MokN - Baits

Overview

Vendor: MokN
Supported environment: SaaS
Detection based on: Telemetry
Supported application or feature:
- Bait attempts
- Credential exposure context
- Attempt follow-up actions

MokN helps detect malicious authentication activity by exposing login attempts captured on bait services. This integration polls MokN bait attempts from the MokN API and forwards them to Sekoia.io as normalized events.

The integration also provides response actions so analysts can interact with an attempt directly from automation:

Add or update the comment attached to an attempt
Request a credential check for a specific attempt

Configure

Prerequisites

To use this integration, you need:

A MokN tenant URL
A MokN API token with access to bait attempts
Access to create an intake and configure automation in Sekoia.io

Create an API key in MokN

In MokN, go to Settings
Open API
Click Create API KEY
Enter a name for the API key
Assign a role
Copy the API key

Create your intake

Go to your Sekoia.io Intakes page, and follow these steps:

Click + Intake
Choose MokN - Baits
Give the intake a name and select the relevant Entity
Enter the MokN tenant base URL in the Base Url field
Enter the MokN API token in the Api Token field
Keep Verify Ssl enabled unless your environment requires otherwise

Configure the polling trigger

Once the module is configured, create and start the trigger Fetch MokN Login Attempts.

The trigger supports the following main options:

frequency: Polling interval in seconds
page_size: Number of attempts fetched per request
initial_lookback_minutes: Initial lookback used when no checkpoint exists yet
threat_levels: Threat levels to include in the query
pending: Restrict collection to pending attempts only
statuses: List of MokN status codes to include in the polling query

Event content

Collected events include the main attempt metadata exposed by MokN, including:

Attempt identifiers and timestamps
Username and password submitted to the bait
Source IP address and geographic context
HTTP headers and user-agent
JA4H fingerprint when available
Attacker reputation and attempt counters
Credential leak context
Credential check history

The integration emits MokN bait attempts with the event action mokn_bait_attempt and the dataset mokn.bait_attempt.

Instruction on Sekoia

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

mokn_bait_high_severitymokn_bait_loginmokn_bait_medium_severitymokn_bait_no_leaksmokn_bait_opportunisticmokn_bait_plain_username

{
    "event_type": "mokn_bait_attempt",
    "id": 4,
    "date": "2026-04-17T14:20:00+00:00",
    "updated_time": "2026-04-17T14:20:00+00:00",
    "bait_name": "SSH Honeypot",
    "username": "root@example.com",
    "password": "toor",
    "is_targeted": true,
    "comment": "",
    "type": "Targeted",
    "identification": "SSH",
    "status": 9,
    "threat_level": "HIGH",
    "attack": {
        "ip": "192.0.2.20",
        "country": "Russia",
        "country_code": "RU",
        "ja4h": "ja4h-ssh-1",
        "user_agent": "GenericBrowser/1.0",
        "headers": [
            [
                "Host",
                "example.com"
            ],
            [
                "Referer",
                "https://example.com/ssh"
            ]
        ],
        "opportunistic_patterns": [
            {
                "name": "brute_force",
                "threat_level_setting": "HIGH"
            }
        ],
        "reputation": "Malicious",
        "total_attempts": 200,
        "total_targeted_attempts": 200
    },
    "leaks": [
        {
            "site": "darkweb_dump.txt",
            "date": "2025-03-01T00:00:00+00:00"
        }
    ]
}

