An all-in-one, optionally distributed, multi-architecture honeypot platform with 20+ honeypots, visualization via Elastic Stack, and live attack maps.
T-Pot is an all-in-one honeypot platform that combines over 20 different honeypots and security tools into a single, optionally distributed system. It captures and analyzes attack data, providing visualization through the Elastic Stack and live attack maps to help security researchers and organizations understand threats.
Security researchers, SOC analysts, and cybersecurity professionals who need a comprehensive, self-hosted honeypot solution for threat intelligence, attack analysis, and deception.
T-Pot offers a unified, open-source platform with extensive honeypot coverage, real-time visualization, and community-driven threat data sharing, eliminating the need to deploy and manage multiple standalone honeypots.
🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Integrates over 20 different honeypots like Cowrie, Dionaea, and Conpot, covering a wide range of protocols from SSH to industrial control systems, as listed in the README.
Leverages the Elastic Stack (Elasticsearch, Logstash, Kibana) for storing and visualizing attack data, plus animated live attack maps and tools like CyberChef for analysis.
Supports hive-sensor deployment for distributing honeypots across networks, allowing centralized logging and management, as detailed in the distributed deployment section.
Open-source and community-driven with options to customize honeypot selection via docker-compose files and tools like customizer.py, enabling tailored setups.
Requires at least 8-16 GB of RAM and 128 GB of disk space, making it unsuitable for low-resource environments or lightweight deployments.
Installation is non-trivial, requiring specific Linux distros, port conflict management, and regular updates; the README warns about potential issues and recommends fresh installs for problems.
By default, captured data is submitted to a community backend (Sicherheitstacho), which requires manual opt-out by editing configuration files, potentially a concern for private deployments.