# Honeypot Investigation - Complete Process Documentation

**Document Version:** 1.0  
**Last Updated:** December 14, 2025  
**Generated by:** GitHub Copilot in Agent mode with Claude Opus 4.6  
**Classification:** INTERNAL USE

---

## 📑 TABLE OF CONTENTS

1. [Overview](#overview)
2. [Purpose and Objectives](#purpose-and-objectives)
3. [Prerequisites](#prerequisites)
4. [Investigation Workflow](#investigation-workflow)
5. [Technical Implementation](#technical-implementation)
6. [Query Library](#query-library)
7. [IP Enrichment Process](#ip-enrichment-process)
8. [Report Generation](#report-generation)
9. [Best Practices](#best-practices)
10. [Troubleshooting](#troubleshooting)
11. [Appendix](#appendix)

---

## Overview

### What is a Honeypot Investigation?

A honeypot investigation is a comprehensive security analysis performed on decoy systems (honeypots) designed to attract and log malicious activity. These investigations provide critical threat intelligence by:

- **Detecting attack patterns** from real-world threat actors
- **Identifying emerging threats** before they target production systems
- **Collecting threat intelligence** (malicious IPs, exploits, TTPs)
- **Validating security controls** and detection capabilities
- **Providing early warning** of campaigns targeting the organization

### Investigation Scope

Each investigation analyzes:

- **Failed authentication attempts** (RDP, SSH, Windows logon)
- **Web exploitation attempts** (SQL injection, XSS, path traversal, CVE-specific exploits)
- **Network reconnaissance** (port scans, connection attempts)
- **Threat intelligence correlation** (known malicious IPs, APT groups)
- **Security incidents** triggered by honeypot activity
- **Vulnerability assessment** of the honeypot system
- **Attack pattern analysis** (MITRE ATT&CK mapping)

---

## Purpose and Objectives

### Primary Objectives

1. **Threat Intelligence Collection**
   - Identify novel malicious IPs not yet cataloged in threat intelligence feeds
   - Document new attack patterns, exploit techniques, and malware signatures
   - Provide actionable indicators of compromise (IOCs) for organizational defense

2. **Attack Pattern Analysis**
   - Understand attacker tactics, techniques, and procedures (TTPs)
   - Map observed activities to MITRE ATT&CK framework
   - Assess threat actor sophistication levels

3. **Security Posture Assessment**
   - Evaluate detection rule effectiveness
   - Measure incident response trigger rates
   - Identify gaps in security monitoring coverage

4. **Vulnerability Risk Assessment**
   - Cross-reference honeypot vulnerabilities with observed exploitation attempts
   - Prioritize patching based on active targeting
   - Assess real-world exploit availability for CVEs

### Success Metrics

- **Threat Intelligence Value**: Novel IPs discovered / Total attacking IPs
- **Detection Coverage**: Incidents generated / Total attack events
- **Intelligence Quality**: Threat intel match rate (% of IPs with known malicious indicators)
- **Actionable Findings**: High-priority IOCs suitable for organizational threat feeds

---

## Prerequisites

### Required Access

- **Microsoft Sentinel**: Read access to log analytics workspace
- **Microsoft Defender for Endpoint**: Access to Advanced Hunting and device inventory
- **Threat Intelligence Platform**: Access to ThreatIntelIndicators table
- **IP Enrichment APIs**: 
  - ipinfo.io API token (configured in `config.json`)
  - vpnapi.io access
  - AbuseIPDB API access

### Required Tools

- **Python Environment**: Version 3.8+ with virtual environment configured
- **PowerShell**: Version 5.1+ or PowerShell Core 7+
- **MCP Servers**: 
  - `sentinel-data` (Sentinel KQL queries)
  - `sentinel-tria` (Defender Advanced Hunting)
  - Proper authentication configured

### Configuration Files

- **config.json**: Sentinel workspace ID, tenant ID, API tokens
- **Python Virtual Environment**: `.venv` with required packages installed
- **Workspace Path**: Properly set `PYTHONPATH` environment variable

---

## Investigation Workflow

### Phase Overview

```
Phase 1: Query Failed Connections (Parallel)
   ├── SecurityEvent (Windows failed logons)
   ├── W3CIISLog (IIS web server errors)
   └── DeviceNetworkEvents (network traffic)
   
Phase 2: IP Enrichment & Threat Intelligence (Parallel)
   ├── IP Enrichment Script (geolocation, VPN, abuse)
   └── Sentinel Threat Intelligence (ThreatIntelIndicators)
   
Phase 3: Security Incidents (Sequential)
   ├── Get Device ID from DeviceInfo
   └── Query SecurityIncident table
   
Phase 4: Vulnerability Assessment (Sequential)
   ├── Activate Advanced Hunting tools
   ├── Get MDE Machine ID
   ├── Activate Security Alert tools
   └── Query vulnerabilities
   
Phase 5: Generate Executive Report
   └── Create markdown report with findings
```

