Put live honeypot telemetry where your team already works.

# Data connectors -> Threat Intelligence - TAXII -> Add
Friendly name : HoneyLabs exploiters
API root URL  : https://honeylabs.net/taxii2/api/
Collection ID : exploiters
Username      : taxii
Password      : <your API key>   # free, from /dashboard?src=sentinel
Polling       : Once an hour

# Repeat with Collection ID: malware-infrastructure

# Configure -> Threat intelligence -> Threat intelligence sources
Name              : honeylabs_exploiters
Type              : ip
URL               : https://honeylabs.net/feed/exploiters.csv
Delimiting regex  : ,
Fields            : ip:$1,description:$7
Skip header lines : 1

# Matches land in threat_activity and carry a reference URL
# back to the full report for that indicator.

# Scripted input, every 5 min: refresh the lookup table file
curl -fsS 'https://honeylabs.net/feed/<token>.csv' \
  > $SPLUNK_HOME/etc/apps/search/lookups/honeylabs_scanners.csv
# Define it once: Settings > Lookups > add a definition over that CSV.

# Search-time: flag any source IP HoneyLabs has caught scanning
index=firewall
| lookup honeylabs_scanners ip AS src_ip OUTPUT events asn country last_seen
| eval HoneyLabs=if(isnotnull(events),"known scanner","clean")
| table src_ip HoneyLabs events country asn last_seen

# logstash.conf  -  poll the JSON feed into an index
input {
  http_poller {
    urls => { honeylabs => "https://honeylabs.net/feed/<token>.json" }
    request_timeout => 30
    schedule => { every => "5m" }
    codec => "json"
  }
}
filter { split { field => "message" } }
output { elasticsearch { index => "honeylabs-scanners" } }
# Then build an enrich policy on honeylabs-scanners keyed by ip.

# Cortex analyzer  -  HoneyLabs_Lookup
from cortexutils.analyzer import Analyzer
import requests

class HoneyLabs(Analyzer):
    def run(self):
        ip = self.get_data()
        d = requests.get(
            f"https://honeylabs.net/lookup/{ip}?format=json", timeout=20
        ).json()
        self.report({
            "verdict": d["verdict"]["label"],
            "events":  d["total_events"],
            "scanner": d.get("scanner_tag"),
            "last_seen": d["last_seen"],
        })

if __name__ == "__main__":
    HoneyLabs().run()

# Nothing to add: both feeds are in MISP's shipped defaults.json.
# Sync Actions -> List Feeds -> filter "HoneyLabs"
#   HoneyLabs active exploiters       (csv, ip-src)
#   HoneyLabs malware infrastructure  (freetext, url)
# "Cache all feeds" for correlation, or "Fetch and store all feed data"
# to pull them into events.

# Your own saved queries work as extra MISP feeds too:
URL           : https://honeylabs.net/feed/<token>.csv
Source Format : Simple CSV, value field 1

# Data -> Ingestion -> TAXII Feeds -> Create
TAXII server URL : https://honeylabs.net/taxii2/api/
TAXII collection : 253ff00b-4863-571f-8949-9d05616de5b7
Authentication   : Basic (user: taxii, password: <your API key>)

# Second ingester for loader/C2 URLs:
TAXII collection : e144c129-a19a-55c8-b926-dd2dfbbd8138

# n8n "HTTP Request" node (or a Tines HTTP action)
Method : GET
URL    : https://honeylabs.net/lookup/{{ $json.ip }}?format=json
# Optional, lifts the anonymous rate limit:
Header : Authorization: Bearer hlk_xxxxxxxxxxxxxxxx

# Branch on  {{ $json.verdict.verdict == "scanner" }}

# Firewall -> Aliases -> add a "URL Table (IPs)" alias
Name             : HoneyLabs_Scanners
Type             : URL Table (IPs)
URL              : https://honeylabs.net/feed/<token>
Update frequency : 1 day

# Then: Firewall -> Rules -> WAN -> block, Source = HoneyLabs_Scanners

# /etc/cron.d/honeylabs  -  refresh every 30 min
*/30 * * * * root ipset create honeylabs hash:ip -exist; \
  curl -fsS 'https://honeylabs.net/feed/<token>' | \
  while read ip; do ipset add honeylabs "$ip" -exist; done

# One-time: drop anything in the set
iptables -I INPUT -m set --match-set honeylabs src -j DROP

# Jail with no log filter, fed from the feed by cron
# /etc/fail2ban/jail.d/honeylabs.conf
[honeylabs]
enabled = true
filter = honeylabs      # empty failregex
logpath = /dev/null
bantime = 6h

# /etc/cron.d/honeylabs-fail2ban
*/30 * * * * root curl -fsS 'https://honeylabs.net/feed/<token>' \
  | while read -r ip; do fail2ban-client set honeylabs banip "$ip" >/dev/null; done

# Daily: import the feed as 24h ban decisions
curl -fsS 'https://honeylabs.net/feed/<token>' -o /tmp/honeylabs.txt
cscli decisions import -i /tmp/honeylabs.txt --format values --duration 24h

# Existing bouncers (firewall, nginx, Traefik) pick them up automatically
cscli decisions list | head

curl -s 'https://honeylabs.net/lookup/80.82.77.202?format=json' \
  | jq '{verdict: .verdict.label, events: .total_events, asn: .geo.org}'

# { "verdict": "Recognized scanner", "events": 292541, "asn": "IP Volume inc" }

import requests

r = requests.get(
    "https://honeylabs.net/lookup/80.82.77.202",
    params={"format": "json"},
    headers={"Authorization": "Bearer hlk_xxxxxxxxxxxxxxxx"},  # optional
    timeout=20,
)
v = r.json()["verdict"]
print(v["label"], v["confidence"])  # Recognized scanner high