{
    "event_type": "mokn_bait_attempt",
    "id": 1,
    "date": "2026-04-14T12:45:54+00:00",
    "updated_time": "2026-04-14T12:45:54+00:00",
    "bait_name": "App Portal",
    "username": "User3@example.com",
    "password": "password-example-3",
    "is_targeted": true,
    "comment": "",
    "type": "Targeted",
    "identification": "App Connector",
    "status": 9,
    "threat_level": "LOW",
    "attack": {
        "ip": "198.51.100.42",
        "country": "Germany",
        "country_code": "DE",
        "ja4h": "sample-ja4h",
        "user_agent": "GenericBrowser/1.0",
        "headers": [
            [
                "Host",
                "example.com"
            ],
            [
                "Origin",
                "https://example.com"
            ],
            [
                "Referer",
                "https://example.com/login"
            ],
            [
                "X-Forwarded-For",
                "198.51.100.42"
            ]
        ],
        "opportunistic_patterns": [
            {
                "name": "has_leaked",
                "threat_level_setting": "HIGH"
            }
        ],
        "reputation": "Malicious",
        "total_attempts": 12,
        "total_targeted_attempts": 12
    },
    "leaks": [
        {
            "site": "random_source_a.txt",
            "date": "2024-07-18T00:00:00+00:00"
        },
        {
            "site": "random_source_b.zip",
            "date": "2023-11-02T00:00:00+00:00"
        }
    ]
}

{
    "event_type": "mokn_bait_attempt",
    "id": 5,
    "date": "2026-04-18T11:15:00+00:00",
    "updated_time": "2026-04-18T11:15:00+00:00",
    "bait_name": "VPN Portal",
    "username": "user1@example.com",
    "password": "VpnPass123",
    "is_targeted": true,
    "comment": "",
    "type": "Targeted",
    "identification": "VPN",
    "status": 7,
    "threat_level": "MEDIUM",
    "attack": {
        "ip": "192.0.2.30",
        "country": "China",
        "country_code": "CN",
        "ja4h": "ja4h-vpn-1",
        "user_agent": "GenericBrowser/1.0",
        "headers": [
            [
                "Host",
                "example.com"
            ],
            [
                "Referer",
                "https://example.com/vpn"
            ]
        ],
        "opportunistic_patterns": [
            {
                "name": "credential_stuffing",
                "threat_level_setting": "MEDIUM"
            }
        ],
        "reputation": "Suspicious",
        "total_attempts": 30,
        "total_targeted_attempts": 30
    },
    "leaks": [
        {
            "site": "combo_list.txt",
            "date": "2024-06-15T00:00:00+00:00"
        }
    ]
}

{
    "event_type": "mokn_bait_attempt",
    "id": 2,
    "date": "2026-04-15T10:00:00+00:00",
    "updated_time": "2026-04-15T10:00:00+00:00",
    "bait_name": "DB Admin",
    "username": "admin@example.com",
    "password": "Summer2024!",
    "is_targeted": true,
    "comment": "",
    "type": "Targeted",
    "identification": "Database",
    "status": 5,
    "threat_level": "LOW",
    "attack": {
        "ip": "192.0.2.10",
        "country": "France",
        "country_code": "FR",
        "ja4h": "ja4h-db-1",
        "user_agent": "GenericBrowser/1.0",
        "headers": [
            [
                "Host",
                "example.com"
            ],
            [
                "Referer",
                "https://example.com/admin"
            ]
        ],
        "opportunistic_patterns": [
            {
                "name": "sql_injection",
                "threat_level_setting": "MEDIUM"
            }
        ],
        "reputation": "Suspicious",
        "total_attempts": 3,
        "total_targeted_attempts": 3
    },
    "leaks": []
}

{
    "event_type": "mokn_bait_attempt",
    "id": 3,
    "date": "2026-04-16T08:30:00+00:00",
    "updated_time": "2026-04-16T08:30:00+00:00",
    "bait_name": "File Share",
    "username": "user1@example.com",
    "password": "guest",
    "is_targeted": false,
    "comment": "",
    "type": "Opportunistic",
    "identification": "NAS",
    "status": 2,
    "threat_level": "LOW",
    "attack": {
        "ip": "203.0.113.5",
        "country": "Netherlands",
        "country_code": "NL",
        "ja4h": "ja4h-nas-1",
        "user_agent": "GenericBrowser/1.0",
        "headers": [
            [
                "Host",
                "example.com"
            ],
            [
                "Referer",
                "https://example.com/files"
            ]
        ],
        "opportunistic_patterns": [
            {
                "name": "default_creds",
                "threat_level_setting": "LOW"
            }
        ],
        "reputation": "Unknown",
        "total_attempts": 50,
        "total_targeted_attempts": 0
    },
    "leaks": [
        {
            "site": "breach_db.txt",
            "date": "2025-01-10T00:00:00+00:00"
        }
    ]
}

