A centralized but distributed honeypot system inspired by telekom-security/tpotce

Based on the T-Pot Honeypot framework, this projects makes it easy to deploy and monitor a distributed honeypot infrastructure.

• ELK Stack
• Elastic Curator

1. Set your password in .env file (you MUST keep the elastic username)
2. Generate certificates for Logstash and Filebeat (sensors) with logstash/ssl/generate.sh
3. Generate certificates for NGINX with nginx/generate.sh
4. $ docker-compose up -d

• Filebeat
• Cowrie
• Mailhoney
• ElasticPot
• Dionaea / Heralding
• Suricata

1. Set collector IP/FQDN and sensor name in .env file
2. Copy ca.crt, ca.key and serial file from logstash ssl config into sensor/filebeat/ssl/
3. Generate Filebeat certificate with generate.sh
4. Select honeypots to active by commenting the services in docker-compose.yml file or with docker-compose up -d filbeat [honeypots]