DeathsPirate

### Keybase proof

I hereby claim:

  * I am DeathsPirate on github.
  * I am deathspirate (https://keybase.io/deathspirate) on keybase.
  * I have a public key whose fingerprint is BC39 34A0 DF78 5A3C EBA7  4147 C6A2 41E9 D5FB 9C24

To claim this, I am signing this object:

DeathsPirate

{
    "args": "http://157.52.151.215/s443ls",
    "user": "root",
    "datetime": "2019-03-01 12:29:29:276538",
    "type": "spyusers",
    "processInfo": 7960,
    "containerName": "honeypot-157.52.151.215",
    "containerId": "e6a625ff7a00",
    "srcaddr": "157.52.151.215",
    "baseCommand": "wget",

DeathsPirate

{
    "args": "http://157.52.151.215/s443ls",
    "user": "root",
    "datetime": "2019-03-01 12:29:29:276538",
    "type": "spyusers",
    "processInfo": 7960,
    "containerName": "honeypot-157.52.151.215",
    "containerId": "e6a625ff7a00",
    "command": "wget"
}

DeathsPirate

name: furnace-honey
platform:
    aws: {defaultBatchSize: 10}
state:
    repo: 'https://github.com/{YourGitAccount}/{YourStackStateRepo}'
environments:
    - dev
    - staging
    - prod

DeathsPirate

- name: honeylogs
  type: KinesisStream
  initialize: false
  aws:
    shardCount: 1

DeathsPirate

- name: honeylogs-tap
  module: honeytap
  source: honeylogs
  aws:
    shardCount: 1

DeathsPirate

async def processEvent(event):
    # Do event processing here ...
    return event

DeathsPirate

- name: enrichment
  modules:
    - name: lookup-geo
    - name: honeyenrich

DeathsPirate

- tap: honeylogs-tap
  pipeline: enrichment

- pipeline: enrichment
  sink: es-sink

DeathsPirate

- name: es-sink
  type: AwsFirehose
  resource: es
  aws:
    destination: elasticsearch
    elasticsearchConfiguration:
        indexName: hpevents
        typeName: hpevent