A Rimba Siber project · Building in public
Building Sarang
in public.
A Cowrie honeypot deployed in Malaysia observes inbound SSH activity. Sarang processes those observations and shares the resulting threat feeds openly.
What I’m creating and why
Public threat feeds from a Malaysia-based Cowrie honeypot.
Sarang begins with a Cowrie SSH honeypot deployed in Malaysia. The honeypot records activity directed at it, including connection attempts and attacker behaviour within the monitored environment.
Sarang processes and organises these Cowrie observations, then distributes the resulting feeds through the Sarang website, OTX, and downloadable JSON and TXT files.
After an end user connects a Sarang feed to a firewall, SIEM, threat-intelligence platform, or another security product, that solution can use relevant feed entries within its own detection and response process.
Scope: Sarang reflects activity observed by this Malaysia-based Cowrie deployment. It does not represent every cyber threat affecting Malaysia, and a source address alone does not establish the identity or intent of an attacker.
The idea
From Cowrie observations to practical feeds.
- 01
Observe
Use Cowrie in Malaysia to record inbound SSH activity directed at the honeypot.
- 02
Process
Filter, organise, and prepare the Cowrie observations for consistent use.
- 03
Publish
Share through Sarang, OTX, and downloadable JSON and TXT files.
- 04
Integrate
Let end users connect the feeds to their own defensive solutions.
Open by design
Start small.
Share openly.
Improve over time.
The goal is not to claim visibility into every threat affecting Malaysia or to publish the largest feed. It is to make observations from this Cowrie deployment useful, accessible, and consistently maintained for defenders, researchers, system administrators, and organisations.
Feed entries should be evaluated in context before they are used for automated blocking.
This page is the beginning. I will share what I learn while building Sarang and improve the project through practical use and community feedback.
Open the Sarang project