SENTINEL 🛡️

Multi-source honeypot aggregator. Unifies Cowrie SSH honeypot, HTTP honeypot, and canary token events into a single API — ready to feed dashboards, SIEM, or alerting pipelines.

Components

Component	Port	Description
canary_server.py	8181	HTTP canary token server — any hit on /canary/<token> triggers an alert
http_honeypot.py	8180	Fake HTTP service — logs all requests with full headers and body
sentinel_aggregator.py	8282	Unified API — aggregates Cowrie + HTTP + canary events

Quick Start

bash start.sh

Or individually:

python3 canary_server.py &
python3 http_honeypot.py &
python3 sentinel_aggregator.py

API

GET  /api/sentinel              — all recent events (Cowrie + HTTP + canary)
GET  /api/sentinel/cowrie       — Cowrie SSH events only
GET  /api/sentinel/http         — HTTP honeypot events only
GET  /api/sentinel/canary       — canary token hits only
GET  /api/sentinel/stats        — event counts by source and type
GET  /health

Canary Tokens

Deploy canary tokens anywhere — documents, config files, URLs — and get alerted the moment they're accessed:

# Place this URL in a sensitive file
curl http://your-server:8181/canary/my-secret-doc-2024
# → Triggers immediate alert with requester IP, time, user-agent

Cowrie Integration

SENTINEL reads Cowrie's NDJSON log file directly. Point it at your Cowrie instance:

COWRIE_LOG = "/home/cowrie/var/log/cowrie/cowrie.json"

Dashboard Integration

The aggregator exposes a clean JSON API that feeds directly into lab-dashboard, Grafana, or any SIEM.

License

MIT