### Time Tracking (MANDATORY)

**You MUST track and report elapsed time after each phase:**

```
[MM:SS] ✓ Phase description (XX seconds)
```

**Example Output:**
```
[00:12] ✓ Failed connection queries completed (12 seconds) - 487 unique IPs identified, top 15 prioritized for enrichment
[02:45] ✓ IP enrichment completed (153 seconds) - 12 IPs flagged in threat intelligence (100% confidence)
[02:48] ✓ Security incidents query completed (3 seconds) - 3 incidents found (1 active HIGH, 2 closed)
[03:21] ✓ Vulnerability scan completed (33 seconds) - 14 CVEs found (2 CRITICAL, 5 HIGH)
[05:36] ✓ Report generated (135 seconds)

Total Investigation Time: 5 minutes 36 seconds (336 seconds)
```

---

## Technical Implementation

### Phase 1: Query Failed Connections

**Objective**: Identify all attacking IPs from authentication failures, web exploits, and network reconnaissance.

#### Query 1A: Windows Security Events

**Table**: `SecurityEvent`  
**Event IDs**: 4625 (Failed Logon), 4771 (Kerberos Pre-Auth Failed), 4776 (NTLM Auth Failed)

```kql
let start = datetime(2025-12-12);
let end = datetime(2025-12-14);
let honeypot = 'honeypot-server';

SecurityEvent
| where TimeGenerated between (start .. end)
| where Computer contains honeypot
| where EventID in (4625, 4771, 4776)
| where isnotempty(IpAddress) and IpAddress != "-"
| where IpAddress != "127.0.0.1"
| summarize 
    FailedAttempts=count(), 
    FirstSeen=min(TimeGenerated), 
    LastSeen=max(TimeGenerated),
    TargetAccounts=make_set(Account, 10)
    by IpAddress, EventID
| extend EventType = case(
    EventID == 4625, "Failed Logon",
    EventID == 4771, "Kerberos Pre-Auth Failed",
    EventID == 4776, "NTLM Auth Failed",
    "Unknown")
| order by FailedAttempts desc
| take 50
```

**What This Captures:**
- RDP brute force attacks (EventID 4625)
- Kerberos authentication failures (EventID 4771)
- NTLM authentication failures (EventID 4776)
- Target usernames attempted by attackers

#### Query 1B: IIS Web Server Logs

**Table**: `W3CIISLog`  
**Focus**: HTTP 4xx/5xx errors indicating exploitation attempts

```kql
let start = datetime(2025-12-12);
let end = datetime(2025-12-14);
let honeypot = 'honeypot-server';

W3CIISLog
| where TimeGenerated between (start .. end)
| where Computer =~ honeypot
| where tolong(scStatus) >= 400
| where cIP != "127.0.0.1" and cIP != "::1"
| summarize 
    RequestCount=count(), 
    FirstSeen=min(TimeGenerated), 
    LastSeen=max(TimeGenerated),
    TargetedURIs=make_set(csUriStem, 10),
    StatusCodes=make_set(tolong(scStatus), 5)
    by IpAddress = cIP
| order by RequestCount desc
| take 50
```

**What This Captures:**
- SQL injection attempts
- Cross-site scripting (XSS) probes
- Path traversal attempts
- CVE-specific exploit payloads (PHPUnit, Struts2, OpenWrt, etc.)
- Web shell upload attempts

#### Query 1C: Network Traffic (Defender)

**Table**: `DeviceNetworkEvents`  
**Focus**: Successful inbound connections to common attack surfaces

```kql
let start = datetime(2025-12-12);
let end = datetime(2025-12-14);
let honeypot = 'honeypot-server';

DeviceNetworkEvents
| where TimeGenerated between (start .. end)
| where DeviceName =~ honeypot
| where ActionType in ("ConnectionSuccess", "InboundConnectionAccepted", "ConnectionFound")
| where LocalPort in (3389, 80, 443, 445, 22, 21, 23, 8080, 8443)
| where RemoteIP != "127.0.0.1" and RemoteIP != "::1" and RemoteIP != "::ffff:127.0.0.1"
| where RemoteIP !startswith "192.168." and RemoteIP !startswith "10." and RemoteIP !startswith "172.16."
| where RemoteIP !startswith "fe80:" and RemoteIP !startswith "fc00:" and RemoteIP !startswith "fd00:"
| where RemoteIP !startswith "::ffff:"
| summarize 
    ConnectionCount=count(), 
    FirstSeen=min(TimeGenerated), 
    LastSeen=max(TimeGenerated),
    TargetedPorts=make_set(LocalPort, 10),
    Actions=make_set(ActionType, 5)
    by RemoteIP
| order by ConnectionCount desc
| take 50
```

