Operations · Intermediate
Monitoring and analyzing SSH honeypot logs
Track unauthorized login attempts, inspect shell commands, and summarize threat patterns
- On a scheduleInspect honeypot event logs
- ThenExtract sessions and shell commands
- ResultSave structured threat intelligence
Collect session logs from an SSH honeypot to observe unauthorized access attempts in real time. Group incoming traffic by remote IP address, decode executed shell commands and downloaded scripts, and flag automated brute-force attacks and interactive intrusion patterns for security review.
Prompt to start with
BotBentoRecommended
Parse new JSON events from the honeypot log stream using terminal commands. Extract client IP addresses, submitted credentials, and shell commands run during each interactive session. Save normalized session data into the database. When suspicious payload URLs or novel intrusion patterns appear, compile a triage brief and request approval before posting alert notifications to chat.