Huginn 0.31.0: attacker timeline, ATT&CK labels, collection health, programs that run

Update both the Huginn machine and the honeypot. The honeypot gets two new Cowrie patches and a new hp-export.

New

• Attacker timeline. The attacker page opens with the last 30 days across every service: web requests, tarpit, decoy logins, SSH and Telnet sessions, files and programs run, merged per kind of activity, each step with a phase (Recon, Access, Commands, Payload, Exploit).
• MITRE ATT&CK labels on commands, for example T1105 tool transfer, T1098.004 SSH keys, T1053.003 cron, T1496 mining, linked to MITRE, on the timeline and on every session.
• Folded sessions. The same command script is shown once with "×N like this"; sessions that only connected or only tried to log in are folded into two groups. Chips filter to sessions with commands or with logins.
• Uploaded programs "run". A program uploaded for the persona's CPU exits silently instead of failing with "Exec format error", so bots go on to their next step; the run, its arguments and the file's hash are logged. Nothing is ever executed.
• wget answers like the persona's own wget: BusyBox words on the camera, no "connected" before a connection fails, no name lookup for an address.
• Collection health. An alert (ntfy) when no sync works for 30 minutes or a source is quiet for longer than its own longest silence last week, and again when it is back. Account lists every source; /healthz adds collection_problems.
• Protection report. The honeypot reports its sandbox and memory/file limits per service, running services and every Huginn patch; Huginn shows it and alerts when something goes missing.
• Phone alert for web exploits recognised by the rules, with their CVE.
• Decoy cap. The first 2,000 decoy-service events per IP, service and day are stored, the rest only counted (HUGINN_DECOY_CAP); one VNC brute forcer alone was nearly a fifth of a database. Existing history is trimmed once on update. Account shows how fast the data folder grows and when the disk would be full.
• Wider screens get three columns on the Overview and two on Campaigns; Campaigns shows IPs in the last 7 days with an Active filter; Files has a chip per malware family; the Blocklist explains the whole scoring; visible keyboard focus and chart labels for screen readers.

Updating

git pull && ./update-huginn.sh      # on the Huginn machine
git pull && ./update-honeypot.sh    # on the honeypot (restarts Cowrie once)

The one-time decoy trim deletes stored repeats above the cap (they stay counted); update-huginn.sh takes a backup first.