{
    "event_type": "mokn_bait_attempt",
    "id": 6,
    "date": "2026-04-19T16:45:00+00:00",
    "updated_time": "2026-04-19T16:45:00+00:00",
    "bait_name": "Internal Tool",
    "username": "user1",
    "password": "admin123",
    "is_targeted": false,
    "comment": "",
    "type": "Opportunistic",
    "identification": "Intranet",
    "status": 1,
    "threat_level": "LOW",
    "attack": {
        "ip": "203.0.113.15",
        "country": "United States",
        "country_code": "US",
        "ja4h": "ja4h-int-1",
        "user_agent": "GenericBrowser/1.0",
        "headers": [
            [
                "Host",
                "example.com"
            ],
            [
                "Referer",
                "https://example.com/tool"
            ]
        ],
        "opportunistic_patterns": [
            {
                "name": "default_creds",
                "threat_level_setting": "LOW"
            }
        ],
        "reputation": "Unknown",
        "total_attempts": 5,
        "total_targeted_attempts": 0
    },
    "leaks": []
}

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

No related built-in rules was found. This message is automatically generated.

Event Categories

The following table lists the data source offered by this integration.

Data Source	Description
`Authentication logs`	MokN captures login attempts observed on bait services

In details, the following table denotes the type of events produced by this integration.

Name	Values
Kind	`alert`
Category	`authentication`, `intrusion_detection`
Type	`info`

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

mokn_bait_high_severity.jsonmokn_bait_login.jsonmokn_bait_medium_severity.jsonmokn_bait_no_leaks.jsonmokn_bait_opportunistic.jsonmokn_bait_plain_username.json

{
    "message": "{\"event_type\":\"mokn_bait_attempt\",\"id\":4,\"date\":\"2026-04-17T14:20:00+00:00\",\"updated_time\":\"2026-04-17T14:20:00+00:00\",\"bait_name\":\"SSH Honeypot\",\"username\":\"root@example.com\",\"password\":\"toor\",\"is_targeted\":true,\"comment\":\"\",\"type\":\"Targeted\",\"identification\":\"SSH\",\"status\":9,\"threat_level\":\"HIGH\",\"attack\":{\"ip\":\"192.0.2.20\",\"country\":\"Russia\",\"country_code\":\"RU\",\"ja4h\":\"ja4h-ssh-1\",\"user_agent\":\"GenericBrowser/1.0\",\"headers\":[[\"Host\",\"example.com\"],[\"Referer\",\"https://example.com/ssh\"]],\"opportunistic_patterns\":[{\"name\":\"brute_force\",\"threat_level_setting\":\"HIGH\"}],\"reputation\":\"Malicious\",\"total_attempts\":200,\"total_targeted_attempts\":200},\"leaks\":[{\"site\":\"darkweb_dump.txt\",\"date\":\"2025-03-01T00:00:00+00:00\"}]}",
    "event": {
        "action": "bait login attempt",
        "category": [
            "authentication",
            "intrusion_detection"
        ],
        "dataset": "mokn.bait_attempt",
        "kind": "alert",
        "module": "mokn",
        "reason": "Targeted",
        "severity": 8,
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-04-17T14:20:00Z",
    "http": {
        "request": {
            "referrer": "https://example.com/ssh"
        }
    },
    "mokn": {
        "attacker_reputation": "Malicious",
        "attacker_total_attempts": 200,
        "attacker_total_targeted_attempts": 200,
        "first_leak_date": "2025-03-01T00:00:00+00:00",
        "first_leak_site": "darkweb_dump.txt",
        "id": 4,
        "identification": "SSH",
        "is_targeted": true,
        "ja4h": "ja4h-ssh-1",
        "leaks": [
            {
                "date": "2025-03-01T00:00:00+00:00",
                "site": "darkweb_dump.txt"
            }
        ],
        "opportunistic_pattern_names": "brute_force",
        "opportunistic_patterns": [
            {
                "name": "brute_force",
                "threat_level_setting": "HIGH"
            }
        ],
        "status": 9,
        "threat_level": "HIGH"
    },
    "observer": {
        "product": "Baits",
        "type": "honeypot",
        "vendor": "MokN"
    },
    "related": {
        "hosts": [
            "example.com"
        ],
        "ip": [
            "192.0.2.20"
        ],
        "user": [
            "root"
        ]
    },
    "rule": {
        "name": "SSH Honeypot"
    },
    "source": {
        "address": "192.0.2.20",
        "geo": {
            "country_iso_code": "RU",
            "country_name": "Russia"
        },
        "ip": "192.0.2.20"
    },
    "url": {
        "domain": "example.com",
        "registered_domain": "example.com",
        "top_level_domain": "com"
    },
    "user": {
        "email": "root@example.com",
        "name": "root"
    },
    "user_agent": {
        "device": {
            "name": "Generic Feature Phone"
        },
        "name": "Other",
        "original": "GenericBrowser/1.0",
        "os": {
            "name": "Other"
        }
    }
}