**What This Captures:**
- Port scanning activity
- Successful TCP connections to honeypot services
- Multi-port reconnaissance patterns
- C2 communication attempts

#### IP Prioritization Strategy

After collecting all three result sets:

1. **Rank IPs by attack severity:**
   - SecurityEvent FailedAttempts (highest priority)
   - W3CIISLog RequestCount (web exploitation)
   - DeviceNetworkEvents ConnectionCount (reconnaissance)

2. **Select top 10-15 IPs for enrichment** (reduces API costs while maintaining intelligence value)

3. **Save to temporary file:**
   ```json
   {
     "ips": ["203.0.113.42", "198.51.100.10", "192.0.2.50", ...]
   }
   ```

4. **Document total unique attacker count** separately for report statistics

---

### Phase 2: IP Enrichment & Threat Intelligence

#### IP Enrichment Script

**Script**: `enrich_ips.py`  
**Input**: `temp/honeypot_ips_<timestamp>.json`  
**Output**: Enriched IP data with geolocation, VPN detection, abuse scores

**Command:**
```powershell
$env:PYTHONPATH = "C:\path\to\security-investigator"
cd "C:\path\to\security-investigator"
.\.venv\Scripts\python.exe enrich_ips.py --file temp/honeypot_ips_20251214_103245.json
```

**Enrichment Data Collected:**

| Field | Source | Description |
|-------|--------|-------------|
| `ip` | Input | IP address |
| `city`, `region`, `country` | ipinfo.io | Geolocation |
| `org`, `asn` | ipinfo.io | Network ownership |
| `is_vpn`, `is_proxy`, `is_tor` | ipinfo.io + vpnapi.io | Anonymization detection |
| `abuse_confidence_score` | AbuseIPDB | Reputation (0-100) |
| `total_reports` | AbuseIPDB | Community reports |
| `threat_description` | Sentinel ThreatIntelIndicators | Threat intel match |

#### Sentinel Threat Intelligence Query

**Table**: `ThreatIntelIndicators`  
**Objective**: Cross-reference attacking IPs with known threat intelligence

```kql
let target_ips = dynamic(["203.0.113.42", "198.51.100.10", "192.0.2.50"]);

ThreatIntelIndicators
| extend IndicatorType = replace_string(replace_string(replace_string(tostring(split(ObservableKey, ":", 0)), "[", ""), "]", ""), "\"", "")
| where IndicatorType in ("ipv4-addr", "ipv6-addr", "network-traffic")
| extend NetworkSourceIP = toupper(ObservableValue)
| where NetworkSourceIP in (target_ips)
| where IsActive and (ValidUntil > now() or isempty(ValidUntil))
| extend Description = tostring(parse_json(Data).description)
| where Description !contains_cs "State: inactive;" and Description !contains_cs "State: falsepos;"
| extend TrafficLightProtocolLevel = tostring(parse_json(AdditionalFields).TLPLevel)
| extend ActivityGroupNames = extract(@"ActivityGroup:(\S+)", 1, tostring(parse_json(Data).labels))
| summarize arg_max(TimeGenerated, *) by NetworkSourceIP
| project 
    TimeGenerated,
    IPAddress = NetworkSourceIP,
    ThreatDescription = Description,
    ActivityGroupNames,
    Confidence,
    ValidUntil,
    TrafficLightProtocolLevel,
    IsActive
| order by Confidence desc, TimeGenerated desc
```

**Threat Intelligence Sources:**
- Microsoft Threat Intelligence (MSTIC)
- STIX/TAXII feeds
- Community threat intel platforms
- Internal organizational indicators

---

### Phase 3: Security Incidents

**Objective**: Identify security incidents triggered by honeypot activity.

#### Step 3A: Get Device ID

```kql
let honeypot = 'honeypot-server';

DeviceInfo
| where TimeGenerated > ago(30d)
| where DeviceName =~ honeypot or DeviceName contains honeypot
| summarize arg_max(TimeGenerated, *)
| project DeviceId, DeviceName, OSPlatform, OSVersion, PublicIP
```

