Elastic
Start free trial Contact Sales
Loading

OpenCanary

<div class="condensed-table">
| | |
| --- | --- |
| Version | 0.3.0 [beta] (View all) |
| Compatible Kibana version(s) | 8.13.0 or higher |
| Supported Serverless project types
What’s this? | Security
Observability |
| Subscription level
What’s this? | Basic |
| Level of support
What’s this? | Community |

</div>
This integration is for Thinkst OpenCanary honeypot event logs. The package processes messages from OpenCanary honeypot logs.

The OpenCanary integration collects the following event types:

  • events

Elastic Agent must be installed. For more details and installation instructions, please refer to the Elastic Agent Installation Guide.

There are several options for installing and managing Elastic Agent:

With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier.

With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only.

You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes.

Please note, there are minimum requirements for running Elastic Agent. For more information, refer to the Elastic Agent Minimum Requirements.

  1. In Kibana navigate to Management > Integrations.
  2. In "Search for integrations" top bar, search for OpenCanary.
  3. Select the "OpenCanary" integration from the search results.
  4. Select "Add OpenCanary" to add the integration.
  5. Add all the required integration configuration parameters.
  6. Select "Save and continue" to save the integration.

The events dataset collects the OpenCanary logs.

**Example**

An example event for events looks as following:

{
    "@timestamp": "2024-04-05T14:37:26.457Z",
    "destination": {
        "address": "10.10.10.10",
        "domain": "OpenCanary1",
        "ip": "10.10.10.10",
        "port": 445
    },
    "event": {
        "action": "flistxattr",
        "category": [
            "network",
            "intrusion_detection"
        ],
        "created": "2024-04-05T14:37:26.457Z",
        "kind": [
            "alert"
        ],
        "original": "{\"dst_host\": \"10.10.10.10\", \"dst_port\": 445, \"local_time\": \"2024-04-05 14:37:26.457226\", \"local_time_adjusted\": \"2024-04-05 07:37:26.457252\", \"logdata\": {\"AUDITACTION\": \"flistxattr\", \"DOMAIN\": \"CONTOSO\", \"FILENAME\": \"/shares/database\", \"LOCALNAME\": \"OpenCanary1\", \"REMOTENAME\": \"Client1\", \"SHARENAME\": \"database\", \"SMBARCH\": \"OSX\", \"SMBVER\": \"SMB3_11\", \"STATUS\": \"ok\", \"USER\": \"jdoe\"}, \"logtype\": 5000, \"node_id\": \"opencanary-1\", \"src_host\": \"192.168.0.10\", \"src_port\": \"-1\", \"utc_time\": \"2024-04-05 14:37:26.457249\"}",
        "provider": "LOG_SMB_FILE_OPEN",
        "start": "2024-04-05T14:37:26.457Z",
        "type": [
            "connection"
        ]
    },
    "log": {
        "logger": "LOG_SMB_FILE_OPEN"
    },
    "network": {
        "direction": "internal"
    },
    "opencanary": {
        "node": {
            "id": "opencanary-1"
        },
        "smb": {
            "filename": "/shares/database",
            "share_name": "database",
            "smb_arch": "OSX",
            "smb_version": "SMB3_11",
            "status": "ok"
        }
    },
    "related": {
        "hosts": [
            "OpenCanary1",
            "Client1"
        ],
        "ip": [
            "10.10.10.10",
            "192.168.0.10"
        ],
        "user": [
            "jdoe"
        ]
    },
    "source": {
        "address": "192.168.0.10",
        "domain": "Client1",
        "ip": "192.168.0.10",
        "port": -1
    },
    "tags": [
        "preserve_original_event",
        "redact_passwords"
    ],
    "user": {
        "domain": "CONTOSO",
        "name": "jdoe"
    }
}
**Exported fields**
Field Description Type
@timestamp Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. date
cloud.image.id Image ID for the cloud instance. keyword
data_stream.dataset Data stream dataset. constant_keyword
data_stream.namespace Data stream namespace. constant_keyword
data_stream.type Data stream type. constant_keyword
event.dataset Event dataset constant_keyword
event.module Event module constant_keyword
host.containerized If the host is a container. boolean
host.os.build OS build information. keyword
host.os.codename OS codename, if any. keyword
input.type Input type. keyword
log.offset Offset of the entry in the log file. long
opencanary.logdata.cwr keyword
opencanary.logdata.df keyword
opencanary.logdata.ece keyword
opencanary.logdata.id long
opencanary.logdata.len keyword
opencanary.logdata.prec keyword
opencanary.logdata.res keyword
opencanary.logdata.session keyword
opencanary.logdata.syn keyword
opencanary.logdata.tos keyword
opencanary.logdata.ttl long
opencanary.logdata.urgp long
opencanary.logdata.window long
opencanary.mssql.client.app keyword
opencanary.mssql.client.hostname keyword
opencanary.mssql.client.interface_library keyword
opencanary.mssql.database keyword
opencanary.node.id Identifier for the OpenCanary node as configured in /etc/opencanaryd/opencanary.conf keyword
opencanary.redis.args keyword
opencanary.redis.command keyword
opencanary.skin Skin configured for the OpenCanary service. keyword
opencanary.smb.audit_action keyword
opencanary.smb.filename keyword
opencanary.smb.share_name keyword
opencanary.smb.smb_arch keyword
opencanary.smb.smb_version keyword
opencanary.smb.status keyword
opencanary.ssh.local_version keyword
opencanary.ssh.remote_version keyword
opencanary.tcp_banner.banner_id keyword
opencanary.tcp_banner.data keyword
opencanary.tcp_banner.function keyword
opencanary.tcp_banner.secret_string keyword
**Changelog**
Version Details Kibana version(s)
0.3.0 pass:[] Enhancement (View pull request)
Do not remove event.original in main ingest pipeline.
 —
0.2.0 pass:[] Enhancement (View pull request)
Add "preserve_original_event" tag to documents with event.kind set to "pipeline_error".
 —
0.1.3 pass:[] Bug fix (View pull request)
Use triple-brace Mustache templating when referencing variables in ingest pipelines.
 —
0.1.2 pass:[] Enhancement (View pull request)
Update documentation.
 —
0.1.1 pass:[] Bug fix (View pull request)
Fixes and issue where all source and destination details were removed if the source or destination port was an invalid "-1".
 —
0.1.0 pass:[] Enhancement (View pull request)
Update the kibana constraint to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template.
 —
0.0.1 pass:[] Enhancement (View pull request)
Initial draft of the package
 —