{
    "message": "{\"event_type\":\"mokn_bait_attempt\",\"id\":1,\"date\":\"2026-04-14T12:45:54+00:00\",\"updated_time\":\"2026-04-14T12:45:54+00:00\",\"bait_name\":\"App Portal\",\"username\":\"User3@example.com\",\"password\":\"password-example-3\",\"is_targeted\":true,\"comment\":\"\",\"type\":\"Targeted\",\"identification\":\"App Connector\",\"status\":9,\"threat_level\":\"LOW\",\"attack\":{\"ip\":\"198.51.100.42\",\"country\":\"Germany\",\"country_code\":\"DE\",\"ja4h\":\"sample-ja4h\",\"user_agent\":\"GenericBrowser/1.0\",\"headers\":[[\"Host\",\"example.com\"],[\"Origin\",\"https://example.com\"],[\"Referer\",\"https://example.com/login\"],[\"X-Forwarded-For\",\"198.51.100.42\"]],\"opportunistic_patterns\":[{\"name\":\"has_leaked\",\"threat_level_setting\":\"HIGH\"}],\"reputation\":\"Malicious\",\"total_attempts\":12,\"total_targeted_attempts\":12},\"leaks\":[{\"site\":\"random_source_a.txt\",\"date\":\"2024-07-18T00:00:00+00:00\"},{\"site\":\"random_source_b.zip\",\"date\":\"2023-11-02T00:00:00+00:00\"}]}",
    "event": {
        "action": "bait login attempt",
        "category": [
            "authentication",
            "intrusion_detection"
        ],
        "dataset": "mokn.bait_attempt",
        "kind": "alert",
        "module": "mokn",
        "reason": "Targeted",
        "severity": 3,
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-04-14T12:45:54Z",
    "http": {
        "request": {
            "referrer": "https://example.com/login"
        }
    },
    "mokn": {
        "attacker_reputation": "Malicious",
        "attacker_total_attempts": 12,
        "attacker_total_targeted_attempts": 12,
        "first_leak_date": "2023-11-02T00:00:00+00:00",
        "first_leak_site": "random_source_b.zip",
        "id": 1,
        "identification": "App Connector",
        "is_targeted": true,
        "ja4h": "sample-ja4h",
        "leaks": [
            {
                "date": "2024-07-18T00:00:00+00:00",
                "site": "random_source_a.txt"
            },
            {
                "date": "2023-11-02T00:00:00+00:00",
                "site": "random_source_b.zip"
            }
        ],
        "opportunistic_pattern_names": "has_leaked",
        "opportunistic_patterns": [
            {
                "name": "has_leaked",
                "threat_level_setting": "HIGH"
            }
        ],
        "status": 9,
        "threat_level": "LOW"
    },
    "observer": {
        "product": "Baits",
        "type": "honeypot",
        "vendor": "MokN"
    },
    "related": {
        "hosts": [
            "example.com"
        ],
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "User3"
        ]
    },
    "rule": {
        "name": "App Portal"
    },
    "source": {
        "address": "198.51.100.42",
        "geo": {
            "country_iso_code": "DE",
            "country_name": "Germany"
        },
        "ip": "198.51.100.42"
    },
    "url": {
        "domain": "example.com",
        "registered_domain": "example.com",
        "top_level_domain": "com"
    },
    "user": {
        "email": "User3@example.com",
        "name": "User3"
    },
    "user_agent": {
        "device": {
            "name": "Generic Feature Phone"
        },
        "name": "Other",
        "original": "GenericBrowser/1.0",
        "os": {
            "name": "Other"
        }
    }
}

