{"id":468,"date":"2026-01-08T01:08:00","date_gmt":"2026-01-08T01:08:00","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/"},"modified":"2026-01-08T01:08:00","modified_gmt":"2026-01-08T01:08:00","slug":"analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/","title":{"rendered":"Analysis using Gephi with DShield Sensor Data, (Wed, Jan 7th)"},"content":{"rendered":"
\n

I’m always looking for new ways of manipulating the data captured by my DShield sensor [1<\/a>]. This time I used Gephi [2<\/a>] and Graphiz [3<\/a>] a popular and powerful tool for visualizing and exploring relationships between nodes, to examine the relationship between the source IP, filename and which sensor got a copy of the file. I queried the past 30 days of data stored in my ELK [4<\/a>] database in Kibana using ES|QL [5<\/a>][6<\/a>] to query and export the data and import the result into Gephi.\u00a0<\/p>\n

This is the query I used to export the data I needed. Notice the field event.reference == “no match”<\/span> which is a tag that filters all the know researchers [7] added by Logstash as a tag.\u00a0<\/p>\n

Kibana ES|QL Query from Analytics \u2192\u00a0Discover<\/span><\/strong><\/p>\n

FROM cowrie*\u00a0
\n| WHERE event.reference == “no match”
\n| KEEP related.ip, file.name, host.name
\n| WHERE file.name IS NOT NULL
\n| LIMIT 10000<\/span><\/p>\n

\"\"<\/p>\n

This second example exports the source IP, file hash and filename. This query exported 2685 records for a period of 30 days of data.<\/p>\n

FROM cowrie*\u00a0
\n| WHERE event.reference == “no match”
\n| KEEP related.ip, related.hash, file.name
\n| WHERE file.name IS NOT NULL
\n| LIMIT 10000<\/span><\/p>\n

This screenshot shows one of the 2 groups of malware activity that contains various files. This is the first grouping of the files with multiple hashes and IP addresses for the same filename.\u00a0<\/p>\n

\"\"<\/p>\n

The second grouping of IPs, filename and hashes are all related to redtail malware.\u00a0<\/p>\n

\"\"<\/p>\n

One of the nice things with Gephi is where you can put the cursor on a specific type of activity to show the overall relationship from that point view and push the unselected data into the background. Using this graph and selecting with the cursor on IP 130.12.180.51 that uploaded several times (large blue arrow) shows the redtail malware by IP 130.12.180.51 over the past 30 days and the with all the files matching hashes.<\/p>\n

\"\"<\/p>\n

Indicators<\/strong><\/span><\/p>\n

45.132.180.51
\n130.12.180.51
\n193.32.162.157
\n213.209.143.51<\/p>\n

783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59\u00a0
\n59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5
\n048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7
\ndbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9
\nd46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e
\n3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f<\/p>\n

[1] https:\/\/isc.sans.edu\/diary\/Analysis+of+SSH+Honeypot+Data+with+PowerBI\/28872
\n[2] https:\/\/gephi.org\/
\n[3] https:\/\/www.graphviz.org\/download\/
\n[4] https:\/\/github.com\/bruneaug
\n[5] https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/8.19\/esql-using.html
\n[6] https:\/\/isc.sans.edu\/diary\/Using+ESQL+in+Kibana+to+Queries+DShield+Honeypot+Logs\/31704
\n[7] https:\/\/isc.sans.edu\/api\/threatcategory\/research?json
\n[8] https:\/\/gephi.org\/quickstart\/<\/p>\n

———–
\nGuy Bruneau IPSS Inc.<\/a>
\nMy GitHub Page<\/a>
\nTwitter: GuyBruneau<\/a>
\ngbruneau at isc dot sans dot edu<\/p>\n

