A modular OSINT honeypot that monitors adversary reconnaissance attempts and generates early-warning intelligence for blue teams.
Manuka is an open-source OSINT honeypot that simulates reconnaissance targets like social media profiles and leaked credentials to monitor adversary activity. It helps blue teams detect threats during the pre-attack phase by generating actionable intelligence from staged OSINT sources. The tool aligns with MITRE's PRE-ATT&CK framework to provide early-warning signals that traditional network honeypots miss.
Blue teamers, security analysts, and threat intelligence professionals who need to detect and analyze adversary reconnaissance attempts against their organization. It's particularly valuable for teams looking to extend visibility beyond network-based attacks.
Developers choose Manuka because it focuses exclusively on OSINT threat detection at the reconnaissance stage, offering a modular, scalable framework that integrates with existing tools. Its Dockerized deployment and customizable listeners allow teams to quickly adapt it to specific use cases and threat landscapes.
A modular OSINT honeypot for blue teamers
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Enables easy addition of new listener modules to monitor different OSINT vectors like social media, as highlighted in the README's key features for scalable threat detection.
Focuses on Stage 1 of the cyber kill chain, providing early-warning signals that traditional network honeypots miss, aligning with MITRE's PRE-ATT&CK framework per the description.
Uses containerized components orchestrated via Docker Compose, allowing for easy deployment and coordination of multiple honeypot campaigns, as detailed in the system design.
Generates hits (indicators of interest) that can be ported to third-party analysis tools, integrating into existing security workflows for enhanced threat intelligence.
Requires extensive configuration with Google Cloud Pub/Sub, ngrok, and multiple secret files, making initial deployment cumbersome and error-prone, as noted in the Configure sections.
Currently only supports social media and login listeners out-of-the-box, restricting immediate coverage of other OSINT vectors without custom development.
Heavily dependent on Google services like Gmail and Pub/Sub for functionality, which could lead to integration challenges and reliability issues if service changes occur.