6.3 Log Collection

6.3.1 Dashboard Log History#

The Log History tab on the main Dashboard (see Section 2.1.2.9) provides an archive of historical log records for forensic analysis and compliance reporting. This serves as the primary chronological record of all platform activity.

6.3.2 Intelligence Area Events#

The Events page within the Intelligence Area module (see Section 2.9.1) provides system-wide event monitoring with real-time counters. Events can be viewed in two modes:

View Mode	Description
Cards	Display events as individual cards in a grid layout
Table	Display events in a tabular format

The Events page displays total system-wide statistics:

Counter	Description
Connection	Total connection events
Interaction	Total interaction events
Credential	Total credential events

A Search events field allows filtering events by name or other criteria. Pagination controls allow navigation through multiple pages of events.

6.3.3 Forensic Intelligence#

The Forensic Intelligence page (see Section 2.9.3) provides detailed session-level forensic analysis of attacker interactions. The session counter displays total sessions. A Search sessions field and Filter Sessions dropdown allow filtering by Guardpot name or Attacker IP address.

Each session row displays:

Column	Description
Session	Guardpot name, attacker IP, OS, location, and public IP
Location	Geographic region of the attacker
Time	Session start and end timestamps with duration
Status	Session state (e.g., "Ended")

6.3.4 VGN Logs#

The Logs tab within the VGN module (see Section 2.7.5) provides audit trail visibility with three sub-tabs:

Log Sub-Tab	Content
Connections	Successful VPN connections with user, client IP, assigned VPN IP, duration, and MFA status
Failures	Unsuccessful connection attempts with failure reasons
IP Assignments	IP address lease history with user, VPN IP, and lease expiration

All log views include a date range filter and a search text bar for narrowing results by specific criteria.

6.3.5 Monitoring Module Logs#

The Monitoring module (see Section 2.11) provides analytical log views across multiple dimensions:

Monitoring Tab	Log Analysis Focus
IP Address	Connection data for specific attacker IP addresses over configurable time ranges (1-90 days)
Interaction	Attacker interaction types (SSH, FTP, HTTP requests)
Credential	Captured password analysis across the honeypot fleet
Local Area	Internal network topology and activity analysis for selected Guardpot agents

6.3.6 Honeypot-Specific Logs#

Individual honeypot logs can be accessed directly from the Guardpots module (see Section 2.2.10). Each honeypot card includes a Log (yellow) action button for viewing logs and generating reports specific to that instance.

6.3.7 Report-Based Log Summaries#

The Reports module (see Section 2.14) generates formatted log summaries for stakeholders and compliance requirements. The following reports are particularly relevant for log collection:

Report	Log Data Summarized
Overview Threat Summary	Totals by period, top services, geo heat map, top credentials, attack trends
Detailed Attack Analysis	Protocol distribution, daily attack volume, top attacker IPs, MITRE mapping
Alarm & Incident Management	Daily alarm volume, MTTR, resolved vs. open ratios

Reports are available for instant download in PDF, CSV, and Excel formats.

6.3.8 Event Detail View#

Clicking on an event card or table row in the Events page (see Section 2.9.1.5) opens a detailed analysis view for the specific IP address, providing comprehensive threat analysis across multiple panels:

Panel	Content
IP Information	Geolocation details including country, city, timezone, provider, and coordinates
Security & Reliability Scores	Threat security rating and intelligence reliability score
Protocol Activity	Network interactions analysis with hit counts and percentages
MITRE Attacks	MITRE ATT&CK framework mappings for observed attack techniques
Attack Map	Visual representation showing attacker location and targeted destinations
Top Targeted Countries	Attack destinations with percentage distribution
Weekly Attacks	Temporal analysis with attack frequency timeline
Network Topology	Agent connections and interactions timeline