T-Pot
An all-in-one, optionally distributed, multi-architecture honeypot platform with 20+ honeypots, visualization via Elastic Stack, and live attack maps.
What is T-Pot?
T-Pot is an all-in-one honeypot platform that combines over 20 different honeypots and security tools into a single, optionally distributed system. It captures and analyzes attack data, providing visualization through the Elastic Stack and live attack maps to help security researchers and organizations understand threats.
Security researchers, SOC analysts, and cybersecurity professionals who need a comprehensive, self-hosted honeypot solution for threat intelligence, attack analysis, and deception.
T-Pot offers a unified, open-source platform with extensive honeypot coverage, real-time visualization, and community-driven threat data sharing, eliminating the need to deploy and manage multiple standalone honeypots.
Overview
🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
Use Cases
Best For
- Security teams building a centralized honeypot deployment for threat intelligence
- Researchers analyzing attack patterns across multiple protocols and services
- Organizations needing a self-hosted, customizable honeypot platform
- Educational environments for teaching cybersecurity and honeypot concepts
- SOC analysts visualizing live attack data with Kibana dashboards
- Deploying distributed honeypot sensors across network segments
Not Ideal For
- Teams needing a lightweight, single-purpose honeypot for specific protocol monitoring
- Environments with limited hardware resources, such as small VMs or embedded systems
- Projects requiring quick, out-of-the-box deployment without Docker or complex configuration
- Organizations that prioritize data privacy and prefer no default community data sharing
Pros & Cons
Pros
Integrates over 20 different honeypots like Cowrie, Dionaea, and Conpot, covering a wide range of protocols from SSH to industrial control systems, as listed in the README.
Leverages the Elastic Stack (Elasticsearch, Logstash, Kibana) for storing and visualizing attack data, plus animated live attack maps and tools like CyberChef for analysis.
Supports hive-sensor deployment for distributing honeypots across networks, allowing centralized logging and management, as detailed in the distributed deployment section.
Open-source and community-driven with options to customize honeypot selection via docker-compose files and tools like customizer.py, enabling tailored setups.
Cons
Requires at least 8-16 GB of RAM and 128 GB of disk space, making it unsuitable for low-resource environments or lightweight deployments.
Installation is non-trivial, requiring specific Linux distros, port conflict management, and regular updates; the README warns about potential issues and recommends fresh installs for problems.
By default, captured data is submitted to a community backend (Sicherheitstacho), which requires manual opt-out by editing configuration files, potentially a concern for private deployments.
Frequently Asked Questions
Related Projects
EndlesshSSH tarpit that slowly sends an endless banner
CowrieCowrie SSH/Telnet Honeypot https://docs.cowrie.org/
AndroguardReverse engineering and pentesting for Android applications
OpenCanaryModular and decentralised honeypot
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.