SentinelBrief
← Alert queue

115.190.212.50

Sensor
hp-use-01
Source
cowrie
Status
triaged
Event time
Received

Verdict

S4successful_intrusionConfidence 98%Escalate: yes

Reasoning

A successful SSH login occurred using root/ubuntu, which establishes a foothold and meets the severity-4 rubric. Session command retrieval shows no post-login commands and no download/upload activity, so there is no evidence of malware delivery, persistence, or further hands-on recon in this session. This is therefore best classified as a successful intrusion rather than brute force or reconnaissance.

Recommended action

Escalate for review, preserve session telemetry, block or monitor the source IP, and verify no exposed systems accept the same credentials.

Routing

Primary model
gpt-4o-mini
Final model
gpt-5.4
Escalated to strong model
yes
Prompt version
triage-v4
Input tokens
4,637
Output tokens
247
Cost
$0.006017
Latency
5,417 ms
Verdict at
2026-09-20 06:19:32Z

Tool trace

  1. 0. get_session_commands· 0 ms

    Arguments
    {
  "session_id": "92be73df27a3"
}
    Result
    {
  "commands": [],
  "downloads": [],
  "session_id": "92be73df27a3",
  "command_count": 0,
  "download_count": 0,
  "clipped_commands": 0,
  "commands_truncated": false,
  "downloads_truncated": false
}
Raw session JSON
{
  "events": [
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "115.190.212.50",
      "eventid": "cowrie.session.connect",
      "message": "New connection: 115.190.212.50:44682 (172.18.0.2:2222) [session: 92be73df27a3]",
      "outfile": null,
      "session": "92be73df27a3",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 44682,
      "username": null,
      "timestamp": "2026-09-20T06:19:26.251099Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "115.190.212.50",
      "eventid": "cowrie.client.version",
      "message": "Remote SSH version: SSH-2.0-Go",
      "outfile": null,
      "session": "92be73df27a3",
      "version": "SSH-2.0-Go",
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 44682,
      "username": null,
      "timestamp": "2026-09-20T06:19:26.251412Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "encCS": [
        "aes128-gcm@openssh.com",
        "chacha20-poly1305@openssh.com",
        "aes128-ctr",
        "aes192-ctr",
        "aes256-ctr"
      ],
      "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
      "input": null,
      "macCS": [
        "hmac-sha2-256-etm@openssh.com",
        "hmac-sha2-256",
        "hmac-sha1",
        "hmac-sha1-96"
      ],
      "compCS": [
        "none"
      ],
      "dst_ip": "172.18.0.2",
      "langCS": [
        ""
      ],
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "115.190.212.50",
      "eventid": "cowrie.client.kex",
      "kexAlgs": [
        "curve25519-sha256@libssh.org",
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "diffie-hellman-group14-sha1"
      ],
      "keyAlgs": [
        "rsa-sha2-512-cert-v01@openssh.com",
        "rsa-sha2-256-cert-v01@openssh.com",
        "ssh-rsa-cert-v01@openssh.com",
        "ssh-dss-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256-cert-v01@openssh.com",
        "ecdsa-sha2-nistp384-cert-v01@openssh.com",
        "ecdsa-sha2-nistp521-cert-v01@openssh.com",
        "ssh-ed25519-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
        "rsa-sha2-512",
        "rsa-sha2-256",
        "ssh-rsa",
        "ssh-dss",
        "ssh-ed25519"
      ],
      "message": "SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6",
      "outfile": null,
      "session": "92be73df27a3",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 44682,
      "username": null,
      "timestamp": "2026-09-20T06:19:26.486656Z",
      "duration_ms": null,
      "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "115.190.212.50",
      "eventid": "cowrie.login.success",
      "message": "login attempt [root/ubuntu] succeeded",
      "outfile": null,
      "session": "92be73df27a3",
      "version": null,
      "dst_port": 2222,
      "password": "ubuntu",
      "protocol": "ssh",
      "src_port": 44682,
      "username": "root",
      "timestamp": "2026-09-20T06:19:29.623399Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "115.190.212.50",
      "eventid": "cowrie.session.closed",
      "message": "Connection lost after 5581 milliseconds",
      "outfile": null,
      "session": "92be73df27a3",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 44682,
      "username": null,
      "timestamp": "2026-09-20T06:19:31.832525Z",
      "duration_ms": 5581
    }
  ],
  "sensor": "hp-use-01",
  "source": "cowrie",
  "src_ip": "115.190.212.50",
  "session_id": "92be73df27a3"
}