ElasticHoney Sensor

ElasticHoney is a "simple elasticsearch honeypot designed to catch attackers exploiting RCE vulnerabilities in elasticsearch."

Deployment

This sensor can be deployed using the Ubuntu - ElasticHoney deploy script, found in MHN's Deploy page. The script provided supports installation on Ubuntu 14.04 and 16.04 systems. To avoid installation errors, it is highly recommended you make sure the host system is fully up-to-date before running the deploy script.

Further Information

Introducing elastichoney - an Elasticsearch Honeypot