SentinelBrief
← Alert queue

117.89.254.46

Sensor
hp-use-01
Source
cowrie
Status
triaged
Event time
Received

Verdict

S4successful_intrusionConfidence 96%Escalate: yes

Reasoning

The session shows a successful SSH login using root/centos, which establishes a foothold and meets severity 4 by rubric. Per command retrieval, no post-login commands, downloads, or uploads were executed during the short session, so there is no evidence of malware delivery, persistence, or broader compromise activity beyond initial access.

Recommended action

Escalate as a confirmed honeypot compromise attempt; retain session artifacts, block or monitor the source IP as appropriate, and watch for repeat access or follow-on payload delivery.

Routing

Primary model
gpt-4o-mini
Final model
gpt-5.4
Escalated to strong model
yes
Prompt version
triage-v4
Input tokens
4,626
Output tokens
264
Cost
$0.006028
Latency
4,746 ms
Verdict at
2026-09-16 07:39:41Z

Tool trace

  1. 0. get_session_commands· 0 ms

    Arguments
    {
  "session_id": "7018ed048809"
}
    Result
    {
  "commands": [],
  "downloads": [],
  "session_id": "7018ed048809",
  "command_count": 0,
  "download_count": 0,
  "clipped_commands": 0,
  "commands_truncated": false,
  "downloads_truncated": false
}
Raw session JSON
{
  "events": [
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "117.89.254.46",
      "eventid": "cowrie.session.connect",
      "message": "New connection: 117.89.254.46:57034 (172.18.0.2:2222) [session: 7018ed048809]",
      "outfile": null,
      "session": "7018ed048809",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 57034,
      "username": null,
      "timestamp": "2026-09-16T07:39:24.565135Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "117.89.254.46",
      "eventid": "cowrie.client.version",
      "message": "Remote SSH version: SSH-2.0-Go",
      "outfile": null,
      "session": "7018ed048809",
      "version": "SSH-2.0-Go",
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 57034,
      "username": null,
      "timestamp": "2026-09-16T07:39:36.053678Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "encCS": [
        "aes128-gcm@openssh.com",
        "chacha20-poly1305@openssh.com",
        "aes128-ctr",
        "aes192-ctr",
        "aes256-ctr"
      ],
      "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
      "input": null,
      "macCS": [
        "hmac-sha2-256-etm@openssh.com",
        "hmac-sha2-256",
        "hmac-sha1",
        "hmac-sha1-96"
      ],
      "compCS": [
        "none"
      ],
      "dst_ip": "172.18.0.2",
      "langCS": [
        ""
      ],
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "117.89.254.46",
      "eventid": "cowrie.client.kex",
      "kexAlgs": [
        "curve25519-sha256@libssh.org",
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "diffie-hellman-group14-sha1"
      ],
      "keyAlgs": [
        "rsa-sha2-512-cert-v01@openssh.com",
        "rsa-sha2-256-cert-v01@openssh.com",
        "ssh-rsa-cert-v01@openssh.com",
        "ssh-dss-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256-cert-v01@openssh.com",
        "ecdsa-sha2-nistp384-cert-v01@openssh.com",
        "ecdsa-sha2-nistp521-cert-v01@openssh.com",
        "ssh-ed25519-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
        "rsa-sha2-512",
        "rsa-sha2-256",
        "ssh-rsa",
        "ssh-dss",
        "ssh-ed25519"
      ],
      "message": "SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6",
      "outfile": null,
      "session": "7018ed048809",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 57034,
      "username": null,
      "timestamp": "2026-09-16T07:39:36.054128Z",
      "duration_ms": null,
      "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "117.89.254.46",
      "eventid": "cowrie.login.success",
      "message": "login attempt [root/centos] succeeded",
      "outfile": null,
      "session": "7018ed048809",
      "version": null,
      "dst_port": 2222,
      "password": "centos",
      "protocol": "ssh",
      "src_port": 57034,
      "username": "root",
      "timestamp": "2026-09-16T07:39:37.605738Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "117.89.254.46",
      "eventid": "cowrie.session.closed",
      "message": "Connection lost after 15928 milliseconds",
      "outfile": null,
      "session": "7018ed048809",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 57034,
      "username": null,
      "timestamp": "2026-09-16T07:39:40.492881Z",
      "duration_ms": 15928
    }
  ],
  "sensor": "hp-use-01",
  "source": "cowrie",
  "src_ip": "117.89.254.46",
  "session_id": "7018ed048809"
}