#### Step 3B: Query Security Incidents

```kql
let targetDevice = "honeypot-server";
let targetDeviceId = "<DEVICE_ID_FROM_STEP_3A>";
let start = datetime(2025-12-12);
let end = datetime(2025-12-14);

let relevantAlerts = SecurityAlert
| where TimeGenerated between (start .. end)
| where Entities has targetDevice or Entities has targetDeviceId
| summarize arg_max(TimeGenerated, *) by SystemAlertId
| project SystemAlertId, AlertName, AlertSeverity, ProviderName, Tactics;

SecurityIncident
| where CreatedTime between (start .. end)
| summarize arg_max(TimeGenerated, *) by ProviderIncidentId
| project ProviderIncidentId, Title, Severity, Status, Classification, CreatedTime, LastModifiedTime, Owner, AdditionalData, AlertIds, Labels
| where not(tostring(Labels) has "Redirected")
| mv-expand AlertId = AlertIds
| extend AlertId = tostring(AlertId)
| join kind=inner relevantAlerts on $left.AlertId == $right.SystemAlertId
| extend ProviderIncidentUrl = tostring(AdditionalData.providerIncidentUrl)
| extend OwnerUPN = tostring(Owner.userPrincipalName)
| extend LastModifiedTime = todatetime(LastModifiedTime)
| summarize 
    Title = any(Title),
    Severity = any(Severity),
    Status = any(Status),
    Classification = any(Classification),
    CreatedTime = any(CreatedTime),
    LastModifiedTime = any(LastModifiedTime),
    OwnerUPN = any(OwnerUPN),
    ProviderIncidentUrl = any(ProviderIncidentUrl),
    AlertCount = count(),
    MitreTactics = make_set(Tactics)
    by ProviderIncidentId
| order by LastModifiedTime desc
| take 10
```

**Incident Filtering Logic:**

Only report as threats:
- Status = "New" or "Active"
- Classification NOT "BenignPositive"

Closed incidents with Classification = "BenignPositive" represent **expected honeypot activity** (not security threats).

---

### Phase 4: Vulnerability Assessment

**Objective**: Assess honeypot vulnerabilities and cross-reference with observed exploitation attempts.

#### Step 4A: Activate Advanced Hunting Tools

```python
activate_advanced_hunting_tools()
```

#### Step 4B: Get MDE Machine ID

**CRITICAL**: Microsoft Defender for Endpoint uses a different machine ID format (GUID) than Sentinel's DeviceId (SHA1 hash).

```kql
DeviceInfo 
| where DeviceName =~ 'honeypot-server' 
| summarize arg_max(Timestamp, *) 
| project DeviceId, DeviceName, OSPlatform, OSVersion, PublicIP
```

Extract the **GUID-format DeviceId** from this result.

#### Step 4C: Activate Security Alert Tools

```python
activate_security_alert_and_incident_management_tools()
```

#### Step 4D: Query Vulnerabilities

```python
mcp_sentinel-tria_GetDefenderMachineVulnerabilities({"id": "<MDE_MACHINE_ID>"})
```

**Vulnerability Data Collected:**
- CVE ID
- Severity (Critical/High/Medium/Low)
- CVSS Score
- Affected Product/Component
- Exploit Availability (public exploit exists?)
- Publicly Disclosed (yes/no)

---

### Phase 5: Generate Executive Report

**Template**: See [Report Generation](#report-generation) section below.

**Key Report Sections:**

1. **Executive Summary** (3 paragraphs)
   - Attack overview with quantitative metrics
   - Threat intelligence correlation findings
   - Vulnerability context and honeypot value

2. **Attack Surface Analysis**
   - Failed connections by source IP
   - Geographic distribution
   - Attack volume statistics

3. **Threat Intelligence Correlation**
   - IPs matched in threat intelligence feeds
   - High-confidence malicious indicators
   - APT/threat actor attribution

4. **Security Incidents**
   - Active incidents requiring investigation
   - Closed incidents (benign honeypot activity)
   - Detection effectiveness assessment

5. **Attack Pattern Analysis**
   - Targeted services and ports
   - Exploitation techniques (CVE references)
   - MITRE ATT&CK mapping

6. **Vulnerability Status**
   - Critical and high severity CVEs
   - Cross-reference with observed exploitation
   - Patching prioritization

7. **Key Detection Insights**
   - Novel indicators discovered
   - Attack sophistication assessment
   - Threat actor infrastructure analysis

8. **Honeypot Effectiveness**
   - Detection capability metrics
   - Threat intelligence value delivered
   - Optimization recommendations

---

## Query Library

### Additional Honeypot Analysis Queries

#### Top Targeted User Accounts

```kql
let start = datetime(2025-12-12);
let end = datetime(2025-12-14);
let honeypot = 'honeypot-server';

SecurityEvent
| where TimeGenerated between (start .. end)
| where Computer =~ honeypot
| where EventID == 4625
| summarize FailedAttempts = count() by Account
| order by FailedAttempts desc
| take 20
```

**Purpose**: Identify credential attack patterns (common usernames, service accounts, default credentials).

#### Web Exploitation Patterns

```kql
let start = datetime(2025-12-12);
let end = datetime(2025-12-14);
let honeypot = 'honeypot-server';

W3CIISLog
| where TimeGenerated between (start .. end)
| where Computer =~ honeypot
| where csUriStem has_any ("'", "union", "select", "script", "../", "..\\", "cmd.exe", "powershell")
| summarize 
    AttemptCount = count(),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    UniqueIPs = dcount(cIP)
    by ExploitPattern = case(
        csUriStem has_any ("'", "union", "select"), "SQL Injection",
        csUriStem has "script", "XSS",
        csUriStem has_any ("../", "..\\"), "Path Traversal",
        csUriStem has_any ("cmd.exe", "powershell"), "Command Injection",
        "Other")
| order by AttemptCount desc
```

