_detection" + ], + "dataset": "mokn.bait_attempt", + "kind": "alert", + "module": "mokn", + "reason": "Targeted", + "severity": 3, + "type": [ + "info" + ] + }, + "@timestamp": "2026-04-15T10:00:00Z", + "http": { + "request": { + "referrer": "https://example.com/admin" + } + }, + "mokn": { + "attacker_reputation": "Suspicious", + "attacker_total_attempts": 3, + "attacker_total_targeted_attempts": 3, + "id": 2, + "identification": "Database", + "is_targeted": true, + "ja4h": "ja4h-db-1", + "leaks": [], + "opportunistic_pattern_names": "sql_injection", + "opportunistic_patterns": [ + { + "name": "sql_injection", + "threat_level_setting": "MEDIUM" + } + ], + "status": 5, + "threat_level": "LOW" + }, + "observer": { + "product": "Baits", + "type": "honeypot", + "vendor": "MokN" + }, + "related": { + "hosts": [ + "example.com" + ], + "ip": [ + "192.0.2.10" + ], + "user": [ + "admin" + ] + }, + "rule": { + "name": "DB Admin" + }, + "source": { + "address": "192.0.2.10", + "geo": { + "country_iso_code": "FR", + "country_name": "France" + }, + "ip": "192.0.2.10" + }, + "url": { + "domain": "example.com", + "registered_domain": "example.com", + "top_level_domain": "com" + }, + "user": { + "email": "admin@example.com", + "name": "admin" + }, + "user_agent": { + "device": { + "name": "Generic Feature Phone" + }, + "name": "Other", + "original": "GenericBrowser/1.0", + "os": { + "name": "Other" + } + } + } + + ``` + + +=== "mokn_bait_opportunistic.json" + + ```json + + { + "message": "{\"event_type\":\"mokn_bait_attempt\",\"id\":3,\"date\":\"2026-04-16T08:30:00+00:00\",\"updated_time\":\"2026-04-16T08:30:00+00:00\",\"bait_name\":\"File Share\",\"username\":\"user1@example.com\",\"password\":\"guest\",\"is_targeted\":false,\"comment\":\"\",\"type\":\"Opportunistic\",\"identification\":\"NAS\",\"status\":2,\"threat_level\":\"LOW\",\"attack\":{\"ip\":\"203.0.113.5\",\"country\":\"Netherlands\",\"country_code\":\"NL\",\"ja4h\":\"ja4h-nas-1\",\"user_agent\":\"GenericBrowser/1.0\",\"headers\":[[\"Host\",\"example.com\"],[\"Referer\",\"https://example.com/files\"]],\"opportunistic_patterns\":[{\"name\":\"default_creds\",\"threat_level_setting\":\"LOW\"}],\"reputation\":\"Unknown\",\"total_attempts\":50,\"total_targeted_attempts\":0},\"leaks\":[{\"site\":\"breach_db.txt\",\"date\":\"2025-01-10T00:00:00+00:00\"}]}", + "event": { + "action": "bait login attempt", + "category": [ + "authentication", + "intrusion_detection" + ], + "dataset": "mokn.bait_attempt", + "kind": "alert", + "module": "mokn", + "reason": "Opportunistic", + "severity": 3, + "type": [ + "info" + ] + }, + "@timestamp": "2026-04-16T08:30:00Z", + "http": { + "request": { + "referrer": "https://example.com/files" + } + }, + "mokn": { + "attacker_reputation": "Unknown", + "attacker_total_attempts": 50, + "attacker_total_targeted_attempts": 0, + "first_leak_date": "2025-01-10T00:00:00+00:00", + "first_leak_site": "breach_db.txt", + "id": 3, + "identification": "NAS", + "is_targeted": false, + "ja4h": "ja4h-nas-1", + "leaks": [ + { + "date": "2025-01-10T00:00:00+00:00", + "site": "breach_db.txt" + } + ], + "opportunistic_pattern_names": "default_creds", + "opportunistic_patterns": [ + { + "name": "default_creds", + "threat_level_setting": "LOW" + } + ], + "status": 2, + "threat_level": "LOW" + }, + "observer": { + "product": "Baits", + "type": "honeypot", + "vendor": "MokN" + }, + "related": { + "hosts": [ + "example.com" + ], + "ip": [ + "203.0.113.5" + ], + "user": [ + "user1" + ] + }, + "rule": { + "name": "File Share" + }, + "source": { + "address": "203.0.113.5", + "geo": { + "country_iso_code": "NL", + "country_name": "Netherlands" + }, + "ip": "203.0.113.5" + }, + "url": { + "domain": "example.com", + "registered_domain": "example.com", + "top_level_domain": "com" + }, + "user": { + "email": "user1@example.com", + "name": "user1" + }, + "user_agent": { + "device": { + "name": "Generic Feature