HoneyLabs Integration
| Version | 0.1.0
|
| Subscription level What's this? |
Basic |
| Developed by What's this? |
Community |
| Ingestion method(s) | API |
| Minimum Kibana version(s) | 9.1.0 8.19.0 |
The HoneyLabs integration v0.1.0 is in technical preview
To use pre-release integrations, go to the Integrations page in Kibana, scroll down, and toggle on the Display beta integrations option.
The HoneyLabs integration ingests threat intelligence indicators from HoneyLabs into Elasticsearch. HoneyLabs runs internet-facing honeypot sensors and publishes the addresses and URLs it has evidence of malicious intent for. Indicators ingested with this integration can be explored in Intelligence > Indicators in Kibana and matched against your own events with indicator match rules.
This integration reads the HoneyLabs public feeds at https://honeylabs.net/feed/ and the HoneyLabs TAXII 2.1 server at https://honeylabs.net/taxii2/api/. The feed format is documented at https://honeylabs.net/feed/about.
Elastic Agent polls HoneyLabs with the CEL input. Without an API key it reads the anonymous JSON feeds, which need no account. Each feed holds every indicator of its window (7 days for exploiters, 14 days for malware infrastructure), so each poll collects the whole feed. With an API key it reads the TAXII 2.1 collections instead and asks only for indicators added since the previous poll.
An ingest pipeline maps each indicator to the ECS threat.indicator.* fields. A transform per data stream keeps the latest copy of each indicator in a destination index and removes it once it expires.
The integration collects two data streams:
exploiter: source IP addresses observed running an exploit or loader command against HoneyLabs sensors, including addresses that logged in to a sensor and ran commands in a shell. Known research scanners are excluded. Each indicator carries the first and last sighting, the number of events, the autonomous system, the country, whether the address is a Tor exit, and the MITRE ATT&CK techniques its shell sessions showed.malware_infrastructure: loader and command-and-control URLs taken from captured exploit payloads and from the downloads named inside shell sessions. Each indicator carries the URL, its host, the first and last sighting and the number of sightings.
Both data streams set threat.indicator.reference to the HoneyLabs lookup page of the address, which lists the evidence behind the indicator.
When an API key is set, indicators also carry a confidence from 0 to 100 (honeylabs.*.confidence, mapped to threat.indicator.confidence), a description, STIX labels, the malware family where one is known and, for URLs, whether the URL is a Mozi peer download served by an infected device.
- Match inbound connections in firewall, proxy, web server and authentication logs against addresses that are exploiting systems on the internet now.
- Match outbound requests in proxy and DNS logs against URLs that serve malware to compromised hosts.
- Look up the evidence for an indicator on its HoneyLabs lookup page during an investigation.
- Elastic Stack: Elasticsearch for storing data and Kibana for viewing it. You can use Elastic Cloud or self-manage the Elastic Stack.
- Elastic Agent with outbound HTTPS access to
honeylabs.net. - Optionally, a HoneyLabs API key. Keys are free and are created at https://honeylabs.net/dashboard. A paid HoneyLabs plan extends the TAXII collections from 7 or 14 days to 30 days.
For step-by-step instructions on how to set up an integration, see the Getting started guide.
- In Kibana, go to Management > Integrations and search for HoneyLabs.
- Click Add HoneyLabs.
- Leave API Key empty to read the anonymous feeds, or enter a HoneyLabs API key to read the TAXII 2.1 collections.
- Adjust the polling interval and the IOC expiration duration of each data stream if needed.
- Save the integration and add it to an agent policy.
The settings are:
- API Key: optional HoneyLabs API key. When set, the TAXII 2.1 collections are read instead of the anonymous feeds.
- Interval: time between polls,
1hby default. HoneyLabs rebuilds the feeds every few minutes, so an interval below15madds requests without adding data. - IOC Expiration Duration: how long after its last sighting an indicator stays in the latest index. The defaults (
7dfor exploiters,14dfor malware infrastructure) match the windows of the feeds.
Advanced settings hold the HoneyLabs URL, the feed path and TAXII collection ID of each data stream, the TAXII page size, the TAXII overlap (how far before the newest indicator of the previous poll the next poll starts, 1h by default, so a sighting recorded late is still collected), proxy and SSL options, and the request tracer.
