T-Pot is a multi-honeypot platform and threat intelligence framework that deploys a collection of containerized decoy services to capture attacker behavior and network telemetry. It functions as a Docker-based deception system, simulating vulnerable network environments to gather intelligence on threat actors.
The system features a distributed sensor network using a hub-and-spoke architecture, allowing remote sensors to transmit logs back to a central management hub. It integrates large language models to create a dynamic deception engine capable of adaptive interactions with attackers.
The platform covers a broad range of security capabilities, including the emulation of vulnerable services, passive network traffic analysis, and the use of HTTP tarpitting to exhaust attacker resources. Captured event logs are aggregated into real-time dashboards and geographic maps for threat data visualization.
Administrative access to the tool suite and dashboards is managed through a reverse proxy and authenticated web access control.