Hive/Distributed install : malware still saved on honeypots not to hive server

[dmille6]

i'm running a hive/distributed install. all the logs from each honeypot are being sent to the hive server, which is great, but the malware from cowrie and other HP's are still saved on the honeypots.

is anyone else donig anything with that malware? how are you managing it? and getting it off the honeypots?

i want it all in one central spot. only way i can think of doing it is a script taht would SCP into each honeypot and transfer it to one location and put it in a folder based on the ip address or hostname of the HP.

anyone else doing anything like this? any better suggestions?