- Check that the Elastic Agent reports a healthy status in Fleet.
- Within one polling interval, documents appear in
logs-ti_honeylabs.exploiter-*andlogs-ti_honeylabs.malware_infrastructure-*in Discover. - Within a few minutes after that, the transforms fill
logs-ti_honeylabs_latest.exploiterandlogs-ti_honeylabs_latest.malware_infrastructure.
- A
401error on the TAXII path means the API key is missing, invalid or revoked. Remove the key to fall back to the anonymous feeds, or create a new key. - A
403error means the configured TAXII collection needs a paid HoneyLabs plan. The default collections do not. - Documents with
event.kind: pipeline_errorcarry the cause inerror.message. Enable Preserve original event to keep the raw indicator inevent.original.
An indicator expires ioc_expiration_duration after its last sighting. The pipeline writes that time to honeylabs.exploiter.deleted_at or honeylabs.malware_infrastructure.deleted_at, and the transform removes the indicator from the destination index once it has passed. An indicator that HoneyLabs sees again gets a new last sighting on the next poll and stays.
- Source indices (
logs-ti_honeylabs.exploiter-*,logs-ti_honeylabs.malware_infrastructure-*) hold every collected copy. See Data retention for how long. - Destination indices (
logs-ti_honeylabs_latest.dest_exploiter-*,logs-ti_honeylabs_latest.dest_malware_infrastructure-*) hold one current copy of each indicator. They are aliased aslogs-ti_honeylabs_latest.exploiterandlogs-ti_honeylabs_latest.malware_infrastructure. Point indicator match rules at these aliases.
Indicators are collected again on every poll, and the latest transform keeps the deduplicated view in its destination index. The source data streams therefore hold repeated copies of the same indicators. The package bounds their growth with a retention that depends on the deployment type:
| Data stream | Self-managed and Elastic Cloud Hosted (ILM policy) | Serverless (data stream lifecycle) |
|---|---|---|
logs-ti_honeylabs.exploiter-* |
logs-ti_honeylabs.exploiter-default_policy: roll over after 1d, delete 7d after rollover |
delete 7d after rollover |
logs-ti_honeylabs.malware_infrastructure-* |
logs-ti_honeylabs.malware_infrastructure-default_policy: roll over after 1d, delete 7d after rollover |
delete 7d after rollover |
To keep data for a different period:
- Self-managed and Elastic Cloud Hosted: edit the ILM policy in Kibana under Stack Management > Index Lifecycle Policies, or with
PUT _ilm/policy/<policy name>. A package upgrade reinstalls the package's ILM policies, so check your change after upgrading. - Serverless: set the retention on the data stream, for example
PUT _data_stream/logs-ti_honeylabs.exploiter-default/_lifecyclewith the body{"data_retention": "30d"}. Replacedefaultwith your namespace.
The transform destination indices are not affected by either.
To view only HoneyLabs indicators in the Intelligence page, filter with:
threat.feed.name: "HoneyLabs Exploiters" or threat.feed.name: "HoneyLabs Malware Infrastructure"
The HoneyLabs feeds are free to use for security research, asset inventory and defensive monitoring, including inside a commercial organisation's own defences. Redistribution as part of a product or a paid service needs a licence from HoneyLabs. See https://honeylabs.net/feed/about.
