SentinelBrief
← Alert queue

101.96.192.198

Sensor
hp-use-01
Source
cowrie
Status
triaged
Event time
Received

Verdict

S4successful_intrusionConfidence 98%Escalate: yes

Reasoning

The session shows a successful SSH login to the honeypot using the root account, which constitutes a foothold. Per rubric, any successful login is at least severity 4 and falls under successful_intrusion unless there is evidence of malware delivery or persistence. Retrieved session commands show no post-login commands, downloads, or uploads, so there is no evidence to raise this to severity 5.

Recommended action

Escalate for review, preserve session artifacts, and monitor for repeat access from this source or credential reuse in related alerts.

Routing

Primary model
gpt-4o-mini
Final model
gpt-5.4
Escalated to strong model
yes
Prompt version
triage-v4
Input tokens
4,679
Output tokens
265
Cost
$0.006110
Latency
8,689 ms
Verdict at
2026-11-10 20:30:23Z

Tool trace

  1. 0. get_session_commands· 0 ms

    Arguments
    {
  "session_id": "c128e11f2854"
}
    Result
    {
  "commands": [],
  "downloads": [],
  "session_id": "c128e11f2854",
  "command_count": 0,
  "download_count": 0,
  "clipped_commands": 0,
  "commands_truncated": false,
  "downloads_truncated": false
}
Raw session JSON
{
  "events": [
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "101.96.192.198",
      "eventid": "cowrie.session.connect",
      "message": "New connection: 101.96.192.198:56684 (172.18.0.2:2222) [session: c128e11f2854]",
      "outfile": null,
      "session": "c128e11f2854",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 56684,
      "username": null,
      "timestamp": "2026-11-10T20:30:15.227091Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "101.96.192.198",
      "eventid": "cowrie.client.version",
      "message": "Remote SSH version: SSH-2.0-russh_0.51.1",
      "outfile": null,
      "session": "c128e11f2854",
      "version": "SSH-2.0-russh_0.51.1",
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 56684,
      "username": null,
      "timestamp": "2026-11-10T20:30:15.236682Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "encCS": [
        "chacha20-poly1305@openssh.com",
        "aes256-gcm@openssh.com",
        "aes256-ctr",
        "aes192-ctr",
        "aes128-ctr"
      ],
      "hassh": "1b8acd46a07d2dc9854db9ec4044c45c",
      "input": null,
      "macCS": [
        "hmac-sha2-512-etm@openssh.com",
        "hmac-sha2-256-etm@openssh.com",
        "hmac-sha2-512",
        "hmac-sha2-256",
        "hmac-sha1-etm@openssh.com",
        "hmac-sha1"
      ],
      "compCS": [
        "none",
        "zlib",
        "zlib@openssh.com"
      ],
      "dst_ip": "172.18.0.2",
      "langCS": [
        ""
      ],
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "101.96.192.198",
      "eventid": "cowrie.client.kex",
      "kexAlgs": [
        "curve25519-sha256",
        "curve25519-sha256@libssh.org",
        "diffie-hellman-group-exchange-sha256",
        "diffie-hellman-group18-sha512",
        "diffie-hellman-group17-sha512",
        "diffie-hellman-group16-sha512",
        "diffie-hellman-group15-sha512",
        "diffie-hellman-group14-sha256",
        "ext-info-c",
        "kex-strict-c-v00@openssh.com"
      ],
      "keyAlgs": [
        "ssh-ed25519",
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
        "rsa-sha2-512",
        "rsa-sha2-256",
        "ssh-rsa"
      ],
      "message": "SSH client hassh fingerprint: 1b8acd46a07d2dc9854db9ec4044c45c",
      "outfile": null,
      "session": "c128e11f2854",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 56684,
      "username": null,
      "timestamp": "2026-11-10T20:30:15.452265Z",
      "duration_ms": null,
      "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group18-sha512,diffie-hellman-group17-sha512,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1-etm@openssh.com,hmac-sha1;none,zlib,zlib@openssh.com"
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "101.96.192.198",
      "eventid": "cowrie.login.success",
      "message": "login attempt [root/X5eIL3KFRe] succeeded",
      "outfile": null,
      "session": "c128e11f2854",
      "version": null,
      "dst_port": 2222,
      "password": "X5eIL3KFRe",
      "protocol": "ssh",
      "src_port": 56684,
      "username": "root",
      "timestamp": "2026-11-10T20:30:20.622226Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "101.96.192.198",
      "eventid": "cowrie.session.closed",
      "message": "Connection lost after 7701 milliseconds",
      "outfile": null,
      "session": "c128e11f2854",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 56684,
      "username": null,
      "timestamp": "2026-11-10T20:30:22.928804Z",
      "duration_ms": 7701
    }
  ],
  "sensor": "hp-use-01",
  "source": "cowrie",
  "src_ip": "101.96.192.198",
  "session_id": "c128e11f2854"
}