https://burnett.sh/tags/threat-intel/Recent content in Threat-Intel on Joshua's NotebookHugoenWed, 17 Jun 2026 10:00:00 -0500https://burnett.sh/posts/honeypi-enrich-ai/Wed, 17 Jun 2026 10:00:00 -0500https://burnett.sh/posts/honeypi-enrich-ai/<p>The <a href="https://burnett.sh/posts/honeypi-enrich-pi/">previous two</a> <a href="https://burnett.sh/posts/honeypi-enrich-mac/">posts</a> got all three streams into Loki, unified by <code>src_ip</code> and joinable by Community ID. That&rsquo;s a powerful dataset, but it has a problem: it&rsquo;s enormous. A single day produces tens of thousands of Cowrie events, thousands of Suricata alerts, and thousands of Zeek records. Nobody is reading that by hand every morning. This post covers the layer that makes the whole thing usable, a Python script that pulls the day&rsquo;s data, scores attackers by how interesting they are, and hands the most significant ones to Claude to write up as per-attacker narratives.</p>