SentinelBrief
← Alert queue

182.43.19.187

Sensor
hp-use-01
Source
cowrie
Status
triaged
Event time
Received

Verdict

S4successful_intrusionConfidence 97%Escalate: yes

Reasoning

A successful SSH login occurred using root/debian, which establishes a foothold on the honeypot and meets severity 4. Retrieved session commands show no post-login commands, downloads, or uploads, so there is no evidence of malware delivery or persistence activity. The session lasted about 90 seconds, indicating an authenticated connection even without recorded command execution.

Recommended action

Escalate as a confirmed successful intrusion on the honeypot; retain session artifacts, monitor for repeat access from this source, and block or rate-limit the IP if operationally useful.

Routing

Primary model
gpt-4o-mini
Final model
gpt-5.4
Escalated to strong model
yes
Prompt version
triage-v4
Input tokens
4,647
Output tokens
275
Cost
$0.006159
Latency
5,233 ms
Verdict at
2026-09-15 05:15:48Z

Tool trace

  1. 0. get_session_commands· 0 ms

    Arguments
    {
  "session_id": "0b19d1b85deb"
}
    Result
    {
  "commands": [],
  "downloads": [],
  "session_id": "0b19d1b85deb",
  "command_count": 0,
  "download_count": 0,
  "clipped_commands": 0,
  "commands_truncated": false,
  "downloads_truncated": false
}
Raw session JSON
{
  "events": [
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "182.43.19.187",
      "eventid": "cowrie.session.connect",
      "message": "New connection: 182.43.19.187:34986 (172.18.0.2:2222) [session: 0b19d1b85deb]",
      "outfile": null,
      "session": "0b19d1b85deb",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 34986,
      "username": null,
      "timestamp": "2026-09-15T05:14:17.178555Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "182.43.19.187",
      "eventid": "cowrie.client.version",
      "message": "Remote SSH version: SSH-2.0-Go",
      "outfile": null,
      "session": "0b19d1b85deb",
      "version": "SSH-2.0-Go",
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 34986,
      "username": null,
      "timestamp": "2026-09-15T05:15:44.602984Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "encCS": [
        "aes128-gcm@openssh.com",
        "chacha20-poly1305@openssh.com",
        "aes128-ctr",
        "aes192-ctr",
        "aes256-ctr"
      ],
      "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
      "input": null,
      "macCS": [
        "hmac-sha2-256-etm@openssh.com",
        "hmac-sha2-256",
        "hmac-sha1",
        "hmac-sha1-96"
      ],
      "compCS": [
        "none"
      ],
      "dst_ip": "172.18.0.2",
      "langCS": [
        ""
      ],
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "182.43.19.187",
      "eventid": "cowrie.client.kex",
      "kexAlgs": [
        "curve25519-sha256@libssh.org",
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "diffie-hellman-group14-sha1"
      ],
      "keyAlgs": [
        "rsa-sha2-512-cert-v01@openssh.com",
        "rsa-sha2-256-cert-v01@openssh.com",
        "ssh-rsa-cert-v01@openssh.com",
        "ssh-dss-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256-cert-v01@openssh.com",
        "ecdsa-sha2-nistp384-cert-v01@openssh.com",
        "ecdsa-sha2-nistp521-cert-v01@openssh.com",
        "ssh-ed25519-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
        "rsa-sha2-512",
        "rsa-sha2-256",
        "ssh-rsa",
        "ssh-dss",
        "ssh-ed25519"
      ],
      "message": "SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6",
      "outfile": null,
      "session": "0b19d1b85deb",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 34986,
      "username": null,
      "timestamp": "2026-09-15T05:15:44.610367Z",
      "duration_ms": null,
      "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "182.43.19.187",
      "eventid": "cowrie.login.success",
      "message": "login attempt [root/debian] succeeded",
      "outfile": null,
      "session": "0b19d1b85deb",
      "version": null,
      "dst_port": 2222,
      "password": "debian",
      "protocol": "ssh",
      "src_port": 34986,
      "username": "root",
      "timestamp": "2026-09-15T05:15:45.566520Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "182.43.19.187",
      "eventid": "cowrie.session.closed",
      "message": "Connection lost after 90197 milliseconds",
      "outfile": null,
      "session": "0b19d1b85deb",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 34986,
      "username": null,
      "timestamp": "2026-09-15T05:15:47.375566Z",
      "duration_ms": 90197
    }
  ],
  "sensor": "hp-use-01",
  "source": "cowrie",
  "src_ip": "182.43.19.187",
  "session_id": "0b19d1b85deb"
}