Greedybear: Access payload files

The goal of this project is to improve GreedyBear’s threat intelligence capabilities by incorporating honeypot payload files received from T-Pot. Currently, GreedyBear only receives and handles metadata such as IP addresses, ports, and credentials from Elasticsearch logs, while actual threat payloads received from honeypots remain unused and inaccessible to analysts . In this regard, this project proposes a secure end-to-end payload ingestion pipeline between T-Pot and GreedyBear. To achieve this, a FastAPI-based microservice will be deployed along with T-Pot to dynamically expose payload files and their associated metadata such as hashes and MIME types via authenticated APIs without altering existing honeypot functionality or imposing additional system overhead. On the GreedyBear end of the pipeline, a scheduled Django Q2 task will be implemented to fetch new payloads and securely store them in a quarantined environment while ensuring deduplication via cryptographic hashes and metadata indexing in PostgreSQL for easy retrieval via a REST API while imposing strict access controls to only allow authorized personnel to download payload files. Moreover, the system will also be designed to optionally share received payloads with MalwareBazaar to contribute to the threat intelligence community as well. In summary, this project aims to greatly improve GreedyBear’s threat intelligence and security analysis capabilities by not only ingesting threat indicators but also threat payloads to become a comprehensive threat intelligence platform for the organization and the entire threat intelligence community at large.