**Purpose**: Categorize web exploitation techniques and identify CVE-specific payloads.

#### Port Scanning Detection

```kql
let start = datetime(2025-12-12);
let end = datetime(2025-12-14);
let honeypot = 'honeypot-server';

DeviceNetworkEvents
| where TimeGenerated between (start .. end)
| where DeviceName =~ honeypot
| summarize 
    DistinctPorts = dcount(RemotePort),
    PortsScanned = make_set(RemotePort),
    EventCount = count()
    by RemoteIP
| where DistinctPorts >= 5
| order by DistinctPorts desc
| take 20
```

**Purpose**: Detect reconnaissance activity from IPs scanning multiple ports.

#### Brute Force Detection

```kql
let start = datetime(2025-12-12);
let end = datetime(2025-12-14);
let honeypot = 'honeypot-server';
let threshold = 50;

SecurityEvent
| where TimeGenerated between (start .. end)
| where Computer =~ honeypot
| where EventID == 4625
| extend IpAddress = extract(@"Source Network Address:\s+([^\s]+)", 1, tostring(EventData))
| summarize FailedAttempts = count() by IpAddress
| where FailedAttempts >= threshold
| order by FailedAttempts desc
```

**Purpose**: Identify high-volume brute force attacks exceeding defined thresholds.

---

## IP Enrichment Process

### Enrichment Script Architecture

**File**: `enrich_ips.py`  
**Input Format**: JSON array of IP addresses  
**Output**: Enriched IP data with multiple intelligence sources

#### Enrichment Sources

1. **ipinfo.io**
   - Geolocation (city, region, country)
   - ASN and organization
   - Company type (hosting, isp, business)
   - Privacy detection (VPN, proxy, Tor, relay)

2. **vpnapi.io**
   - VPN endpoint detection
   - Security risk scoring
   - Network type classification

3. **AbuseIPDB**
   - Community-reported abuse
   - Abuse confidence score (0-100)
   - Total reports count
   - Whitelisted status

4. **Sentinel Threat Intelligence**
   - STIX/TAXII indicators
   - Microsoft Threat Intelligence (MSTIC)
   - Activity group attribution

#### Enrichment Output Format

```json
{
  "ip": "203.0.113.42",
  "city": "Singapore",
  "region": "Singapore",
  "country": "SG",
  "org": "AS12345 Example Hosting Ltd",
  "asn": "AS12345",
  "timezone": "Asia/Singapore",
  "risk_level": "HIGH",
  "assessment": "⚠️ Threat Intelligence Match: Commercial VPN Service Detected",
  "is_vpn": true,
  "is_proxy": false,
  "is_tor": false,
  "abuse_confidence_score": 0,
  "total_reports": 2,
  "is_whitelisted": false,
  "threat_description": "Commercial VPN Service: Known Anonymization Infrastructure",
  "threat_detected": false,
  "threat_confidence": 0,
  "threat_tlp_level": "",
  "threat_activity_groups": ""
}
```

#### Risk Level Classification

| Risk Level | Criteria |
|------------|----------|
| **CRITICAL** | Threat intelligence match + High abuse score (≥75) |
| **HIGH** | Threat intelligence match OR Abuse score ≥75 OR Tor exit node |
| **MEDIUM** | VPN/Proxy + Moderate abuse (25-74) OR Abuse score ≥25 |
| **LOW** | Clean reputation + Residential ISP |

---

## Report Generation

### Executive Report Structure

#### Section 1: Executive Summary

**Format**: 3 comprehensive paragraphs covering:

**Paragraph 1 - Attack Overview & Threat Intelligence:**
- Total unique attacking IPs (use full count from Phase 1)
- Geographic distribution statistics
- Threat intelligence hit rate (percentage)
- Security incidents summary
- Brief attack pattern mention

**Example:**
```
The honeypot-server honeypot successfully attracted and logged 487 unique attackers 
over a 48-hour period, capturing 12,456 attack attempts spanning credential brute 
force, web exploitation, and network reconnaissance. The honeypot's threat intelligence 
value is exceptional, with 78% of prioritized attackers (12 of 15 IPs) matching known 
malicious indicators at 100% confidence levels, and the discovery of 3 novel malicious 
IPs not previously cataloged. Attack patterns reveal opportunistic mass scanning from 
bulletproof hosting providers rather than targeted APT operations.
```

