An open-source ICS/SCADA honeypot designed to emulate industrial control systems and collect adversary intelligence.
Conpot is an open-source ICS/SCADA honeypot that emulates industrial control systems to attract and monitor cyber attacks targeting critical infrastructure. It simulates various industrial protocols and devices to collect intelligence on adversary behavior, helping security researchers analyze threats in a safe environment. The project focuses on understanding the motives and methods of attackers to improve defensive strategies.
Security researchers, ICS/SCADA operators, cybersecurity professionals, and organizations involved in protecting industrial control systems and critical infrastructure.
Developers choose Conpot for its specialized focus on ICS/SCADA threat intelligence, customizable emulation capabilities, and ease of deployment via Docker. It provides a low-risk platform to study real-world attacks without compromising actual industrial assets.
ICS/SCADA honeypot
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Accurately simulates key industrial protocols like Modbus and S7comm, enabling realistic mimicry of ICS devices for threat detection as highlighted in the key features.
Allows users to create or modify emulation templates for specific scenarios, providing flexibility in deployment, as noted in the documentation guides.
Supports Docker for simplified setup and scalability, with build status badges indicating maintained container images.
Offers detailed installation, configuration, and development guides on Read the Docs, reducing the learning curve for new users.
Host installation requires managing dependencies with uv and intricate configuration, which can be daunting for those without Python or ICS experience, as admitted in the README.
Primarily targets ICS/SCADA environments, making it ineffective for general cybersecurity honeypot needs or non-industrial threat monitoring.
Requires regular updates to templates and protocols to avoid detection by sophisticated attackers, adding operational burden without automated tools.