View:
Combined metrics across sensors. Switch hosts or open side-by-side to isolate web, game, or gateway edges.
Distraction time (24h)
Black Hole + Sticky Wicket seconds wasted (bar, not doughnut).
Most guessed usernames (7d)
Top culprit IPs
| # | IP | Intrusions | SSH | BH | SW | Where | ASN |
Black Hole — commands
Loading command note…
Credentials — pairs + guessed users
Black Hole pairs (if any) + real sshd username guesses.
| # | User | Password | Hits | OK/Fail | IPs |
|---|
Top guessed usernames (sshd)
SSH client version / banner
Cowrie client banners (binary/TLS collapsed).
ASN / Organization
First-seen / returning / multi-day
Active SSH attackers in window.
| Status | IP | Events | Days | First seen | Where |
|---|
Black Hole — session duration
Distribution of session lengths.
Spike detection high-volume windows
Severity: elevated ≥3× · high ≥5× · extreme ≥10× median. SSH-only spikes ignore tarpit floods.
| When | Sev | Vol | ×med | /min | Dominant | SSH | BH | SW | IPs≈ |
Command categories
recon · download · persistence · crypto · …
Payload hashes (SHA256)
Cowrie shasum or URL fingerprint.
Intrusion geolocation
| Country | Attempts | IPs | SSH | BH | SW |
|---|
Storage / hosts
| Host | Label | SSH fails | IPs | 24h fails | Ingest |
|---|
Black Hole — recent activity
Latest connects, logins, commands, downloads (newest first).
Black Hole — downloads / URLs
wget/curl targets and dropped files.
| # | URL / file | Hits | IPs | SHA | Last |
|---|
Black Hole — time wasted by IP (24h)
Sticky Wicket — time wasted by IP (24h)