**Paragraph 2 - Attack Landscape & Tactics:**
- Dominant attack vectors with quantitative details
- Sophisticated pattern highlights
- Attacker behavior patterns
- Active incidents requiring investigation

**Paragraph 3 - Vulnerability Context & Value Proposition:**
- Current vulnerability count and severity
- CVE cross-reference with exploitation attempts
- Exploitation risk assessment
- Honeypot value conclusion

**Key Metrics Table:**
```markdown
**Key Metrics:**
- **Total Attack Attempts:** 12,456
- **Unique Attacking IPs:** 487
- **Security Incidents Triggered:** 3 (1 active HIGH severity)
- **Known Malicious IPs (Threat Intel):** 12 of 15 (78%)
- **Current Vulnerabilities:** 2 HIGH, 5 MEDIUM
```

#### Section 2: Attack Surface Analysis

**Tables:**

1. **Windows Security Events (Failed Logons)**
   - Source IP with country (from enrichment)
   - Failed attempts count
   - Target accounts
   - Event type
   - First/Last seen timestamps

2. **IIS Web Server (HTTP Errors) - By Exploit Pattern**
   - Source IP with country
   - Request count
   - Targeted URIs (samples)
   - Status codes
   - First/Last seen timestamps
   - **Group by exploit pattern**: PHPUnit RCE, Webshell probes, Router exploits

3. **Network Traffic (Connection Failures)**
   - Source IP
   - Event count
   - Targeted ports
   - First/Last seen timestamps

**Analysis Subsections:**

- Geographic Distribution (top 10 countries)
- Top ASNs/Organizations (infrastructure context)
- VPN/Anonymization Summary (enrichment statistics)

#### Section 3: Threat Intelligence Correlation

**Tables:**

1. **Highest Confidence Threats (100% Confidence)**
   - IP Address
   - Threat Description
   - Confidence score
   - Valid Until date
   - TLP Level

2. **High Abuse Reputation (AbuseIPDB ≥100%)**
   - IP Address
   - Country
   - Organization
   - Total Reports
   - Attack Volume

**Analysis:**
- Threat intelligence match rate
- MSTIC honeypot indicators
- APT/threat actor attribution
- Bulletproof hosting provider patterns

#### Section 4: Security Incidents

**Format**: List each incident with details:

```markdown
### Incident #2325: Multiple failed sign-in attempts
- **Severity:** HIGH
- **Status:** ACTIVE (NEW)
- **Classification:** Undetermined
- **Created:** 2025-12-13T14:23:05Z
- **Last Modified:** 2025-12-13T18:45:12Z (4 hours ago)
- **Alerts:** 5 correlated alerts
- **MITRE Tactics:** CredentialAccess, InitialAccess
- **Owner:** Unassigned
- **Investigation Link:** [Open in Sentinel](https://...)

**Critical Finding:** Active HIGH severity incident with credential access tactics 
requires immediate investigation.
```

**Incident Analysis:**
- Classification breakdown
- Detection effectiveness
- False positive/benign positive rate

#### Section 5: Attack Pattern Analysis

**Subsections:**

1. **Most Targeted Services**
   - RDP (3389)
   - HTTP/HTTPS (80/443)
   - SMB (445)
   - SSH (22)
   - FTP (21)

2. **Credential Attack Patterns**
   - Most targeted accounts
   - Brute force detection
   - Attack persistence

3. **Web Exploitation Attempts**
   - Exploit types (SQL injection, XSS, path traversal, command injection)
   - CVE references (PHPUnit CVE-2017-9841, Struts2 CVE-2017-5638)
   - Sample attack payloads

4. **Port Scanning Activity**
   - IPs performing scans (≥5 ports)
   - Targeted port ranges

#### Section 6: Honeypot Vulnerability Status

**Format:**

```markdown
**Last Vulnerability Scan:** 2025-12-14T12:34:56Z  
**Device ID:** abc123def456  
**OS Platform:** Windows Server 2022 (Build 20348)  
**Public IP:** 203.0.113.10

### Critical & High Severity Vulnerabilities

**Total Critical CVEs:** 2  
**Total High CVEs:** 5

| CVE ID | Severity | CVSS Score | Affected Product | Exploit Available | Publicly Disclosed |
|--------|----------|------------|------------------|-------------------|-------------------|
| CVE-2023-XXXXX | Critical | 9.8 | Product X | Yes | Yes |
```

**Cross-Reference with Attack Patterns:**
- Assess if observed attacks targeted identified CVEs
- Prioritize patching based on active exploitation attempts

#### Section 7: Key Detection Insights

**Subsections:**

1. **MITRE ATT&CK Mapping**

| Tactic | Technique | Evidence | IPs Involved |
|--------|-----------|----------|--------------|
| **Reconnaissance** | T1595.001 - Active Scanning: Scanning IP Blocks | Port scanning (TCP, 15+ ports) | 203.0.113.42 (487 attempts) |
| **Initial Access** | T1190 - Exploit Public-Facing Application | PHPUnit CVE-2017-9841 | 198.51.100.10 (44 requests) |