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Event timestamp. | date |
| data_stream.dataset | Data stream dataset name. | constant_keyword |
| data_stream.namespace | Data stream namespace. | constant_keyword |
| data_stream.type | Data stream type. | constant_keyword |
| event.dataset | Event dataset. | constant_keyword |
| event.module | Event module. | constant_keyword |
| honeylabs.exploiter.akin | HTTP request (Akin) fingerprints of the address that are shared by a scanning tool population. | keyword |
| honeylabs.exploiter.confidence | Confidence from 0 to 100 that HoneyLabs assigns from the number of observed events. Present when the indicator was read from TAXII. | long |
| honeylabs.exploiter.deleted_at | Time at which the indicator expires from the latest index. | date |
| honeylabs.exploiter.id | STIX identifier of the indicator. Present when the indicator was read from TAXII. | keyword |
| honeylabs.exploiter.interactive_sessions | Number of the address's events that were interactive sessions, in which it logged in to a sensor and ran commands or named a download. | long |
| honeylabs.exploiter.ioc_expiration_duration | The configured expiration duration. | keyword |
| honeylabs.exploiter.ja4 | TLS client (JA4) fingerprints of the address that are shared by a scanning tool population. | keyword |
| honeylabs.exploiter.labels | STIX labels of the indicator. Present when the indicator was read from TAXII. | keyword |
| honeylabs.exploiter.malware_family | Malware family of the payloads the address tried to load, where one is known. | keyword |
| honeylabs.exploiter.tor_exit | Whether the address was a Tor exit node when the feed was built. | boolean |
| honeylabs.exploiter.valid_until | End of the STIX validity period of the indicator. Present when the indicator was read from TAXII. | date |
| input.type | Type of Filebeat input. | keyword |
| labels.is_ioc_transform_source | Indicates whether an IOC is in the raw source data stream, or the in latest destination index. | constant_keyword |
| threat.feed.name | Display friendly feed name. | constant_keyword |
Example
{
"@timestamp": "2026-10-30T13:34:51.048Z",
"agent": {
"ephemeral_id": "0f7369f0-2593-4da6-974b-38e16027f548",
"id": "e8667f29-f815-4135-88e0-63b7cc233503",
"name": "elastic-agent-63458",
"type": "filebeat",
"version": "9.5.5"
},
"data_stream": {
"dataset": "ti_honeylabs.exploiter",
"namespace": "22094",
"type": "logs"
},
"ecs": {
"version": "9.5.0"
},
"elastic_agent": {
"id": "e8667f29-f815-4135-88e0-63b7cc233503",
"snapshot": false,
"version": "9.5.5"
},
"event": {
"agent_id_status": "verified",
"category": [
"threat"
],
"dataset": "ti_honeylabs.exploiter",
"ingested": "2026-10-30T13:34:55Z",
"kind": "enrichment",
"module": "ti_honeylabs",
"original": "{\"confidence\":90,\"created\":\"2026-10-22T20:38:45.000Z\",\"description\":\"Ran exploit or loader commands against HoneyLabs honeypot sensors from AS206264 (DE): 327 events between 2026-10-22T20:38:45.000Z and 2026-10-29T19:59:29.000Z. 327 of them were interactive sessions in which it logged in and ran commands or named a download. Its interactive sessions showed MITRE ATT\\u0026CK T1190 Exploit Public-Facing Application, T1105 Ingress Tool Transfer.\",\"external_references\":[{\"source_name\":\"HoneyLabs\",\"url\":\"https://honeylabs.net/lookup/89.160.20.112\"},{\"external_id\":\"T1190\",\"source_name\":\"mitre-attack\",\"url\":\"https://attack.mitre.org/techniques/T1190/\"},{\"external_id\":\"T1105\",\"source_name\":\"mitre-attack\",\"url\":\"https://attack.mitre.org/techniques/T1105/\"}],\"id\":\"indicator--8f77131c-ddce-5b4b-8e49-49763da60072\",\"indicator_types\":[\"malicious-activity\"],\"kill_chain_phases\":[{\"kill_chain_name\":\"lockheed-martin-cyber-kill-chain\",\"phase_name\":\"exploitation\"},{\"kill_chain_name\":\"mitre-attack\",\"phase_name\":\"initial-access\"},{\"kill_chain_name\":\"mitre-attack\",\"phase_name\":\"command-and-control\"}],\"labels\":[\"honeylabs\",\"exploitation\",\"interactive-session\",\"asn:AS206264\",\"country:DE\",\"mitre-attack:T1190\",\"mitre-attack:T1105\"],\"modified\":\"2026-10-29T19:59:29.000Z\",\"name\":\"Exploitation source: 89.160.20.112\",\"pattern\":\"[ipv4-addr:value = '89.160.20.112']\",\"pattern_type\":\"stix\",\"spec_version\":\"2.1\",\"type\":\"indicator\",\"valid_from\":\"2026-10-22T20:38:45.000Z\",\"valid_until\":\"2026-11-05T19:59:29.000Z\"}",
