honeypot-investigation

Honeypot Investigation Agent - Instructions

Purpose

This agent performs comprehensive security analysis on honeypot servers to assess attack patterns, threat intelligence, vulnerabilities, and defensive effectiveness. Honeypots are decoy systems designed to attract attackers and provide early warning of emerging threats.

---

📑 TABLE OF CONTENTS

1. Critical Workflow Rules - Start here!
2. Investigation Parameters - Input requirements
3. Execution Workflow - Complete process with time tracking
4. KQL Query Library - Validated query patterns
5. Report Template - Executive markdown structure
6. Error Handling - Troubleshooting guide
7. Visualization Options - Heatmap and Geomap skills

---

⚠️ CRITICAL WORKFLOW RULES - READ FIRST ⚠️

Before starting ANY honeypot investigation:

1. ALWAYS calculate date ranges correctly (use current date from context)
2. ALWAYS track and report time after each major step (mandatory per main instructions)
3. ALWAYS run independent queries in parallel (drastically faster execution)
4. ALWAYS save intermediate results to temp/ (enables debugging and auditing)
5. ALWAYS use create_file for reports (NEVER use PowerShell terminal commands)

Date Range Rules (from main copilot-instructions):

• Real-time/recent searches: Add +2 days to current date for end range
• Example: Current date = Dec 12, 2025; Last 48 hours = datetime(2025-12-10) to datetime(2025-12-14)

---

Investigation Parameters

Required Inputs

Parameter	Description	Example
Honeypot Name	Server/device name	honeypot-server
Time Range	Investigation period	last 48 hours, last 7 days

Automatic Derivations

• Start Date: Current date - time range
• End Date: Current date + 2 days (per date range rules)
• Output File: reports/honeypot/Honeypot_Report_<hostname>_<timestamp>.md
• Temp Files: temp/honeypot_ips_<timestamp>.json, temp/honeypot_data_<timestamp>.json

---

Execution Workflow

🚨 MANDATORY: Time Tracking Pattern

YOU MUST TRACK AND REPORT TIME AFTER EVERY MAJOR STEP:

[MM:SS] ✓ Step description (XX seconds)

Required Reporting Points:

1. After Phase 1 (failed connection queries)
2. After Phase 2 (IP enrichment + threat intel)
3. After Phase 3 (incident filtering)
4. After Phase 4 (vulnerability scan)
5. After Phase 5 (report generation)
6. Final: Total elapsed time

---

Phase 1: Query Failed Connections (PARALLEL)

Execute ALL THREE queries in parallel using mcp_sentinel-data_query_lake:

Query 1A: SecurityEvent (Windows Security Logs)

let start = datetime(<StartDate>);
let end = datetime(<EndDate>);
let honeypot = '<HONEYPOT_NAME>';
SecurityEvent
| where TimeGenerated between (start .. end)
| where Computer contains honeypot  // Use 'contains' for flexible hostname matching
| where EventID in (4625, 4771, 4776)  // Failed logon attempts
| where isnotempty(IpAddress) and IpAddress != "-"  // IpAddress is built-in field
| where IpAddress != "127.0.0.1"  // Exclude localhost (internal honeypot traffic)
| summarize 
    FailedAttempts=count(), 
    FirstSeen=min(TimeGenerated), 
    LastSeen=max(TimeGenerated),
    TargetAccounts=make_set(Account, 10)
    by IpAddress, EventID
| extend EventType = case(
    EventID == 4625, "Failed Logon",
    EventID == 4771, "Kerberos Pre-Auth Failed",
    EventID == 4776, "NTLM Auth Failed",
    "Unknown")
| order by FailedAttempts desc
| take 50

Query 1B: W3CIISLog (IIS Web Server Logs)

let start = datetime(<StartDate>);
let end = datetime(<EndDate>);
let honeypot = '<HONEYPOT_NAME>';
W3CIISLog
| where TimeGenerated between (start .. end)
| where Computer =~ honeypot
| where tolong(scStatus) >= 400  // HTTP errors (4xx/5xx) - scStatus is string type
| where cIP != "127.0.0.1" and cIP != "::1"  // Exclude localhost (internal honeypot traffic)
| summarize 
    RequestCount=count(), 
    FirstSeen=min(TimeGenerated), 
    LastSeen=max(TimeGenerated),
    TargetedURIs=make_set(csUriStem, 10),
    StatusCodes=make_set(tolong(scStatus), 5)  // Convert to long for proper aggregation
    by IpAddress = cIP
| order by RequestCount desc
| take 50

Query 1C: DeviceNetworkEvents (Defender Network Traffic - INBOUND ONLY)

let start = datetime(<StartDate>);
let end = datetime(<EndDate>);
let honeypot = '<HONEYPOT_NAME>';
DeviceNetworkEvents
| where TimeGenerated between (start .. end)
| where DeviceName =~ honeypot
| where ActionType in ("ConnectionSuccess", "InboundConnectionAccepted", "ConnectionFound")  // Successful inbound TCP connections
| where LocalPort in (3389, 80, 443, 445, 22, 21, 23, 8080, 8443)  // Filter by attacked services (LocalPort = honeypot's listening port)
| where RemoteIP != "127.0.0.1" and RemoteIP != "::1" and RemoteIP != "::ffff:127.0.0.1"  // Exclude localhost
| where RemoteIP !startswith "192.168." and RemoteIP !startswith "10." and RemoteIP !startswith "172.16."  // Exclude RFC1918 private IPs
| where RemoteIP !startswith "fe80:" and RemoteIP !startswith "fc00:" and RemoteIP !startswith "fd00:"  // Exclude IPv6 link-local and ULA
| where RemoteIP !startswith "::ffff:"  // Filter out IPv6-mapped IPv4 addresses (reduces duplicate noise)
| summarize 
    ConnectionCount=count(), 
    FirstSeen=min(TimeGenerated), 
    LastSeen=max(TimeGenerated),
    TargetedPorts=make_set(LocalPort, 10),  // LocalPort = attacked services on honeypot
    Actions=make_set(ActionType, 5)
    by RemoteIP  // RemoteIP = attacker source
| order by ConnectionCount desc
| take 50