(c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

I’m always looking for new ways of manipulating the data captured by my DShield sensor [1]. This time I used Gephi [2] and Graphiz [3] a popular and powerful tool for visualizing and exploring relationships between nodes, to examine the relationship between the source IP, filename and which sensor got a copy of the file. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[90],"tags":[91],"class_list":["post-468","post","type-post","status-publish","format-standard","hentry","category-cybersecurity","tag-cybersecurity"],"yoast_head":"\nAnalysis using Gephi with DShield Sensor Data, (Wed, Jan 7th) - Imperative Business Ventures Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Analysis using Gephi with DShield Sensor Data, (Wed, Jan 7th) - Imperative Business Ventures Limited\" \/>\n<meta property=\"og:description\" content=\"I’m always looking for new ways of manipulating the data captured by my DShield sensor [1]. This time I used Gephi [2] and Graphiz [3] a popular and powerful tool for visualizing and exploring relationships between nodes, to examine the relationship between the source IP, filename and which sensor got a copy of the file. […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/\" \/>\n<meta property=\"og:site_name\" content=\"Imperative Business Ventures Limited\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-08T01:08:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/isc.sans.edu\/diaryimages\/images\/gephi_srcip_file_sensor_pic2.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"headline\":\"Analysis using Gephi with DShield Sensor Data, (Wed, Jan 7th)\",\"datePublished\":\"2026-01-08T01:08:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/\"},\"wordCount\":505,\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/gephi_srcip_file_sensor_pic2.png\",\"keywords\":[\"Cybersecurity\"],\"articleSection\":[\"Cybersecurity\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/\",\"url\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/\",\"name\":\"Analysis using Gephi with DShield Sensor Data, (Wed, Jan 7th) - Imperative Business Ventures Limited\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/gephi_srcip_file_sensor_pic2.png\",\"datePublished\":\"2026-01-08T01:08:00+00:00\",\"author\":{\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/#primaryimage\",\"url\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/gephi_srcip_file_sensor_pic2.png\",\"contentUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/gephi_srcip_file_sensor_pic2.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.ibvl.in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Analysis using Gephi with DShield Sensor Data, (Wed, Jan 7th)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.ibvl.in\/#website\",\"url\":\"https:\/\/blog.ibvl.in\/\",\"name\":\"Imperative Business Ventures Limited\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.ibvl.in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/blog.ibvl.in\"],\"url\":\"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Analysis using Gephi with DShield Sensor Data, (Wed, Jan 7th) - Imperative Business Ventures Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/","og_locale":"en_US","og_type":"article","og_title":"Analysis using Gephi with DShield Sensor Data, (Wed, Jan 7th) - Imperative Business Ventures Limited","og_description":"I’m always looking for new ways of manipulating the data captured by my DShield sensor [1]. This time I used Gephi [2] and Graphiz [3] a popular and powerful tool for visualizing and exploring relationships between nodes, to examine the relationship between the source IP, filename and which sensor got a copy of the file. […]","og_url":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/","og_site_name":"Imperative Business Ventures Limited","article_published_time":"2026-01-08T01:08:00+00:00","og_image":[{"url":"https:\/\/isc.sans.edu\/diaryimages\/images\/gephi_srcip_file_sensor_pic2.png","type":"","width":"","height":""}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/#article","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/"},"author":{"name":"admin","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"headline":"Analysis using Gephi with DShield Sensor Data, (Wed, Jan 7th)","datePublished":"2026-01-08T01:08:00+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/"},"wordCount":505,"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/#primaryimage"},"thumbnailUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/gephi_srcip_file_sensor_pic2.png","keywords":["Cybersecurity"],"articleSection":["Cybersecurity"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/","url":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/","name":"Analysis using Gephi with DShield Sensor Data, (Wed, Jan 7th) - Imperative Business Ventures Limited","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/#primaryimage"},"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/#primaryimage"},"thumbnailUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/gephi_srcip_file_sensor_pic2.png","datePublished":"2026-01-08T01:08:00+00:00","author":{"@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"breadcrumb":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/#primaryimage","url":"https:\/\/isc.sans.edu\/diaryimages\/images\/gephi_srcip_file_sensor_pic2.png","contentUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/gephi_srcip_file_sensor_pic2.png"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/08\/analysis-using-gephi-with-dshield-sensor-data-wed-jan-7th\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.ibvl.in\/"},{"@type":"ListItem","position":2,"name":"Analysis using Gephi with DShield Sensor Data, (Wed, Jan 7th)"}]},{"@type":"WebSite","@id":"https:\/\/blog.ibvl.in\/#website","url":"https:\/\/blog.ibvl.in\/","name":"Imperative Business Ventures Limited","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.ibvl.in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/blog.ibvl.in"],"url":"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/468","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/comments?post=468"}],"version-history":[{"count":0,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/468\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/media?parent=468"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/categories?post=468"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/tags?post=468"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}