{
    "message": "{\"event_type\":\"mokn_bait_attempt\",\"id\":5,\"date\":\"2026-04-18T11:15:00+00:00\",\"updated_time\":\"2026-04-18T11:15:00+00:00\",\"bait_name\":\"VPN Portal\",\"username\":\"user1@example.com\",\"password\":\"VpnPass123\",\"is_targeted\":true,\"comment\":\"\",\"type\":\"Targeted\",\"identification\":\"VPN\",\"status\":7,\"threat_level\":\"MEDIUM\",\"attack\":{\"ip\":\"192.0.2.30\",\"country\":\"China\",\"country_code\":\"CN\",\"ja4h\":\"ja4h-vpn-1\",\"user_agent\":\"GenericBrowser/1.0\",\"headers\":[[\"Host\",\"example.com\"],[\"Referer\",\"https://example.com/vpn\"]],\"opportunistic_patterns\":[{\"name\":\"credential_stuffing\",\"threat_level_setting\":\"MEDIUM\"}],\"reputation\":\"Suspicious\",\"total_attempts\":30,\"total_targeted_attempts\":30},\"leaks\":[{\"site\":\"combo_list.txt\",\"date\":\"2024-06-15T00:00:00+00:00\"}]}",
    "event": {
        "action": "bait login attempt",
        "category": [
            "authentication",
            "intrusion_detection"
        ],
        "dataset": "mokn.bait_attempt",
        "kind": "alert",
        "module": "mokn",
        "reason": "Targeted",
        "severity": 5,
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-04-18T11:15:00Z",
    "http": {
        "request": {
            "referrer": "https://example.com/vpn"
        }
    },
    "mokn": {
        "attacker_reputation": "Suspicious",
        "attacker_total_attempts": 30,
        "attacker_total_targeted_attempts": 30,
        "first_leak_date": "2024-06-15T00:00:00+00:00",
        "first_leak_site": "combo_list.txt",
        "id": 5,
        "identification": "VPN",
        "is_targeted": true,
        "ja4h": "ja4h-vpn-1",
        "leaks": [
            {
                "date": "2024-06-15T00:00:00+00:00",
                "site": "combo_list.txt"
            }
        ],
        "opportunistic_pattern_names": "credential_stuffing",
        "opportunistic_patterns": [
            {
                "name": "credential_stuffing",
                "threat_level_setting": "MEDIUM"
            }
        ],
        "status": 7,
        "threat_level": "MEDIUM"
    },
    "observer": {
        "product": "Baits",
        "type": "honeypot",
        "vendor": "MokN"
    },
    "related": {
        "hosts": [
            "example.com"
        ],
        "ip": [
            "192.0.2.30"
        ],
        "user": [
            "user1"
        ]
    },
    "rule": {
        "name": "VPN Portal"
    },
    "source": {
        "address": "192.0.2.30",
        "geo": {
            "country_iso_code": "CN",
            "country_name": "China"
        },
        "ip": "192.0.2.30"
    },
    "url": {
        "domain": "example.com",
        "registered_domain": "example.com",
        "top_level_domain": "com"
    },
    "user": {
        "email": "user1@example.com",
        "name": "user1"
    },
    "user_agent": {
        "device": {
            "name": "Generic Feature Phone"
        },
        "name": "Other",
        "original": "GenericBrowser/1.0",
        "os": {
            "name": "Other"
        }
    }
}