"type": [
"indicator"
]
},
"honeylabs": {
"exploiter": {
"confidence": 90,
"deleted_at": "2026-11-05T19:59:29.000Z",
"id": "indicator--8f77131c-ddce-5b4b-8e49-49763da60072",
"ioc_expiration_duration": "7d",
"labels": [
"honeylabs",
"exploitation",
"interactive-session",
"asn:AS206264",
"country:DE",
"mitre-attack:T1190",
"mitre-attack:T1105"
],
"tor_exit": false,
"valid_until": "2026-11-05T19:59:29.000Z"
}
},
"input": {
"type": "cel"
},
"labels": {
"is_ioc_transform_source": "true"
},
"tags": [
"preserve_original_event",
"forwarded",
"honeylabs-exploiter"
],
"threat": {
"feed": {
"name": "HoneyLabs Exploiters"
},
"framework": "MITRE ATT&CK",
"indicator": {
"as": {
"number": 206264
},
"confidence": "High",
"description": "Ran exploit or loader commands against HoneyLabs honeypot sensors from AS206264 (DE): 327 events between 2026-10-22T20:38:45.000Z and 2026-10-29T19:59:29.000Z. 327 of them were interactive sessions in which it logged in and ran commands or named a download. Its interactive sessions showed MITRE ATT&CK T1190 Exploit Public-Facing Application, T1105 Ingress Tool Transfer.",
"first_seen": "2026-10-22T20:38:45.000Z",
"geo": {
"country_iso_code": "DE"
},
"ip": "89.160.20.112",
"last_seen": "2026-10-29T19:59:29.000Z",
"marking": {
"tlp": "CLEAR"
},
"modified_at": "2026-10-29T19:59:29.000Z",
"name": "89.160.20.112",
"provider": "HoneyLabs",
"reference": "https://honeylabs.net/lookup/89.160.20.112",
"type": "ipv4-addr"
},
"technique": {
"id": [
"T1190",
"T1105"
],
"reference": [
"https://attack.mitre.org/techniques/T1190/",
"https://attack.mitre.org/techniques/T1105/"
]
}
}
}
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Event timestamp. | date |
| data_stream.dataset | Data stream dataset name. | constant_keyword |
| data_stream.namespace | Data stream namespace. | constant_keyword |
| data_stream.type | Data stream type. | constant_keyword |
| event.dataset | Event dataset. | constant_keyword |
| event.module | Event module. | constant_keyword |
| honeylabs.malware_infrastructure.confidence | Confidence from 0 to 100 that HoneyLabs assigns from the number of sightings. URLs served by Mozi peers are capped at 50. Present when the indicator was read from TAXII. | long |
| honeylabs.malware_infrastructure.deleted_at | Time at which the indicator expires from the latest index. | date |
| honeylabs.malware_infrastructure.id | STIX identifier of the indicator. Present when the indicator was read from TAXII. | keyword |
| honeylabs.malware_infrastructure.interactive_sessions | Number of interactive shell sessions that named the URL as a download. | long |
| honeylabs.malware_infrastructure.ioc_expiration_duration | The configured expiration duration. | keyword |
| honeylabs.malware_infrastructure.labels | STIX labels of the indicator. Present when the indicator was read from TAXII. | keyword |
| honeylabs.malware_infrastructure.malware_family | Malware family of the payload served at the URL, where one is known. | keyword |
| honeylabs.malware_infrastructure.mozi_peer | Whether the URL is a Mozi peer download served by an infected device rather than by attacker-run infrastructure. Present when the indicator was read from TAXII. | boolean |
| honeylabs.malware_infrastructure.valid_until | End of the STIX validity period of the indicator. Present when the indicator was read from TAXII. | date |