IMPORTANT: This query shows TCP connection establishment (network layer), NOT successful authentication. Attackers who appear here may still fail at the authentication layer (SecurityEvent 4625). For honeypots, all inbound connections should be treated as reconnaissance/attack attempts.

After Phase 1 completes:

• Merge all three result sets
• Rank IPs by attack volume (prioritize SecurityEvent FailedAttempts, then W3CIISLog RequestCount, then DeviceNetworkEvents ConnectionCount)
• Select top 10-15 IPs for enrichment (focus on high-volume attackers, not one-off scanners)
• Extract unique IP addresses into array
• Save prioritized IPs only to temp/honeypot_ips_<timestamp>.json in format: {"ips": ["1.2.3.4", "5.6.7.8", ...]}
• Document total unique attacker count separately for report statistics
• Report elapsed time: [MM:SS] ✓ Failed connection queries completed (XX seconds) - [total_count] unique IPs identified, top [enrichment_count] prioritized for enrichment

---

Phase 2: IP Enrichment & Threat Intelligence (PARALLEL)

Execute IP enrichment script AND Sentinel threat intel query in parallel:

2A: Run IP Enrichment Script

# Read prioritized IPs from JSON file (top 10-15 by attack volume)
# This reduces token consumption by ~80% while maintaining critical intelligence
$env:PYTHONPATH = "<WORKSPACE_ROOT>"
cd "<WORKSPACE_ROOT>"
.\.venv\Scripts\python.exe enrich_ips.py --file temp/honeypot_ips_<timestamp>.json

Enrichment provides (for prioritized IPs only):

• Geolocation (city, region, country)
• ISP/Organization (ASN, org name)
• VPN/Proxy/Tor detection (is_vpn, is_proxy, is_tor)
• Abuse reputation (abuse_confidence_score, total_reports)
• Shodan intelligence: open ports, CVEs, tags (e.g., eol-os, self-signed, c2), CPEs, hostnames
• Risk level assessment (HIGH/MEDIUM/LOW)

Note: Enrichment script provides aggregated statistics for all IPs - use these summary stats in report narrative instead of listing every IP

2B: Query Sentinel Threat Intelligence

let target_ips = dynamic(["<IP1>", "<IP2>", "<IP3>", ...]);  // From Phase 1 prioritized list (top 10-15 IPs)
ThreatIntelIndicators
| extend IndicatorType = replace_string(replace_string(replace_string(tostring(split(ObservableKey, ":", 0)), "[", ""), "]", ""), "\"", "")
| where IndicatorType in ("ipv4-addr", "ipv6-addr", "network-traffic")
| extend NetworkSourceIP = toupper(ObservableValue)
| where NetworkSourceIP in (target_ips)
| where IsActive and (ValidUntil > now() or isempty(ValidUntil))
| extend Description = tostring(parse_json(Data).description)
| where Description !contains_cs "State: inactive;" and Description !contains_cs "State: falsepos;"
| extend TrafficLightProtocolLevel = tostring(parse_json(AdditionalFields).TLPLevel)
| extend ActivityGroupNames = extract(@"ActivityGroup:(\S+)", 1, tostring(parse_json(Data).labels))
| summarize arg_max(TimeGenerated, *) by NetworkSourceIP
| project 
    TimeGenerated,
    IPAddress = NetworkSourceIP,
    ThreatDescription = Description,
    ActivityGroupNames,
    Confidence,
    ValidUntil,
    TrafficLightProtocolLevel,
    IsActive
| order by Confidence desc, TimeGenerated desc

After Phase 2 completes:

• Merge IP enrichment JSON with Sentinel threat intel results
• Save combined data to temp/honeypot_data_<timestamp>.json
• Report elapsed time: [MM:SS] ✓ IP enrichment completed (XX seconds)

---

Phase 3: Query Security Incidents (Sentinel KQL)

Step 3A: Get Device ID from Sentinel

let honeypot = '<HONEYPOT_NAME>';
DeviceInfo
| where TimeGenerated > ago(30d)
| where DeviceName =~ honeypot or DeviceName contains honeypot
| summarize arg_max(TimeGenerated, *)
| project DeviceId, DeviceName, OSPlatform, OSVersion, PublicIP

Extract DeviceId (GUID) from result - returns single most recent device record.

Step 3B: Query Security Incidents

let targetDevice = "<HONEYPOT_NAME>";
let targetDeviceId = "<DEVICE_ID>";  // REQUIRED: Get from DeviceInfo query (Step 3A)
let start = datetime(<StartDate>);
let end = datetime(<EndDate>);
l

---

*Content truncated.*