{
    "message": "{\"event_type\":\"mokn_bait_attempt\",\"id\":2,\"date\":\"2026-04-15T10:00:00+00:00\",\"updated_time\":\"2026-04-15T10:00:00+00:00\",\"bait_name\":\"DB Admin\",\"username\":\"admin@example.com\",\"password\":\"Summer2024!\",\"is_targeted\":true,\"comment\":\"\",\"type\":\"Targeted\",\"identification\":\"Database\",\"status\":5,\"threat_level\":\"LOW\",\"attack\":{\"ip\":\"192.0.2.10\",\"country\":\"France\",\"country_code\":\"FR\",\"ja4h\":\"ja4h-db-1\",\"user_agent\":\"GenericBrowser/1.0\",\"headers\":[[\"Host\",\"example.com\"],[\"Referer\",\"https://example.com/admin\"]],\"opportunistic_patterns\":[{\"name\":\"sql_injection\",\"threat_level_setting\":\"MEDIUM\"}],\"reputation\":\"Suspicious\",\"total_attempts\":3,\"total_targeted_attempts\":3},\"leaks\":[]}",
    "event": {
        "action": "bait login attempt",
        "category": [
            "authentication",
            "intrusion_detection"
        ],
        "dataset": "mokn.bait_attempt",
        "kind": "alert",
        "module": "mokn",
        "reason": "Targeted",
        "severity": 3,
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-04-15T10:00:00Z",
    "http": {
        "request": {
            "referrer": "https://example.com/admin"
        }
    },
    "mokn": {
        "attacker_reputation": "Suspicious",
        "attacker_total_attempts": 3,
        "attacker_total_targeted_attempts": 3,
        "id": 2,
        "identification": "Database",
        "is_targeted": true,
        "ja4h": "ja4h-db-1",
        "leaks": [],
        "opportunistic_pattern_names": "sql_injection",
        "opportunistic_patterns": [
            {
                "name": "sql_injection",
                "threat_level_setting": "MEDIUM"
            }
        ],
        "status": 5,
        "threat_level": "LOW"
    },
    "observer": {
        "product": "Baits",
        "type": "honeypot",
        "vendor": "MokN"
    },
    "related": {
        "hosts": [
            "example.com"
        ],
        "ip": [
            "192.0.2.10"
        ],
        "user": [
            "admin"
        ]
    },
    "rule": {
        "name": "DB Admin"
    },
    "source": {
        "address": "192.0.2.10",
        "geo": {
            "country_iso_code": "FR",
            "country_name": "France"
        },
        "ip": "192.0.2.10"
    },
    "url": {
        "domain": "example.com",
        "registered_domain": "example.com",
        "top_level_domain": "com"
    },
    "user": {
        "email": "admin@example.com",
        "name": "admin"
    },
    "user_agent": {
        "device": {
            "name": "Generic Feature Phone"
        },
        "name": "Other",
        "original": "GenericBrowser/1.0",
        "os": {
            "name": "Other"
        }
    }
}

