ElasticSearch

ElasticSearch honeypot dataset

I have uploaded a new ElasticSearch honeypot dataset. It appears there are a few individuals who are attempting to exploit a few 0days in ElasticSearch. All the more reason not

John W8MEJ Menerick June 10, 2015 1-minute read Updated August 18, 2026

Key takeaways

Deception technology in distributed databases catches attackers during their initial reconnaissance phase.
Honey tokens inside index mappings provide zero-false-positive intrusion alerts.
Make your telemetry actively deceptive to raise adversary execution costs.

I have uploaded a new ElasticSearch honeypot dataset. It appears there are a few individuals who are attempting to exploit a few 0days in ElasticSearch. All the more reason not to expose non-battle hardened open source projects to the Internet.

https://github.com/lordappsec/datasets/blob/master/osint/ElasticHoney/elastichoney_logs.json

About the author

John W8MEJ Menerick

Explore cutting-edge cybersecurity insights and protective strategies with John Menerick. Deep dives, threat analysis, and live streams from securesql.info.

Research Speaking About

Related reading

Autonomous Incident Response at Scale: How Energy-Based Models & TAME Replace LLM Guessing in Security

Security Theater and Cap Tables: Deconstructing Cal.com's Closed-Source Pivot

Episode 2: The Layer 2 Bridge Lab