Put live honeypot telemetry where your team already works.

# Scripted input, every 5 min: refresh the lookup table file
curl -fsS 'https://honeylabs.net/feed/<token>.csv' \
  > $SPLUNK_HOME/etc/apps/search/lookups/honeylabs_scanners.csv
# Define it once: Settings > Lookups > add a definition over that CSV.

# Search-time: flag any source IP HoneyLabs has caught scanning
index=firewall
| lookup honeylabs_scanners ip AS src_ip OUTPUT events asn country last_seen
| eval HoneyLabs=if(isnotnull(events),"known scanner","clean")
| table src_ip HoneyLabs events country asn last_seen

# logstash.conf  -  poll the JSON feed into an index
input {
  http_poller {
    urls => { honeylabs => "https://honeylabs.net/feed/<token>.json" }
    request_timeout => 30
    schedule => { every => "5m" }
    codec => "json"
  }
}
filter { split { field => "message" } }
output { elasticsearch { index => "honeylabs-scanners" } }
# Then build an enrich policy on honeylabs-scanners keyed by ip.

# Cortex analyzer  -  HoneyLabs_Lookup
from cortexutils.analyzer import Analyzer
import requests

class HoneyLabs(Analyzer):
    def run(self):
        ip = self.get_data()
        d = requests.get(
            f"https://honeylabs.net/lookup/{ip}?format=json", timeout=20
        ).json()
        self.report({
            "verdict": d["verdict"]["label"],
            "events":  d["total_events"],
            "scanner": d.get("scanner_tag"),
            "last_seen": d["last_seen"],
        })

if __name__ == "__main__":
    HoneyLabs().run()

# Sync Actions -> Feeds -> Add Feed
Provider      : HoneyLabs
Input Source  : Network
URL           : https://honeylabs.net/feed/<token>.csv
Source Format : Simple CSV
Value field   : 1            # the ip column
Settings      : enabled, caching enabled
# Fetch on the usual feed schedule. IPs land as ip-src attributes.

# n8n "HTTP Request" node (or a Tines HTTP action)
Method : GET
URL    : https://honeylabs.net/lookup/{{ $json.ip }}?format=json
# Optional, lifts the anonymous rate limit:
Header : Authorization: Bearer hlk_xxxxxxxxxxxxxxxx

# Branch on  {{ $json.verdict.verdict == "scanner" }}

# Firewall -> Aliases -> add a "URL Table (IPs)" alias
Name             : HoneyLabs_Scanners
Type             : URL Table (IPs)
URL              : https://honeylabs.net/feed/<token>
Update frequency : 1 day

# Then: Firewall -> Rules -> WAN -> block, Source = HoneyLabs_Scanners

# /etc/cron.d/honeylabs  -  refresh every 30 min
*/30 * * * * root ipset create honeylabs hash:ip -exist; \
  curl -fsS 'https://honeylabs.net/feed/<token>' | \
  while read ip; do ipset add honeylabs "$ip" -exist; done

# One-time: drop anything in the set
iptables -I INPUT -m set --match-set honeylabs src -j DROP

curl -s 'https://honeylabs.net/lookup/80.82.77.202?format=json' \
  | jq '{verdict: .verdict.label, events: .total_events, asn: .geo.org}'

# { "verdict": "Recognized scanner", "events": 292541, "asn": "IP Volume inc" }

import requests

r = requests.get(
    "https://honeylabs.net/lookup/80.82.77.202",
    params={"format": "json"},
    headers={"Authorization": "Bearer hlk_xxxxxxxxxxxxxxxx"},  # optional
    timeout=20,
)
v = r.json()["verdict"]
print(v["label"], v["confidence"])  # Recognized scanner high