As part of Hackathon 2024 a team developed a 1 click deploy solution that will deploy a debain vm, install cowrie, create ama dcr, dce, and association, and create a custom table to collect cowrie events. Solution contains a workbook (under development), 1 parser and 5 detection rules . The goal is make this a framework for others and community to create other 1 click deploy for other types of interactive honeypots. Can be used publicly for TI or privately as a detection tripwire

fixing yaml spacing intial validation tests failed.

added workbook and fixing parser yaml

fixed some kql, data connector, workbook validation errors, still researching the permissions on data connector does not match.

made a change to fix kql validation removing commas after each extend and new line | extend, also removed txt based parser.

added vm ext ama for linux in deployment.

fixing detections validation error SourceIP custom colum name to sentinel recognized field Address

…ure-Sentinel into cowrie-nates

minor fixes to validation errors

minor fix filehash

added algo identifier

created new kql validator for cowrie

added | extend for beinging of query line 25

updated deploy to azure button links and data connector permissions reqs

changes to data connector to pass kql validations

create a custom sample data for Sensor SSH Cowrie solution.

…ure-Sentinel into cowrie-nates

…ure-Sentinel into pr/11155

change solution name to match and added workbook metadata in

…ure-Sentinel into cowrie-nates

update images for preview for workbook