search

mrheinen / lophiid

A distributed honeypot for monitoring large scale web attacks
GNU General Public License v2.0
7 stars 1 forks source link

XL: Keep track of unique requests and create AI descriptions for them #97

Open mrheinen opened 1 hour ago

mrheinen commented 1 hour ago

Requests have a base hash which is based on the static elements of the request and helps to distinguish between different type of requests with different purposes. We should create a table with these hashes and keep track of whether new ones are added (and surface them in the UI somewhere, possibly as events) so they can be triaged. Additionally this is the perfect place to add AI descriptions which can then also be surfaced in the UI with each request.

That would be step one. Step two would be to use the AI to also try and identify the application, vulnerability type and possibly exploited CVE.

mrheinen commented 1 hour ago

This work is tracked in the LLM branch