dtag-dev-sec/tpotce
Tpotce
T-Pot is a multi-honeypot orchestration platform and threat intelligence collector. It utilizes a Docker-based security sandbox to deploy and manage a collection of diverse decoy services that simulate vulnerable targets to lure attackers and record their activity.
The system features a distributed sensor network where remote nodes capture attack logs and transmit them via encrypted communication to a central hub. This central hub employs an analytics stack to transform raw logs into geographic maps and interactive dashboards for adversary behavior visualization. To increase the realism of simulated targets, the platform integrates large language models.
Broad capabilities include automated environment installation across Linux distributions, passive network fingerprinting, and the ability to filter out mass scanner traffic to reduce noise. The platform also supports exporting captured security event data to community backends and third-party global threat feeds.
Features
- Honeypot Environments - Integrates large language models and diverse services to create realistic targets that trick attackers.
- Threat Intelligence Platforms - Manages a distributed network of sensors to collect and transmit attacker logs to a central hub.
- Threat Intelligence - Enables the contribution of captured attack data to community backends and global threat intelligence feeds.
- Analytics Dashboards - Transforms raw attack logs into interactive dashboards and geographic maps for behavioral visualization.
- Container Environment Orchestrators - Deploys diverse vulnerable services in isolated containers to simulate targets and capture attacker activity.
- Decoy Service Deployments - Deploys a collection of diverse services in a single environment to analyze network attack data across various ports.
- Distributed Deployment - Coordinates a network of remote sensors that relay captured intruder activity back to a central server.
- Remote Monitoring Transmission - Transmits captured attack data from distributed remote installations to a central hub for aggregated analysis.
- Attack Data Collection - Captures and persists network traffic and attacker logs to facilitate detailed security analysis.
- Cyber Threat Intelligence Maps - Visualizes captured network traffic and intruder behavior using centralized dashboards and geographic maps.
- Secure Sandboxing - Uses Docker containers to create isolated security sandboxes that simulate vulnerable services without risking the host system.
- Decoy Services - Deploys a collection of diverse decoy services to simulate vulnerable targets and capture network attack data.
- Centralized Logging Systems - Aggregates attack logs from multiple remote sensors into a centralized system for unified monitoring.
- Distributed Log Aggregation - Collects and synchronizes security event data from multiple remote sensors into a centralized hub for analysis.
- Sensor Network Coordination - Deploys and coordinates multiple remote sensors to collect threat intelligence across different network locations.
- Interactive Honeypots - Integrates large language models to power interactive simulations that act as realistic targets for attackers.
- Behavior Visualizations - Visualizes captured attack traffic through integrated dashboards and geographic maps to analyze adversary behavior.
- Data Persistence and Storage - Stores collected attack logs and artifacts with configurable retention and purging policies.
- Automated System Installers - Automates dependency installation, firewall configuration, and system setup across various Linux distributions.
- Communication Encryption - Protects data transit between remote collection nodes and the central server using SSL certificates.
- Device Fingerprinting - Extracts metadata and device identifiers from live traffic using passive network fingerprinting.
- Infrastructure Fingerprinters - Extracts network metadata and fingerprints from live traffic using passive fingerprinting engines to identify infrastructure.
- Open Source Intelligence Tools - Collects open source intelligence and utilizes encoding and decryption tools to investigate attacker behavior.
- Security Analysis Dashboards - Provides a centralized security analysis dashboard using the ELK stack to visualize attack patterns and geographic maps.
- Traffic Filtering Systems - Null-routes traffic from known mass scanners at the network level to reduce noise in threat intelligence.
- Honeypot Management - All-in-one honeypot appliance for rapid deployment.