{
    "message": "{\"event_type\":\"mokn_bait_attempt\",\"id\":3,\"date\":\"2026-04-16T08:30:00+00:00\",\"updated_time\":\"2026-04-16T08:30:00+00:00\",\"bait_name\":\"File Share\",\"username\":\"user1@example.com\",\"password\":\"guest\",\"is_targeted\":false,\"comment\":\"\",\"type\":\"Opportunistic\",\"identification\":\"NAS\",\"status\":2,\"threat_level\":\"LOW\",\"attack\":{\"ip\":\"203.0.113.5\",\"country\":\"Netherlands\",\"country_code\":\"NL\",\"ja4h\":\"ja4h-nas-1\",\"user_agent\":\"GenericBrowser/1.0\",\"headers\":[[\"Host\",\"example.com\"],[\"Referer\",\"https://example.com/files\"]],\"opportunistic_patterns\":[{\"name\":\"default_creds\",\"threat_level_setting\":\"LOW\"}],\"reputation\":\"Unknown\",\"total_attempts\":50,\"total_targeted_attempts\":0},\"leaks\":[{\"site\":\"breach_db.txt\",\"date\":\"2025-01-10T00:00:00+00:00\"}]}",
    "event": {
        "action": "bait login attempt",
        "category": [
            "authentication",
            "intrusion_detection"
        ],
        "dataset": "mokn.bait_attempt",
        "kind": "alert",
        "module": "mokn",
        "reason": "Opportunistic",
        "severity": 3,
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-04-16T08:30:00Z",
    "http": {
        "request": {
            "referrer": "https://example.com/files"
        }
    },
    "mokn": {
        "attacker_reputation": "Unknown",
        "attacker_total_attempts": 50,
        "attacker_total_targeted_attempts": 0,
        "first_leak_date": "2025-01-10T00:00:00+00:00",
        "first_leak_site": "breach_db.txt",
        "id": 3,
        "identification": "NAS",
        "is_targeted": false,
        "ja4h": "ja4h-nas-1",
        "leaks": [
            {
                "date": "2025-01-10T00:00:00+00:00",
                "site": "breach_db.txt"
            }
        ],
        "opportunistic_pattern_names": "default_creds",
        "opportunistic_patterns": [
            {
                "name": "default_creds",
                "threat_level_setting": "LOW"
            }
        ],
        "status": 2,
        "threat_level": "LOW"
    },
    "observer": {
        "product": "Baits",
        "type": "honeypot",
        "vendor": "MokN"
    },
    "related": {
        "hosts": [
            "example.com"
        ],
        "ip": [
            "203.0.113.5"
        ],
        "user": [
            "user1"
        ]
    },
    "rule": {
        "name": "File Share"
    },
    "source": {
        "address": "203.0.113.5",
        "geo": {
            "country_iso_code": "NL",
            "country_name": "Netherlands"
        },
        "ip": "203.0.113.5"
    },
    "url": {
        "domain": "example.com",
        "registered_domain": "example.com",
        "top_level_domain": "com"
    },
    "user": {
        "email": "user1@example.com",
        "name": "user1"
    },
    "user_agent": {
        "device": {
            "name": "Generic Feature Phone"
        },
        "name": "Other",
        "original": "GenericBrowser/1.0",
        "os": {
            "name": "Other"
        }
    }
}

