Skip to main content

​
CLI queries

Sundew provides a built-in CLI for querying captured data.

​
Recent sessions

# Most recent session
sundew query --last-session

# Last 24 hours of activity
sundew query --last 24h

# Last week
sundew query --last 7d

​
Filter by classification

# Only AI agent traffic
sundew query --type ai_agent

# Automated scanners
sundew query --type automated

# AI-assisted interactions
sundew query --type ai_assisted

# Combine filters
sundew query --type ai_agent --last 24h

​
Statistics

sundew stats
Returns a summary of:
  • Total events and sessions
  • Classification breakdown
  • Most-hit endpoints
  • Trap type distribution
  • Top source IPs

​
MCP server for researchers

Use Sundew as an MCP server to query your honeypot data from Claude or other AI tools: 
{
  "mcpServers": {
    "sundew": {
      "command": "sundew",
      "args": ["mcp-client"]
    }
  }
}
This exposes your captured data as MCP tools, letting you ask natural language questions about agent behavior directly from your AI assistant.

​
Data format

​
Request events

Each captured request contains:
FieldDescription
idUnique event identifier
timestampISO 8601 timestamp
session_idCorrelated session
source_ipOrigin IP address
methodHTTP method or MCP operation
pathRequest path
headersFull HTTP headers
bodyRequest body (if present)
fingerprint_scoresPer-signal scores
classificationComputed classification
trap_typeWhich trap handled it (rest_api, mcp, discovery)

​
Sessions

Sessions aggregate multiple requests:
FieldDescription
idSession identifier
source_ipShared origin
first_seen / last_seenTime range
request_countTotal requests in session
classificationAggregated classification
fingerprint_scoresAggregated signal scores
endpoints_hitList of endpoints accessed
trap_types_triggeredWhich traps were activated

​
Exporting data

For research and sharing: 
sundew export --anonymize
Anonymization automatically:
  • Hashes IP addresses
  • Buckets timestamps to hourly granularity
  • Strips any PII from request bodies
  • Preserves behavioral data for analysis