Multi-Honeypot Platform: T-Pot
Multi-Honeypot Platform T-Pot is based on Ubuntu Server 16.10 LTS. The honeypot daemons as well as other support components being used have been paravirtualized using docker. This allowed developers to run multiple honeypot daemons on the same network interface without problems and make the entire system very low maintenance. The encapsulation of the honeypot daemons in docker provides a good isolation of the runtime environments and easy update mechanisms. In T-Pot developers combined the dockerized honeypots ( conpot, cowrie, dionaea, elasticpot, emobility, glastopf and honeytrap ) with suricata a Network Security Monitoring engine and the ELK stack to beautifully visualize all the events captured by T-Pot. Events will be correlated by specially developed data submission tool ewsposter which also supports Honeynet project hpfeeds honeypot data sharing. All data in docker is volatile. Once docker container crashes, all data produced within its environm...