{
    "message": "{\"event_type\":\"mokn_bait_attempt\",\"id\":6,\"date\":\"2026-04-19T16:45:00+00:00\",\"updated_time\":\"2026-04-19T16:45:00+00:00\",\"bait_name\":\"Internal Tool\",\"username\":\"user1\",\"password\":\"admin123\",\"is_targeted\":false,\"comment\":\"\",\"type\":\"Opportunistic\",\"identification\":\"Intranet\",\"status\":1,\"threat_level\":\"LOW\",\"attack\":{\"ip\":\"203.0.113.15\",\"country\":\"United States\",\"country_code\":\"US\",\"ja4h\":\"ja4h-int-1\",\"user_agent\":\"GenericBrowser/1.0\",\"headers\":[[\"Host\",\"example.com\"],[\"Referer\",\"https://example.com/tool\"]],\"opportunistic_patterns\":[{\"name\":\"default_creds\",\"threat_level_setting\":\"LOW\"}],\"reputation\":\"Unknown\",\"total_attempts\":5,\"total_targeted_attempts\":0},\"leaks\":[]}",
    "event": {
        "action": "bait login attempt",
        "category": [
            "authentication",
            "intrusion_detection"
        ],
        "dataset": "mokn.bait_attempt",
        "kind": "alert",
        "module": "mokn",
        "reason": "Opportunistic",
        "severity": 3,
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-04-19T16:45:00Z",
    "http": {
        "request": {
            "referrer": "https://example.com/tool"
        }
    },
    "mokn": {
        "attacker_reputation": "Unknown",
        "attacker_total_attempts": 5,
        "attacker_total_targeted_attempts": 0,
        "id": 6,
        "identification": "Intranet",
        "is_targeted": false,
        "ja4h": "ja4h-int-1",
        "leaks": [],
        "opportunistic_pattern_names": "default_creds",
        "opportunistic_patterns": [
            {
                "name": "default_creds",
                "threat_level_setting": "LOW"
            }
        ],
        "status": 1,
        "threat_level": "LOW"
    },
    "observer": {
        "product": "Baits",
        "type": "honeypot",
        "vendor": "MokN"
    },
    "related": {
        "hosts": [
            "example.com"
        ],
        "ip": [
            "203.0.113.15"
        ],
        "user": [
            "user1"
        ]
    },
    "rule": {
        "name": "Internal Tool"
    },
    "source": {
        "address": "203.0.113.15",
        "geo": {
            "country_iso_code": "US",
            "country_name": "United States"
        },
        "ip": "203.0.113.15"
    },
    "url": {
        "domain": "example.com",
        "registered_domain": "example.com",
        "top_level_domain": "com"
    },
    "user": {
        "name": "user1"
    },
    "user_agent": {
        "device": {
            "name": "Generic Feature Phone"
        },
        "name": "Other",
        "original": "GenericBrowser/1.0",
        "os": {
            "name": "Other"
        }
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name	Type	Description
`@timestamp`	`date`	Date/time when the event originated.
`event.action`	`keyword`	The action captured by the event.
`event.category`	`keyword`	Event category. The second categorization field in the hierarchy.
`event.dataset`	`keyword`	Name of the dataset.
`event.kind`	`keyword`	The kind of the event. The highest categorization field in the hierarchy.
`event.module`	`keyword`	Name of the module this data is coming from.
`event.reason`	`keyword`	Reason why this event happened, according to the source
`event.severity`	`long`	Numeric severity of the event.
`event.type`	`keyword`	Event type. The third categorization field in the hierarchy.
`http.request.referrer`	`keyword`	Referrer for this HTTP request.
`mokn.attacker_reputation`	`keyword`	Reputation associated with the attacker
`mokn.attacker_total_attempts`	`long`	Total number of attempts attributed to the attacker
`mokn.attacker_total_targeted_attempts`	`long`	Total number of targeted attempts attributed to the attacker
`mokn.first_leak_date`	`date`	Date when the credential was first seen leaked
`mokn.first_leak_site`	`keyword`	Site name where the credential was first seen leaked
`mokn.id`	`long`	MokN attempt identifier
`mokn.identification`	`keyword`	MokN identification associated with the bait login attempt
`mokn.is_targeted`	`boolean`	Whether MokN classified the bait login attempt as targeted
`mokn.ja4h`	`keyword`	JA4H fingerprint observed for the bait login attempt
`mokn.leaks`	`object`	Leak records associated with the bait login attempt
`mokn.opportunistic_pattern_names`	`keyword`	Human-readable list of opportunistic pattern names detected by MokN
`mokn.opportunistic_patterns`	`object`	Opportunistic patterns detected by MokN for the attacker
`mokn.status`	`long`	MokN status code for the bait login attempt
`mokn.threat_level`	`keyword`	MokN threat level associated with the bait login attempt
`observer.product`	`keyword`	The product name of the observer.
`observer.type`	`keyword`	The type of the observer the data is coming from.
`observer.vendor`	`keyword`	Vendor name of the observer.
`related.ip`	`ip`	All of the IPs seen on your event.
`related.user`	`keyword`	All the user names or other user identifiers seen on the event.
`rule.name`	`keyword`	Rule name
`source.address`	`keyword`	Source network address.
`source.geo.country_iso_code`	`keyword`	Country ISO code.
`source.geo.country_name`	`keyword`	Country name.
`source.ip`	`ip`	IP address of the source.
`url.domain`	`keyword`	Domain of the url.
`user.email`	`keyword`	User email address.
`user.name`	`keyword`	Short name or login of the user.
`user_agent.original`	`keyword`	Unparsed user_agent string.

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.