SentinelBrief
← Alert queue

208.104.31.154

Sensor
hp-use-01
Source
cowrie
Status
triaged
Event time
Received

Verdict

S4successful_intrusionConfidence 98%Escalate: yes

Reasoning

The session shows a successful SSH login to the honeypot using root after two failed attempts. Per rubric, any successful login constitutes a foothold and maps to successful_intrusion with severity 4, even though no post-login commands, downloads, or uploads were observed before the session ended. The very short duration and zero commands suggest limited attacker progress after access, not mere brute force.

Recommended action

Escalate as a confirmed foothold; preserve session artifacts, block or monitor the source IP as appropriate, and review for related successful logins using the same credential pattern.

Routing

Primary model
gpt-4o-mini
Final model
gpt-5.4
Escalated to strong model
yes
Prompt version
triage-v4
Input tokens
4,689
Output tokens
279
Cost
$0.006259
Latency
5,964 ms
Verdict at
2026-09-18 20:09:58Z

Tool trace

  1. 0. get_session_commands· 0 ms

    Arguments
    {
  "session_id": "a0fb33c399d9"
}
    Result
    {
  "commands": [],
  "downloads": [],
  "session_id": "a0fb33c399d9",
  "command_count": 0,
  "download_count": 0,
  "clipped_commands": 0,
  "commands_truncated": false,
  "downloads_truncated": false
}
Raw session JSON
{
  "events": [
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "208.104.31.154",
      "eventid": "cowrie.session.connect",
      "message": "New connection: 208.104.31.154:60756 (172.18.0.2:2222) [session: a0fb33c399d9]",
      "outfile": null,
      "session": "a0fb33c399d9",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 60756,
      "username": null,
      "timestamp": "2026-09-18T20:09:57.002005Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "208.104.31.154",
      "eventid": "cowrie.client.version",
      "message": "Remote SSH version: SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.19",
      "outfile": null,
      "session": "a0fb33c399d9",
      "version": "SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.19",
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 60756,
      "username": null,
      "timestamp": "2026-09-18T20:09:57.004987Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "encCS": [
        "chacha20-poly1305@openssh.com",
        "aes128-ctr",
        "aes192-ctr",
        "aes256-ctr",
        "aes128-gcm@openssh.com",
        "aes256-gcm@openssh.com"
      ],
      "hassh": "aae6b9604f6f3356543709a376d7f657",
      "input": null,
      "macCS": [
        "umac-64-etm@openssh.com",
        "umac-128-etm@openssh.com",
        "hmac-sha2-256-etm@openssh.com",
        "hmac-sha2-512-etm@openssh.com",
        "hmac-sha1-etm@openssh.com",
        "umac-64@openssh.com",
        "umac-128@openssh.com",
        "hmac-sha2-256",
        "hmac-sha2-512",
        "hmac-sha1"
      ],
      "compCS": [
        "none",
        "zlib@openssh.com",
        "zlib"
      ],
      "dst_ip": "172.18.0.2",
      "langCS": [
        ""
      ],
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "208.104.31.154",
      "eventid": "cowrie.client.kex",
      "kexAlgs": [
        "sntrup761x25519-sha512@openssh.com",
        "curve25519-sha256",
        "curve25519-sha256@libssh.org",
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "diffie-hellman-group-exchange-sha256",
        "diffie-hellman-group16-sha512",
        "diffie-hellman-group18-sha512",
        "diffie-hellman-group14-sha256",
        "ext-info-c",
        "kex-strict-c-v00@openssh.com"
      ],
      "keyAlgs": [
        "ssh-ed25519-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256-cert-v01@openssh.com",
        "ecdsa-sha2-nistp384-cert-v01@openssh.com",
        "ecdsa-sha2-nistp521-cert-v01@openssh.com",
        "sk-ssh-ed25519-cert-v01@openssh.com",
        "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com",
        "rsa-sha2-512-cert-v01@openssh.com",
        "rsa-sha2-256-cert-v01@openssh.com",
        "ssh-ed25519",
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
        "sk-ssh-ed25519@openssh.com",
        "sk-ecdsa-sha2-nistp256@openssh.com",
        "rsa-sha2-512",
        "rsa-sha2-256"
      ],
      "message": "SSH client hassh fingerprint: aae6b9604f6f3356543709a376d7f657",
      "outfile": null,
