SentinelBrief
← Alert queue

34.34.184.149

Sensor
hp-use-01
Source
cowrie
Status
triaged
Event time
Received

Verdict

S4successful_intrusionConfidence 98%Escalate: yes

Reasoning

The session shows a successful SSH login using admin/admin, which by rubric is a foothold and maps to severity 4. Retrieved session commands show no post-login commands, downloads, or uploads, so there is no evidence of malware delivery, persistence, or broader compromise behavior. The very short duration suggests automated validation of credentials rather than interactive follow-on activity, but the successful authentication still makes this a successful intrusion.

Recommended action

Escalate and review surrounding sessions from this IP/credential pair; ensure the honeypot remains isolated and check for any related successful logins or follow-on activity.

Routing

Primary model
gpt-4o-mini
Final model
gpt-5.4
Escalated to strong model
yes
Prompt version
triage-v4
Input tokens
4,641
Output tokens
266
Cost
$0.006264
Latency
6,916 ms
Verdict at
2026-10-13 05:53:06Z

Tool trace

  1. 0. get_session_commands· 0 ms

    Arguments
    {
  "session_id": "ab78f2d2893b"
}
    Result
    {
  "commands": [],
  "downloads": [],
  "session_id": "ab78f2d2893b",
  "command_count": 0,
  "download_count": 0,
  "clipped_commands": 0,
  "commands_truncated": false,
  "downloads_truncated": false
}
Raw session JSON
{
  "events": [
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "34.34.184.149",
      "eventid": "cowrie.session.connect",
      "message": "New connection: 34.34.184.149:24186 (172.18.0.2:2222) [session: ab78f2d2893b]",
      "outfile": null,
      "session": "ab78f2d2893b",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 24186,
      "username": null,
      "timestamp": "2026-10-13T05:53:04.853824Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "34.34.184.149",
      "eventid": "cowrie.client.version",
      "message": "Remote SSH version: SSH-2.0-Go",
      "outfile": null,
      "session": "ab78f2d2893b",
      "version": "SSH-2.0-Go",
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 24186,
      "username": null,
      "timestamp": "2026-10-13T05:53:04.854113Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "encCS": [
        "aes128-ctr",
        "aes192-ctr",
        "aes256-ctr",
        "aes128-gcm@openssh.com",
        "chacha20-poly1305@openssh.com",
        "arcfour256",
        "arcfour128",
        "arcfour",
        "aes128-cbc",
        "3des-cbc"
      ],
      "hassh": "dde267e50f82fcc16a7e1e7b59b8af71",
      "input": null,
      "macCS": [
        "hmac-sha2-256-etm@openssh.com",
        "hmac-sha2-256",
        "hmac-sha1",
        "hmac-sha1-96"
      ],
      "compCS": [
        "none"
      ],
      "dst_ip": "172.18.0.2",
      "langCS": [
        ""
      ],
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "34.34.184.149",
      "eventid": "cowrie.client.kex",
      "kexAlgs": [
        "diffie-hellman-group-exchange-sha256",
        "diffie-hellman-group-exchange-sha1",
        "diffie-hellman-group1-sha1",
        "diffie-hellman-group14-sha1",
        "diffie-hellman-group14-sha256",
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "curve25519-sha256@libssh.org",
        "curve25519-sha256",
        "ext-info-c"
      ],
      "keyAlgs": [
        "rsa-sha2-512-cert-v01@openssh.com",
        "rsa-sha2-256-cert-v01@openssh.com",
        "ssh-rsa-cert-v01@openssh.com",
        "ssh-dss-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256-cert-v01@openssh.com",
        "ecdsa-sha2-nistp384-cert-v01@openssh.com",
        "ecdsa-sha2-nistp521-cert-v01@openssh.com",
        "ssh-ed25519-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
        "rsa-sha2-512",
        "rsa-sha2-256",
        "ssh-rsa",
        "ssh-dss",
        "ssh-ed25519"
      ],
      "message": "SSH client hassh fingerprint: dde267e50f82fcc16a7e1e7b59b8af71",
      "outfile": null,
      "session": "ab78f2d2893b",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 24186,
      "username": null,
      "timestamp": "2026-10-13T05:53:04.935447Z",
      "duration_ms": null,
      "hasshAlgorithms": "diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256@libssh.org,curve25519-sha256,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "34.34.184.149",
      "eventid": "cowrie.login.success",
      "message": "login attempt [admin/admin] succeeded",
      "outfile": null,
      "session": "ab78f2d2893b",
      "version": null,
      "dst_port": 2222,
      "password": "admin",
      "protocol": "ssh",
      "src_port": 24186,
      "username": "admin",
      "timestamp": "2026-10-13T05:53:05.204811Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "34.34.184.149",
      "eventid": "cowrie.session.closed",
      "message": "Connection lost after 443 milliseconds",
      "outfile": null,
      "session": "ab78f2d2893b",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 24186,
      "username": null,
      "timestamp": "2026-10-13T05:53:05.297107Z",
      "duration_ms": 443
    }
  ],
  "sensor": "hp-use-01",
  "source": "cowrie",
  "src_ip": "34.34.184.149",
  "session_id": "ab78f2d2893b"
}