extraction of payloads into ElasticSearch

[mlodic]

hey guys how are you? :)

Last day I was looking for a chance to automatically extract payloads from adbhoney and cowrie so that I can feed other platforms like IntelOwl.

Correct me if I am wrong: right now, those payloads can be found only in the /data/<honeypot> folders.

I thought about adding a logstash parser here to extract those payload from the file system and push a new document for each payload in Elastic with the base64 or hex encoded payload.

In that way it would be possible to use ElasticSearch to extract them and maybe add them into GreedyBear too as an additional feed.

Does it make sense to you? If yes, we could try doing that and open a PR to the project?

Looking forward to meet you at the next workshop :)