Identifying which sensor is which

[Oscar-Geare]

Hello,

I have a hive installation with sensors in different network segments. I have cowrie deployed to them, and I'm looking on Kibana at the data. I see there is a "sensor" data field which gives me an ID. How can I associate this with the sensors I have deployed?

Additionally, for both sensors the tpot_hostname field bot appears as the Hive hostname. Is this intended or have I messed something up?

[dmille6]

you should have a "hostname" in the kibana name, and a source/destination IP. between those 3, you should be able to determine which sensor is which

[Oscar-Geare]

Thank you. I thought it was unnecessary when deploying as I do not need the HIVE to be contacted on multiple IP Addresses, only one.

[t3chn0m4g3]

Did that IP change at some point or is a NAT involved?

[Oscar-Geare]

No, the IP has not changed. However, the resource is deployed on Azure as I've just been testing as a POC. It should have its own static, public, IP address.

[t3chn0m4g3]

Thanks, hope everything works now

[dmille6]

@t3chn0m4g3 thanks for the quick response and spending the time to build out a test. I'll dig in deeper on my end. i thew something together too.. probably got the cert wrong so I'm only getting stuff from the hive server.