2. **Attack Timeline**
   - Initial reconnaissance phase (time range)
   - Exploitation attempts phase (time range)
   - Persistence/lateral movement indicators

3. **Sophistication Assessment**
   - Low sophistication (automated scanners)
   - Medium sophistication (targeted attacks with evasion)
   - High sophistication (multi-stage campaigns)

#### Section 8: Honeypot Effectiveness

**Metrics:**

```markdown
**Detection Capability:**
- **Unique Attacking IPs Logged:** 487
- **Security Incidents Generated:** 3
- **Coverage Percentage:** 0.6% (3 incidents / 487 attackers)
- **False Negatives:** High (most attacks did not trigger incidents)

**Threat Intelligence Value:**
- **Novel IPs Discovered:** 3
- **Known Threat Actor IPs Confirmed:** 12 (78% match rate)
- **Enrichment Success Rate:** 100% (15/15 prioritized IPs)
```

**Recommendations:**

1. **Service Exposure Adjustments**
2. **Detection Rule Tuning**
3. **IOC Integration**
4. **Vulnerability Management**
5. **Logging Enhancements**

#### Section 9: Conclusion

**Summary** (2-3 paragraphs):
- Overall threat landscape assessment
- Most significant findings
- Incident detection effectiveness
- Honeypot value proposition

**Key Takeaways** (3-5 bullet points):
- Primary finding with quantitative data
- Secondary finding
- Tertiary finding

**Next Steps:**

- **Immediate Actions (0-24 hours)**
- **Short-Term Actions (1-7 days)**
- **Long-Term Improvements (1-4 weeks)**

---

## Best Practices

### Investigation Execution

1. **Always Calculate Date Ranges Correctly**
   - Use current date from context
   - Apply +2 day rule for real-time searches
   - Example: Current = Dec 14, Last 48 hours = Dec 12 to Dec 16

2. **Parallel Query Execution**
   - Run all independent queries simultaneously
   - Reduces investigation time from 3+ minutes to ~60 seconds
   - Phase 1 queries (SecurityEvent, W3CIISLog, DeviceNetworkEvents) can run in parallel

3. **IP Prioritization**
   - Don't enrich all IPs (reduces API costs and token consumption)
   - Select top 10-15 by attack volume
   - Document total count separately for statistics

4. **Time Tracking**
   - Report elapsed time after EVERY phase (mandatory)
   - Use actual timestamps from tool outputs
   - Provide comprehensive timeline at completion

5. **Token Management**
   - Use `create_file` tool for all output (NEVER echo content in chat)
   - Save intermediate results to temp/ for debugging
   - Avoid including large datasets in responses

### Report Quality

1. **Quantitative Analysis**
   - Always include specific counts and percentages
   - Example: "78% of prioritized IPs (12 of 15)" not "most IPs"

2. **CVE References**
   - Cite specific CVE IDs with product names
   - Example: "PHPUnit RCE (CVE-2017-9841)" not "PHPUnit vulnerability"

3. **Risk Assessment**
   - Use enrichment data for context (VPN, abuse scores, threat intel)
   - Don't assume VPN = malicious (check abuse confidence score)

4. **Incident Classification**
   - Distinguish between active threats and benign honeypot activity
   - Status="Closed" + Classification="BenignPositive" = Expected behavior

5. **Actionable Recommendations**
   - Prioritize based on active exploitation attempts
   - Include specific incident numbers, CVE IDs, IP addresses
   - Provide 3 tiers: Immediate (0-24h), Short-Term (1-7d), Long-Term (1-4wk)

---

## Troubleshooting

### Common Issues

| Issue | Cause | Solution |
|-------|-------|----------|
| **No results from SecurityEvent** | Device not sending Windows Security logs | Verify log forwarding configuration; check EventHub connectivity |
| **Missing honeypot in DeviceInfo** | Device name mismatch | Try `contains` instead of `=~`; check Defender enrollment status |
| **W3CIISLog table not found** | IIS logging not enabled | Enable IIS logging; verify ingestion to Sentinel |
| **IP enrichment script fails** | Missing API token or network issues | Check `config.json` for ipinfo token; verify internet connectivity |
| **Date range returns empty results** | Incorrect date calculation | Verify current date from context; apply +2 day rule correctly |
| **KQL query timeout** | Query too broad or table too large | Reduce `take` limit; narrow time range; add early filters |
| **MDE Machine ID not found** | Using wrong DeviceId format | Use Advanced Hunting to get GUID-format MDE ID (not Sentinel SHA1 hash) |