| input.type | Type of Filebeat input. | keyword |
| labels.is_ioc_transform_source | Indicates whether an IOC is in the raw source data stream, or the in latest destination index. | constant_keyword |
| threat.feed.name | Display friendly feed name. | constant_keyword |
Example
{
"@timestamp": "2026-10-30T13:36:22.313Z",
"agent": {
"ephemeral_id": "1bd46cde-c6b8-4c63-b3e4-c8e78dab55d0",
"id": "0c44e5db-950c-45e3-a033-194318249931",
"name": "elastic-agent-48114",
"type": "filebeat",
"version": "9.5.5"
},
"data_stream": {
"dataset": "ti_honeylabs.malware_infrastructure",
"namespace": "91090",
"type": "logs"
},
"ecs": {
"version": "9.5.0"
},
"elastic_agent": {
"id": "0c44e5db-950c-45e3-a033-194318249931",
"snapshot": false,
"version": "9.5.5"
},
"event": {
"agent_id_status": "verified",
"category": [
"threat"
],
"dataset": "ti_honeylabs.malware_infrastructure",
"ingested": "2026-10-30T13:36:26Z",
"kind": "enrichment",
"module": "ti_honeylabs",
"original": "{\"confidence\":50,\"created\":\"2026-10-29T17:08:35.000Z\",\"description\":\"Mozi botnet download served by an infected device on a random port. Mozi's operators shut it down in 2023; its remaining infected peers keep passing the payload on. Useful for spotting an infected device on your own network, not as attacker-run infrastructure. 1 sighting, last 2026-10-29T17:08:35.000Z.\",\"external_references\":[{\"source_name\":\"HoneyLabs\",\"url\":\"https://honeylabs.net/lookup/175.16.199.1\"}],\"id\":\"indicator--e146e905-27ec-5c73-869d-18da5d851214\",\"indicator_types\":[\"malicious-activity\"],\"kill_chain_phases\":[{\"kill_chain_name\":\"lockheed-martin-cyber-kill-chain\",\"phase_name\":\"installation\"}],\"labels\":[\"honeylabs\",\"malware-infrastructure\",\"loader-url\",\"interactive-session\",\"mozi-peer\",\"malware:mozi\"],\"modified\":\"2026-10-29T17:08:35.000Z\",\"name\":\"Mozi peer download: http://175.16.199.1:60373/Mozi.m\",\"pattern\":\"[url:value = 'http://175.16.199.1:60373/Mozi.m']\",\"pattern_type\":\"stix\",\"spec_version\":\"2.1\",\"type\":\"indicator\",\"valid_from\":\"2026-10-29T17:08:35.000Z\",\"valid_until\":\"2026-11-12T17:08:35.000Z\"}",
"type": [
"indicator"
]
},
"honeylabs": {
"malware_infrastructure": {
"confidence": 50,
"deleted_at": "2026-11-12T17:08:35.000Z",
"id": "indicator--e146e905-27ec-5c73-869d-18da5d851214",
"ioc_expiration_duration": "14d",
"labels": [
"honeylabs",
"malware-infrastructure",
"loader-url",
"interactive-session",
"mozi-peer",
"malware:mozi"
],
"malware_family": "mozi",
"mozi_peer": true,
"valid_until": "2026-11-12T17:08:35.000Z"
}
},
"input": {
"type": "cel"
},
"labels": {
"is_ioc_transform_source": "true"
},
"tags": [
"preserve_original_event",
"forwarded",
"honeylabs-malware-infrastructure"
],
"threat": {
"feed": {
"name": "HoneyLabs Malware Infrastructure"
},
"indicator": {
"confidence": "Medium",
"description": "Mozi botnet download served by an infected device on a random port. Mozi's operators shut it down in 2023; its remaining infected peers keep passing the payload on. Useful for spotting an infected device on your own network, not as attacker-run infrastructure. 1 sighting, last 2026-10-29T17:08:35.000Z.",
"first_seen": "2026-10-29T17:08:35.000Z",
"ip": "175.16.199.1",
"last_seen": "2026-10-29T17:08:35.000Z",
"marking": {
"tlp": "CLEAR"
},
"modified_at": "2026-10-29T17:08:35.000Z",
"name": "http://175.16.199.1:60373/Mozi.m",
"provider": "HoneyLabs",
"reference": "https://honeylabs.net/lookup/175.16.199.1",
"type": "url",
"url": {
"domain": "175.16.199.1",
"extension": "m",
"full": "http://175.16.199.1:60373/Mozi.m",
"original": "http://175.16.199.1:60373/Mozi.m",
"path": "/Mozi.m",
"port": 60373,
"scheme": "http"
}
}
}
}
Changelog
| Version | Details | Minimum Kibana version |
|---|---|---|
| 0.1.0 | Enhancement (View pull request) Initial release with the exploiter and malware infrastructure data streams. |
9.1.0 8.19.0 |