{
  "Name": "HoneyLabs",
  "Author": "HoneyLabs - info@honeylabs.net",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/HoneyLabs.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The [HoneyLabs](https://honeylabs.net) solution for Microsoft Sentinel ingests threat intelligence generated by internet-facing honeypot sensors: source IPs observed running exploit or loader commands, and the malware infrastructure (loader and C2 URLs) extracted from the captured payloads. Indicators are evidence-backed rather than scan-derived, exclude known research scanners (Shadowserver, Censys and similar), and expire automatically as activity stops. Ingestion uses Microsoft Sentinel's built-in **Threat Intelligence - TAXII** data connector against the HoneyLabs TAXII 2.1 server; a free HoneyLabs API key is the only prerequisite. The solution also includes analytic rules that match the indicators against your own logs and a playbook that enriches incidents with the full HoneyLabs report for any IP entity.\n\n[Get a free API key](https://honeylabs.net/dashboard?src=sentinel) | [Integration guide](https://honeylabs.net/integrations/sentinel) | [Methodology](https://honeylabs.net/methodology)",
  "AnalyticalRuleBladeDescription": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in Manage solution view.",
  "Workbooks": [
    "Workbooks/HoneyLabsThreatIntelligence.json"
  ],
  "Analytic Rules": [
    "Analytic Rules/HoneyLabsTIMapIPEntityAsimNetworkSession.yaml",
    "Analytic Rules/HoneyLabsTIMapIPEntityCommonSecurityLog.yaml",
    "Analytic Rules/HoneyLabsTIMapIPEntitySigninLogs.yaml",
    "Analytic Rules/HoneyLabsTIMapURLEntityCommonSecurityLog.yaml"
  ],
  "Data Connectors": [],
  "Playbooks": [
    "Playbooks/HoneyLabs-EnrichIncident-IP/azuredeploy.json"
  ],
  "Parsers": [],
  "SavedSearches": [],
  "Hunting Queries": [
    "Hunting Queries/HoneyLabsCveProberContact.yaml",
    "Hunting Queries/HoneyLabsFirstContactHighConfidence.yaml",
    "Hunting Queries/HoneyLabsLoaderUrlContact.yaml",
    "Hunting Queries/HoneyLabsRepeatedContactAcrossHosts.yaml"
  ],
  "Watchlists": [],
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\HoneyLabs",
  "Version": "3.0.0",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true,
  "Is1PConnector": false,
  "WorkbookBladeDescription": "This Microsoft Sentinel solution installs a workbook that visualises HoneyLabs indicator volume, confidence bands and any matches against your own logs.",
  "HuntingQueryBladeDescription": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view.",
  "WorkbookDescription": [
    "Indicator volume and freshness from the HoneyLabs TAXII feed, matches against your own telemetry, and a breakdown by source ASN, country, targeted port and probed CVE."
  ]
}