opensearch

[dio99]

just wonder if not migrate to opensearch instead so can use ML also.. and other limited stuff in ES without a valid license.?

[dmille6]

I'm going to start poking around with open search in the next few weeks.

my approach:

• leave TPOT the way it is.. it works.. but if you look at the wiki section for tpotce there is a section on "how to transmit data to another destination"
• I'm going to set up an opensearch instance and use the process set out in that wiki article to dump the tpot data into the open search cluster I set up.

in my experience.. I really haven't had much luck with using ML with honeypot data.. the ip addresses are random.. I guess you can see patterns of usernames and passwords, things like that.. but thats about all .. but it'll be a way for me to learn the ins and outs of open search for another project.

[dio99]

nice let me know how it goes :)