Phone" + }, + "name": "Other", + "original": "GenericBrowser/1.0", + "os": { + "name": "Other" + } + } + } + + ``` + + +=== "mokn_bait_plain_username.json" + + ```json + + { + "message": "{\"event_type\":\"mokn_bait_attempt\",\"id\":6,\"date\":\"2026-04-19T16:45:00+00:00\",\"updated_time\":\"2026-04-19T16:45:00+00:00\",\"bait_name\":\"Internal Tool\",\"username\":\"user1\",\"password\":\"admin123\",\"is_targeted\":false,\"comment\":\"\",\"type\":\"Opportunistic\",\"identification\":\"Intranet\",\"status\":1,\"threat_level\":\"LOW\",\"attack\":{\"ip\":\"203.0.113.15\",\"country\":\"United States\",\"country_code\":\"US\",\"ja4h\":\"ja4h-int-1\",\"user_agent\":\"GenericBrowser/1.0\",\"headers\":[[\"Host\",\"example.com\"],[\"Referer\",\"https://example.com/tool\"]],\"opportunistic_patterns\":[{\"name\":\"default_creds\",\"threat_level_setting\":\"LOW\"}],\"reputation\":\"Unknown\",\"total_attempts\":5,\"total_targeted_attempts\":0},\"leaks\":[]}", + "event": { + "action": "bait login attempt", + "category": [ + "authentication", + "intrusion_detection" + ], + "dataset": "mokn.bait_attempt", + "kind": "alert", + "module": "mokn", + "reason": "Opportunistic", + "severity": 3, + "type": [ + "info" + ] + }, + "@timestamp": "2026-04-19T16:45:00Z", + "http": { + "request": { + "referrer": "https://example.com/tool" + } + }, + "mokn": { + "attacker_reputation": "Unknown", + "attacker_total_attempts": 5, + "attacker_total_targeted_attempts": 0, + "id": 6, + "identification": "Intranet", + "is_targeted": false, + "ja4h": "ja4h-int-1", + "leaks": [], + "opportunistic_pattern_names": "default_creds", + "opportunistic_patterns": [ + { + "name": "default_creds", + "threat_level_setting": "LOW" + } + ], + "status": 1, + "threat_level": "LOW" + }, + "observer": { + "product": "Baits", + "type": "honeypot", + "vendor": "MokN" + }, + "related": { + "hosts": [ + "example.com" + ], + "ip": [ + "203.0.113.15" + ], + "user": [ + "user1" + ] + }, + "rule": { + "name": "Internal Tool" + }, + "source": { + "address": "203.0.113.15", + "geo": { + "country_iso_code": "US", + "country_name": "United States" + }, + "ip": "203.0.113.15" + }, + "url": { + "domain": "example.com", + "registered_domain": "example.com", + "top_level_domain": "com" + }, + "user": { + "name": "user1" + }, + "user_agent": { + "device": { + "name": "Generic Feature Phone" + }, + "name": "Other", + "original": "GenericBrowser/1.0", + "os": { + "name": "Other" + } + } + } + + ``` + + + + + +### Extracted Fields + +The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed. + +| Name | Type | Description | +| ---- | ---- | ---------------------------| +|`@timestamp` | `date` | Date/time when the event originated. | +|`event.action` | `keyword` | The action captured by the event. | +|`event.category` | `keyword` | Event category. The second categorization field in the hierarchy. | +|`event.dataset` | `keyword` | Name of the dataset. | +|`event.kind` | `keyword` | The kind of the event. The highest categorization field in the hierarchy. | +|`event.module` | `keyword` | Name of the module this data is coming from. | +|`event.reason` | `keyword` | Reason why this event happened, according to the source | +|`event.severity` | `long` | Numeric severity of the event. | +|`event.type` | `keyword` | Event type. The third categorization field in the hierarchy. | +|`http.request.referrer` | `keyword` | Referrer for this HTTP request. | +|`mokn.attacker_reputation` | `keyword` | Reputation associated with the attacker | +|`mokn.attacker_total_attempts` | `long` | Total number of attempts attributed to the attacker | +|`mokn.attacker_total_targeted_attempts` | `long` | Total number of targeted attempts attributed to the attacker | +|`mokn.first_leak_date` | `date` | Date when the credential was first seen leaked | +|`mokn.first_leak_site` | `keyword` | Site name where the credential was first seen leaked | +|`mokn.id` | `long` | MokN attempt identifier | +|`mokn.identification` | `keyword` | MokN identification associated with the bait login attempt | +|`mokn.is_targeted` | `boolean` | Whether MokN classified the bait login attempt as targeted | +|`mokn.ja4h` | `keyword` | JA4H fingerprint observed for the bait login attempt | +|`mokn.leaks` | `object` | Leak records associated with the bait login attempt | +|`mokn.opportunistic_pattern_names` | `keyword` | Human-readable list of opportunistic pattern names detected by MokN | +|`mokn.opportunistic_patterns` | `object` | Opportunistic patterns detected by MokN for the attacker | +|`mokn.status` | `long` | MokN status code for the bait login attempt | +|`mokn.threat_level` | `keyword` | MokN threat level associated with the bait login attempt | +|`observer.product` | `keyword` | The product name of the observer. | +|`observer.type` | `keyword` | The type of the observer the data is coming from. | +|`observer.vendor` | `keyword` | Vendor name of the observer. | +|`related.ip` | `ip` | All of the IPs seen on your event. | +|`related.user` | `keyword` | All the user names or other user identifiers seen on the event. | +|`rule.name` | `keyword` | Rule name | +|`source.address` | `keyword` | Source network address. | +|`source.geo.country_iso_code` | `keyword` | Country ISO code. | +|`source.geo.country_name` | `keyword` | Country name. | +|`source.ip` | `ip` | IP address of the source. | +|`url.domain` | `keyword` | Domain of the url. | +|`user.email` | `keyword` | User email address. | +|`user.name` | `keyword` | Short name or login of the user. | +|`user_agent.original` | `keyword` | Unparsed user_agent string. | + + + +For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events [here](https://github.com/SEKOIA-IO/intake-formats/tree/main/MokN/mokn-baits). \ No newline at end of file diff --git a/_shared_content/operations_center/integrations/generated/1a1502f5-5a93-44b4-b0b5-359bbcb14902_sample.md b/_shared_content/operations_center/integrations/generated/1a1502f5-5a93-44b4-b0b5-359bbcb14902_sample.md new file mode 100644 index 0000000000..aadeba48ec --- /dev/null +++ b/_shared_content/operations_center/integrations/generated/1a1502f5-5a93-44b4-b0b5-359bbcb14902_sample.md @@ -0,0 +1,338 @@ + +### Raw Events Samples + +In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured. + + +=== "mokn_bait_high_severity" + + + ```json + { + "event_type": "mokn_bait_attempt", + "id": 4, + "date": "2026-04-17T14:20:00+00:00", + "updated_time": "2026-04-17T14:20:00+00:00", + "bait_name": "SSH Honeypot", + "username": "root@example.com", + "password": "toor", + "is_targeted": true, + "comment": "", + "type": "Targeted", + "identification": "SSH", + "status": 9, + "threat_level": "HIGH", + "attack": { + "ip": "192.0.2.20", + "country": "Russia", + "country_code": "RU", + "ja4h": "ja4h-ssh-1", + "user_agent": "GenericBrowser/1.0", + "headers": [ + [ + "Host", + "example.com" + ], + [ + "Referer", + "https://example.com/ssh" + ] + ], + "opportunistic_patterns": [ + { + "name": "brute_force", + "threat_level_setting": "HIGH" + } + ], + "reputation": "Malicious", + "total_attempts": 200, + "total_targeted_attempts": 200 + }, + "leaks": [ + { + "site": "darkweb_dump.txt", + "date": "2025-03-01T00:00:00+00:00" + } + ] + } + ``` + + + +=== "mokn_bait_login" + + + ```json + { + "event_type": "mokn_bait_attempt", + "id": 1, + "date": "2026-04-14T12:45:54+00:00", + "updated_time": "2026-04-14T12:45:54+00:00", + "bait_name": "App Portal", + "username": "User3@example.com", + "password": "password-example-3", + "is_targeted": true, + "comment": "", + "type": "Targeted", + "identification": "App Connector", + "status": 9, + "threat_level": "LOW", + "attack": { + "ip": "198.51.100.42", + "country": "Germany", + "country_code": "DE", + "ja4h": "sample-ja4h", + "user_agent": "GenericBrowser/1.0", + "headers": [ + [ + "Host", + "example.com" + ], + [ + "Origin", + "https://example.com" + ], + [ + "Referer", + "https://example.com/login" + ], + [ + "X-Forwarded-For", + "198.51.100.42" + ] + ], + "opportunistic_patterns": [ + { + "name": "has_leaked", + "threat_level_setting": "HIGH" + } + ], + "reputation": "Malicious", + "total_attempts": 12, + "total_targeted_attempts": 12 + }, + "leaks": [ + { + "site": "random_source_a.txt", + "date": "2024-07-18T00:00:00+00:00" + }, + { + "site": "random_source_b.zip", + "date": "2023-11-02T00:00:00+00:00" + } + ] + } + ``` + + + +=== "mokn_bait_medium_severity" + + + ```json + { + "event_type": "mokn_bait_attempt", + "id": 5, + "date": "2026-04-18T11:15:00+00:00", + "updated_time": "2026-04-18T11:15:00+00:00", + "bait_name": "VPN Portal", + "username": "user1@example.com", + "password": "VpnPass123", + "is_targeted": true, + "comment": "", + "type": "Targeted", + "identification": "VPN", + "status": 7, + "threat_level": "MEDIUM", + "attack": { + "ip": "192.0.2.30", + "country": "China", + "country_code": "CN", + "ja4h": "ja4h-vpn-1", + "user_agent": "GenericBrowser/1.0", + "headers": [ + [ + "Host", + "example.com" + ], + [ + "Referer", + "https://example.com/vpn" + ] + ], + "opportunistic_patterns": [ + { + "name": "credential_stuffing", + "threat_level_setting": "MEDIUM" + } + ], + "reputation": "Suspicious", + "total_attempts": 30, + "total_targeted_attempts": 30 + }, + "leaks": [ + { + "site": "combo_list.txt", + "date": "2024-06-15T00:00:00+00:00" + } + ] + } + ``` + + + +=== "mokn_bait_no_leaks" + + + ```json + { + "event_type": "mokn_bait_attempt", + "id": 2, + "date": "2026-04-15T10:00:00+00:00", + "updated_time": "2026-04-15T10:00:00+00:00", + "bait_name": "DB Admin", + "username": "admin@example.com", + "password": "Summer2024!", + "is_targeted": true, + "comment": "", + "type": "Targeted", + "identification": "Database", + "status": 5, + "threat_level": "LOW", + "attack": { + "ip": "192.0.2.10", + "country": "France", + "country_code": "FR", + "ja4h": "ja4h-db-1", + "user_agent": "GenericBrowser/1.0", + "headers": [ + [ + "Host", + "example.com" + ], + [ + "Referer", + "https://example.com/admin" + ] + ], + "opportunistic_patterns": [ + { + "name": "sql_injection", + "threat_level_setting": "MEDIUM" + } + ], + "reputation": "Suspicious", + "total_attempts": 3, + "total_targeted_attempts": 3 + }, + "leaks": [] + } + ``` + + + +=== "mokn_bait_opportunistic" + + + ```json + { + "event_type": "mokn_bait_attempt", + "id": 3, + "date": "2026-04-16T08:30:00+00:00", + "updated_time": "2026-04-16T08:30:00+00:00", + "bait_name": "File Share", + "username": "user1@example.com", + "password": "guest", + "is_targeted": false, + "comment": "", + "type": "Opportunistic", + "identification": "NAS", + "status": 2, + "threat_level": "LOW", + "attack": { + "ip": "203.0.113.5", + "country": "Netherlands", + "country_code": "NL", + "ja4h": "ja4h-nas-1", + "user_agent": "GenericBrowser/1.0", + "headers": [ + [ + "Host", + "example.com" + ], + [ + "Referer", + "https://example.com/files" + ] + ], + "opportunistic_patterns": [ + { + "name": "default_creds", + "threat_level_setting": "LOW" + } + ], + "reputation": "Unknown", + "total_attempts": 50, + "total_targeted_attempts": 0 + }, + "leaks": [ + { + "site": "breach_db.txt", + "date": "2025-01-10T00:00:00+00:00" + } + ] + } + ``` + + + +=== "mokn_bait_plain_username" + + + ```json + { + "event_type": "mokn_bait_attempt", + "id": 6, + "date": "2026-04-19T16:45:00+00:00", + "updated_time": "2026-04-19T16:45:00+00:00", + "bait_name": "Internal Tool", + "username": "user1", + "password": "admin123", + "is_targeted": false, + "comment": "", + "type": "Opportunistic", + "identification": "Intranet", + "status": 1, + "threat_level": "LOW", + "attack": { + "ip": "203.0.113.15", + "country": "United States", + "country_code": "US", + "ja4h": "ja4h-int-1", + "user_agent": "GenericBrowser/1.0", + "headers": [ + [ + "Host", + "example.com" + ], + [ + "Referer", + "https://example.com/tool" + ] + ], + "opportunistic_patterns": [ + { + "name": "default_creds", + "threat_level_setting": "LOW" + } + ], + "reputation": "Unknown", + "total_attempts": 5, + "total_targeted_attempts": 0 + }, + "leaks": [] + } + ``` + + +