$ show GreedyBear-Project/GreedyBear
GreedyBear is a threat intelligence platform that consumes honeypot logs from T-Pot clusters (Cowrie, Heralding, Tanner, etc.), extracts Indicators of Compromise (IOCs), enriches them with external threat feeds (ThreatFox, AbuseIPDB, FireHol, Spamhaus, MalwareBazaar), and applies machine learning scoring (Random Forest) to predict recurrence probability and expected interactions. The system exposes public and authenticated APIs in multiple formats (JSON, NDJSON, CSV, TXT, STIX 2.1) for threat researchers and supports event ingestion from external sensors. The backend is built with Django/DRF, PostgreSQL, and Elasticsearch, orchestrated via Django-Q cronjobs for scheduled extraction, enrichment, and cleanup. A React SPA frontend provides a customizable dashboard with attack maps, trending attackers, and feed browsing. The architecture uses repository, strategy, and factory patterns, with a clean separation between extraction pipelines, scoring, and API layers. While primarily an application, it has strong data engineering components—ETL pipelines, ML scoring, clustering (MinHash LSH for command sequences), and data enrichment—making it a hybrid that leans application.
The LLM identified 5 files worth highlighting for reuse:
ExtractionStrategyFactory maps honeypot names to provider-specific extraction strategies. New honeypot types can be added without changing the pipeline, demonstrating a textbook factory pattern with modest coupling.
TrendingBucketRepository encapsulates time-bucketed activity counting with raw SQL upserts for efficiency. The abstraction over complex queries makes it independently testable and reusable for similar time-series aggregation problems.
Custom DRF renderers for feeds (JSON, NDJSON, TXT, CSV, STIX 2.1) enable streaming of large IOC datasets without loading all rows into memory. This is a clean example of pluggable output formats that can be adapted for any streaming API.
RFModel abstract base with RFClassifier and RFRegressor subclasses provides a generic pattern for training and inference on tabular features. The feature preprocessing (multi-hot encoding, normalization) is decoupled from model logic, making it adaptable to other security-related prediction tasks.
The extraction pipeline orchestrates pulling Elasticsearch hits, grouping by honeypot type, running strategies, merging IOCs, and updating scores. Its clear state-machine-like flow and error isolation make it a solid reference for building resilient ETL jobs in Django.