      "session": "a0fb33c399d9",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 60756,
      "username": null,
      "timestamp": "2026-09-18T20:09:57.020101Z",
      "duration_ms": null,
      "hasshAlgorithms": "sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib"
    },
    {
      "key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKRJ9WCKL6GmJksnGLPe5HAG0tWht7PZdOtu+9a6byPr",
      "url": null,
      "type": "ssh-ed25519",
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "208.104.31.154",
      "eventid": "cowrie.client.fingerprint",
      "message": "public key attempt for user root of type ssh-ed25519 with fingerprint c8:df:6d:02:c4:c6:ff:6e:bd:1e:25:77:7b:5e:03:f7",
      "outfile": null,
      "session": "a0fb33c399d9",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 60756,
      "username": "root",
      "timestamp": "2026-09-18T20:09:57.118367Z",
      "duration_ms": null,
      "fingerprint": "c8:df:6d:02:c4:c6:ff:6e:bd:1e:25:77:7b:5e:03:f7"
    },
    {
      "key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKRJ9WCKL6GmJksnGLPe5HAG0tWht7PZdOtu+9a6byPr",
      "url": null,
      "type": "ssh-ed25519",
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "208.104.31.154",
      "eventid": "cowrie.login.failed",
      "message": "public key login attempt for [root] failed",
      "outfile": null,
      "session": "a0fb33c399d9",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 60756,
      "username": "root",
      "timestamp": "2026-09-18T20:09:57.118675Z",
      "duration_ms": null,
      "fingerprint": "c8:df:6d:02:c4:c6:ff:6e:bd:1e:25:77:7b:5e:03:f7"
    },
    {
      "key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIF/nhZ54UoPNe4xuDPwLqHwiOyyksdELG6eX7MiNPVq",
      "url": null,
      "type": "ssh-ed25519",
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "208.104.31.154",
      "eventid": "cowrie.client.fingerprint",
      "message": "public key attempt for user root of type ssh-ed25519 with fingerprint d2:60:a1:2b:c7:85:50:e2:b2:c5:d8:59:b7:10:1f:23",
      "outfile": null,
      "session": "a0fb33c399d9",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 60756,
      "username": "root",
      "timestamp": "2026-09-18T20:09:57.135002Z",
      "duration_ms": null,
      "fingerprint": "d2:60:a1:2b:c7:85:50:e2:b2:c5:d8:59:b7:10:1f:23"
    },
    {
      "key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIF/nhZ54UoPNe4xuDPwLqHwiOyyksdELG6eX7MiNPVq",
      "url": null,
      "type": "ssh-ed25519",
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "208.104.31.154",
      "eventid": "cowrie.login.failed",
      "message": "public key login attempt for [root] failed",
      "outfile": null,
      "session": "a0fb33c399d9",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 60756,
      "username": "root",
      "timestamp": "2026-09-18T20:09:57.135293Z",
      "duration_ms": null,
      "fingerprint": "d2:60:a1:2b:c7:85:50:e2:b2:c5:d8:59:b7:10:1f:23"
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "208.104.31.154",
      "eventid": "cowrie.login.success",
      "message": "login attempt [root/hunter2] succeeded",
      "outfile": null,
      "session": "a0fb33c399d9",
      "version": null,
      "dst_port": 2222,
      "password": "hunter2",
      "protocol": "ssh",
      "src_port": 60756,
      "username": "root",
      "timestamp": "2026-09-18T20:09:57.151968Z",
      "duration_ms": null
    },
    {
      "url": null,
      "name": "LANG",
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "value": "en_US.UTF-8",
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "208.104.31.154",
      "eventid": "cowrie.client.var",
      "message": "request_env: LANG=en_US.UTF-8",
      "outfile": null,
      "session": "a0fb33c399d9",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 60756,
      "username": null,
      "timestamp": "2026-09-18T20:09:57.184240Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "208.104.31.154",
      "eventid": "cowrie.session.closed",
      "message": "Connection lost after 200 milliseconds",
      "outfile": null,
      "session": "a0fb33c399d9",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 60756,
      "username": null,
      "timestamp": "2026-09-18T20:09:57.202042Z",
      "duration_ms": 200
    }
  ],
  "sensor": "hp-use-01",
  "source": "cowrie",
  "src_ip": "208.104.31.154",
  "session_id": "a0fb33c399d9"
}