Case study—
Material reviewed: Public pageCritical readingVendor-published story of Fidelis Deception use at a North American children’s hospital.
NetworkIdentityDecoy
Open software—
Material reviewed: Repository metadataCritical readingSSH and Telnet honeypot that records login attempts and attacker sessions.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationAn academic project that deploys a honeypot alongside an Elastic stack (Elasticsearch/Kibana) and ElastAlert, including a custom 'MITREAttack' alert that writes information according to the MITRE ATT&CK matrix for detecting and classifying attacks.
NetworkEndpointHoneypot
Documentation—
Material reviewed: Repository documentationSetup documentation for several low-interaction honeypots (dionaea, kippo, glastopf, conpot), including network configuration steps such as reconfiguring the system SSH port for kippo.
Network
Service—
Material reviewed: Public pageCritical readingACSG publishes a managed decoy and continuous-monitoring offering for IT, cloud and ICS.
NetworkCloudDecoyHoneytoken
Service—
Material reviewed: Public pageManaged offering DALEO publishes in conjunction with the CounterCraft platform.
NetworkDecoyAdversary engagement
Service—
Material reviewed: Public pageCritical readingECCA offering in Egypt and GCC listing integration, independent services, training and managed deception.
NetworkIdentityDecoy
Service—
Material reviewed: Public pageHoneypot service offering published by Maple Networks.
NetworkHoneypot
Product—
Material reviewed: Public pageCritical readingPersistent instrumented environments for malware detonation and adversary observation, according to the platform description.
NetworkEndpointDecoyAdversary engagement
Service—
Material reviewed: Public pageManaged IT and OT deception service published by MainDefense.
OT/ICSNetworkDecoy
Open software—
Material reviewed: Repository documentationDistributed low-interaction honeypot whose agents simulate services with protocol handlers and whose master receives attack information.
NetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingHoneypot project for observing attacks against network services.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA low-interaction honeypot, successor to nepenthes, offering emulated network services such as SMB, HTTP, FTP, TFTP, and MSSQL via embedded Python and libemu, aiming to capture copies of malware.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDionaea is a low-interaction honeypot, successor to nepenthes, designed to trap malware exploiting vulnerabilities in network services offered to a network, with the goal of obtaining a copy of the malware.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDionaea-Vagrant is a set of scripts and a Vagrantfile that automate deployment of a virtual machine running the Dionaea malware honeypot on Ubuntu 12.04, installing dependencies and running it as a daemon alongside p0f.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationWeb front end for the Dionaea low-interaction honeypot, with connection filters and attack graphs. It is honeypot-adjacent visualization infrastructure, not itself a honeypot.
Network
Open software—
Material reviewed: Public pageA Django application for browsing the Kippo SSH honeypot’s MySQL data in the admin panel; it is not described as a honeypot itself.
Network
Open software—
Material reviewed: Repository documentationLow-interaction SSH honeypot packaged in a Docker container that listens on port 2222, logs IP addresses, usernames, and passwords from login attempts, and then disconnects the client.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDocumented project implementing a Docker-based high-interaction SSH honeypot, using patched bash and OpenSSH to log commands and credentials, integrated into a larger architecture of agents and attack-detection servers.
NetworkCloudHoneypot
Open software—
Material reviewed: Repository documentationDocker-based honeypot documented as an SSH decoy on port 22, using containers and auditd logging.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationSDN honeypot with an HTTP interface that simulates a failed login without connecting to a real service; the documentation suggests checking PostgreSQL records.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationDocker container that starts a Cowrie-based SSH honeypot and enables statistics reporting to DShield.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction honeypot that listens for connections on a configurable port, can send a reply, and triggers event handlers, including an email handler.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationElasticPot is a honeypot that emulates an Elasticsearch service, compatible with DTAG's T-Pot environment and also available as a dockerized version.
NetworkApplicationHoneypot