more

internal/collector/collector.go

@@ -51,6 +51,7 @@ type Collector struct {
 	sourceMaps   *sourcemaps.Resolver
 	kubeWatcher  *kube.Watcher
 	prometheus   *prometheus.Client
+	honeypot     HoneypotRecorder
 
 	// Optional capabilities of the configured store (ClickHouse implements
 	// all of them); nil when unsupported, and the API falls back to the
@@ -109,6 +110,17 @@ func (c *Collector) SetIngestKey(key string) {
 	c.ingestKey = key
 }
 
+// HoneypotRecorder receives suspicious request observations extracted from
+// telemetry. It is intentionally a small interface so the collector does not
+// depend on the HTTP honeypot implementation.
+type HoneypotRecorder interface {
+	RecordTelemetry(ip, path string) bool
+}
+
+func (c *Collector) SetHoneypotRecorder(recorder HoneypotRecorder) {
+	c.honeypot = recorder
+}
+
 // SetStatsQuerier enables the aggregate stats endpoints (error trends,
 // release comparisons) when a store supporting them is configured.
 func (c *Collector) SetStatsQuerier(q storage.StatsQuerier) {
@@ -353,6 +365,7 @@ func (c *Collector) ConsumeTraces(ctx context.Context, td ptrace.Traces) error {
 
 	// Store and broadcast raw bytes as json.RawMessage to avoid unsafe interface{} usage
 	c.addToHistory(websocket.DataTypeTraces, buf)
+	recordSuspiciousTraceIPs(c.honeypot, td)
 	if extractSpanErrors(c.issues, td, time.Now().UnixNano()) {
 		c.notifyIssues()
 	}
@@ -398,6 +411,7 @@ func (c *Collector) ConsumeLogs(ctx context.Context, ld plog.Logs) error {
 
 	// Store and broadcast raw bytes as json.RawMessage to avoid unsafe interface{} usage
 	c.addToHistory(websocket.DataTypeLogs, buf)
+	recordSuspiciousLogIPs(c.honeypot, ld)
 	if extractLogErrors(c.issues, ld, time.Now().UnixNano()) {
 		c.notifyIssues()
 	}