Cowrie honeypot - Reporting to abusedbIP

[orlofv]

Hello everyone,

As the title suggest I am having trouble with the abuseIPdb API integration in tpot.
I have a standalone cowrie ssh honeypot that is successfully auto-reporting offending IPs, so I know the API-cowrie configuration is correct, however I can't make it work with tpot. I have added the configuration inside the container's cowrie.cfg and edited the config file located at /root/tpotce/docker/cowrie/dist/cowrie.cfg.
Has anyone managed to do it?
Thank you.

[sefinek]

I've developed an integration between T-Pot and AbuseIPDB. It currently supports Cowrie, Dionaea, and Honeytrap. Support for more honeypots is coming soon.

https://github.com/sefinek/T-Pot-To-AbuseIPDB
I hope someone finds it useful!

[t3chn0m4g3]

Awesome! Thanks for sharing!