security
May 7, 2026
By Teun
LLM Generates Adaptive Dashboards for Honeypot Log Analysis
A SANS guest diary describes a system that summarizes DShield web honeypot logs and uses Claude to generate a React dashboard tailored to each day’s attack patterns. The design keeps raw malicious strings away from the model and renders the generated UI inside a sandboxed iframe with fallback validation.
A SANS guest diary describes a cyber analytics workflow that uses an LLM to generate a daily dashboard for web honeypot logs. The project was written by Eric Roldan, a SANS.edu BACS student and ISC intern, and it is based on DShield web honeypot data.
The core idea is simple: instead of forcing an analyst to start with raw logs and build queries by hand, the system turns the logs into a summary, then asks Claude to generate a React dashboard that matches the day’s attack patterns. According to the post, the UI changes depending on whether a day shows one dominant campaign or a mix of background scanning and random internet traffic.
⚡ New to this?
This news is about using an AI model to build a custom dashboard from security logs instead of making a person do all the setup by hand. A honeypot is a fake internet-facing system used to attract attackers and collect their behavior, and log analysis is the process of reading those records to spot scanning, exploit attempts, and other activity.
The bigger idea is that the interface itself can adapt to the data. That matters because security teams often spend a lot of time deciding which fields, charts, and filters are useful before they can even begin investigating.
🦞 OpenClaw angle
If you build self-hosted security automation, separate log summarization from code generation the way this project does. Send your agent cleaned, structured data, not raw attacker strings, and keep any generated UI in a sandboxed iframe or equivalent isolated container.
Add a validation step that rejects broken or unsafe output and falls back to a static dashboard. If you are using an LLM to triage alerts, start by having it produce a compact summary with top entities, time patterns, and attack tags before asking it to generate any interface or report.
Roldan says the approach is meant to lower the barrier for people who are trying to identify attacks on web servers without much cyber experience. He argues that analysts often spend time figuring out what to look for before they can begin analysis, and that an LLM can help with that first step by surfacing likely patterns and layout choices automatically.
The pipeline starts with a DShield web honeypot log file. A Python analyzer processes the entries and turns them into a cleaned summary rather than sending raw attacker text directly to the AI, according to the diary.
That summary includes top IP addresses, top URLs, time-based patterns, and tags for common probe or attack types. The post lists examples such as WordPress probes, SSRF, path traversal, and CGI abuse, along with other recognizable patterns.
Claude then uses that summary to write a React dashboard component that fits the shape of the activity for that day. If the logs show a single clear pattern, the generated UI can highlight it. If the day is mostly noisy traffic, the dashboard reflects that too.
The post also emphasizes the safety controls around the generated interface. The LLM does not receive the raw malicious strings directly, and the generated code does not run freely in the main page.
Instead, the app serves the dashboard through a backend API, caches the output so it does not constantly change, and renders it inside a sandboxed iframe. If the generated code fails validation, the system falls back to a static dashboard, according to the author.
Roldan says the project was built to answer a basic question analysts face when reading attack logs: what am I actually looking for? By using the model to create a bespoke UI for each day’s scenario, the system tries to make that answer clearer before the analyst starts digging through the data.
The author also notes that the project can highlight obvious attack signatures near the top of the dashboard when those patterns stand out in the logs. On noisier days, the UI may not show a dominant pattern.
The repository for the project is available on GitHub, according to the post. Roldan says Claude Code helped write the repository, and he credits his internship mentor Guy Bruneau for helping shape the idea.