### Validation Checklist

Before delivering report, verify:

- ✅ All phase timestamps reported to user
- ✅ Total elapsed time calculated and displayed
- ✅ IP enrichment data merged with attack logs
- ✅ Incident filtering correctly applied (only honeypot-related)
- ✅ Vulnerability data retrieved (or documented as unavailable)
- ✅ Report saved to: `reports/Honeypot_Executive_Report_<hostname>_<timestamp>.md`
- ✅ Absolute file path returned to user
- ✅ CVE references include product names
- ✅ Quantitative metrics throughout (not vague statements)
- ✅ MITRE ATT&CK techniques cited with evidence

### Error Messages

| Error | Meaning | Fix |
|-------|---------|-----|
| `TypeError: 'NoneType' object is not subscriptable` | Missing expected field in API response | Add null checks; use default values |
| `SemanticError: Failed to resolve column 'IpAddress'` | Field name typo or wrong table | Verify field exists with `| take 1` query first |
| `ipinfo.io API error 429` | Rate limit exceeded | Add delays between requests; reduce batch size |
| `Device not found in DeviceInfo` | Stale device record | Extend time range: `TimeGenerated > ago(90d)` |

---

## Appendix

### Date Range Calculation Examples

**Current Date**: December 14, 2025

| User Request | Start Date | End Date | Rule Applied |
|--------------|------------|----------|--------------|
| "Last 48 hours" | 2025-12-12 | 2025-12-16 | Real-time (+2 days) |
| "Last 7 days" | 2025-12-07 | 2025-12-16 | Real-time (+2 days) |
| "Dec 10-12" | 2025-12-10 | 2025-12-13 | Historical (+1 day) |

### Sample Investigation Timeline

```
[00:12] ✓ Failed connection queries completed (12 seconds) - 487 unique IPs identified, top 15 prioritized for enrichment
[00:15] ✓ IPs extracted and saved to temp/honeypot_ips_20251214_103245.json (3 seconds)
[02:48] ✓ IP enrichment completed (153 seconds) - 12 IPs flagged in threat intelligence (100% confidence)
[02:51] ✓ Security incidents query completed (3 seconds) - 3 incidents found (1 active HIGH, 2 closed)
[03:24] ✓ Vulnerability scan completed (33 seconds) - 14 CVEs found (2 CRITICAL, 5 HIGH)
[05:39] ✓ Report generated (135 seconds)

Total Investigation Time: 5 minutes 39 seconds (339 seconds)
```

### File Naming Conventions

| File Type | Naming Pattern | Example |
|-----------|----------------|---------|
| **IP List (Temp)** | `temp/honeypot_ips_<timestamp>.json` | `temp/honeypot_ips_20251214_103245.json` |
| **Investigation Data (Temp)** | `temp/honeypot_data_<timestamp>.json` | `temp/honeypot_data_20251214_103245.json` |
| **Executive Report** | `reports/Honeypot_Executive_Report_<hostname>_<YYYY-MM-DD>.md` | `reports/Honeypot_Executive_Report_honeypot-server_2025-12-14.md` |

### Reference Links

- **Main Copilot Instructions**: [.github/copilot-instructions.md](../.github/copilot-instructions.md)
- **Honeypot Agent Instructions**: [agents/honeypotInvestigation/AGENTS.md](../agents/honeypotInvestigation/AGENTS.md)
- **IP Enrichment Utility**: [enrich_ips.py](../enrich_ips.py)
- **Report Generator**: [generate_report_from_json.py](../generate_report_from_json.py)

### Glossary

| Term | Definition |
|------|------------|
| **Honeypot** | Decoy system designed to attract and log malicious activity for threat intelligence collection |
| **IOC** | Indicator of Compromise - artifacts observed that indicate potential intrusion |
| **TTP** | Tactics, Techniques, and Procedures - patterns of attacker behavior |
| **MITRE ATT&CK** | Framework for categorizing adversary tactics and techniques |
| **APT** | Advanced Persistent Threat - sophisticated, long-term threat actor |
| **CVE** | Common Vulnerabilities and Exposures - standardized vulnerability identifiers |
| **CVSS** | Common Vulnerability Scoring System - severity rating (0-10) |
| **TLP** | Traffic Light Protocol - sensitivity classification (White/Green/Amber/Red) |
| **STIX** | Structured Threat Information eXpression - threat intel sharing format |
| **TAXII** | Trusted Automated eXchange of Intelligence Information - transport protocol |

---

**Document Classification:** INTERNAL USE  
**Distribution:** Security Operations, Threat Intelligence, Incident Response  
**Retention:** Retain per organizational policy  
**Next Review:** Quarterly or after significant process changes

---

*This documentation was created for the Security Investigator honeypot investigation automation system. For technical support or questions, contact the Security Operations team.*
