Deception

    Honeypot: a trap the attacker walks into

    FlowPro NG collects events from a T-Pot honeypot that pretends to be vulnerable services. It shows who attacks, from where, which passwords they try and what they do after logging in. Legitimate users have no reason to touch a honeypot, so every connection deserves attention.
    Try it free for 14 daysOnline demo
    flowpro.local/honeypot
    Honeypot overview in FlowPro NG

    Logs are full of noise. A honeypot speaks up only when someone touches it.

    On real servers an attack gets lost among thousands of ordinary logins and requests. A honeypot does no legitimate work, so everything it captures is scanning, password guessing or an intrusion attempt. No false positives from normal traffic.

    An internet-facing honeypot shows which passwords and exploits attackers are using right now. A honeypot inside the network works as an early warning: if someone connects to it from your LAN, they are most likely already inside and looking for the next target.

    What you get

    Honeypot in FlowPro NG

    Many services on one server

    T-Pot runs honeypots in Docker containers: Cowrie (SSH/Telnet), Dionaea (SMB, HTTP, FTP), Heralding, Mailoney (SMTP), Conpot (Modbus, S7comm), ADBHoney, CitrixHoneypot and more. Suricata inspects their traffic as well.

    Attackers and their origin

    Attacker IP addresses with geolocation, ASN and number of attacks. The map and timeline show where and when attacks come from and which ports they target.

    Usernames and passwords tried

    The most common credential combinations attackers try. You can easily check whether any of your company's accounts or passwords show up among them.

    SSH and Telnet commands

    Cowrie records what the attacker runs after a "successful" login: system reconnaissance, malware downloads, adding SSH keys. You see the commands in a clear table and within each session.

    Sessions, not single events

    Events from the same IP to the same port are grouped into a session automatically when less than 5 minutes pass between them. You see the attack's duration and number of actions, not thousands of separate rows.

    MITRE ATT&CK and indicators

    Attacker techniques from the honeypot are mapped to MITRE ATT&CK alongside Suricata alerts. Captured IP addresses can serve as your own indicators of compromise for blocking.

    • T-Pot
    • Cowrie
    • Dionaea
    • Heralding
    • Mailoney
    • Conpot
    • ADBHoney
    • CitrixHoneypot
    • Suricata
    • SSH
    • Telnet
    • SMB
    • SMTP
    • Modbus
    • ClickHouse
    • GeoIP
    • MITRE ATT&CK

    How it works

    Up and running in a few steps

    1. 01

      Deploy T-Pot on a separate server

      The honeypot belongs on a dedicated virtual server isolated from production (at least 8 GB RAM, 16 GB recommended, 40 GB disk). Installing T-Pot Standard takes about 10 minutes.

    2. 02

      Install the FlowPro agent

      The flowpro-honeypot package from the APT repository creates a TLS certificate and an API key. In its configuration you allow access only from your FlowPro NG server's IP address.

    3. 03

      Connect and watch the attacks

      In FlowPro NG Settings, enter the agent address and API key. FlowPro NG then pulls new events every minute and stores them in ClickHouse on your server.

    FAQ

    Frequently asked questions

    What is a honeypot?

    A honeypot is a decoy: a server that pretends to run vulnerable services such as SSH, SMB or a web server. It has no real function, so every connection to it is suspicious. It records who attacks, which passwords they try and what they attempt to do.

    Is running a honeypot legal?

    Running a honeypot on your own infrastructure is a common defensive practice. It does not entice anyone into crime, it only records attempts to access services nobody should be using. Captured data such as IP addresses should be covered by your rules for handling security records.

    Doesn't a honeypot attract attackers into my network?

    Attackers scan the internet around the clock and a honeypot only records what they would try anyway. Isolation is what matters: T-Pot runs on a dedicated server outside production and the firewall blocks its outbound connections to private networks. The FlowPro agent is reachable only from your FlowPro NG server's IP address.

    Does a honeypot inside the company network make sense?

    Yes, as an early warning. Inside the network nobody has a legitimate reason to access the honeypot, so a connection from the LAN points to scanning or lateral movement, for example ransomware looking for more machines. Such an alert produces very few false positives.

    Where is the honeypot data stored?

    On your own server. FlowPro NG pulls the events from the agent and stores them in its ClickHouse database. Only the license check and technical instance status leave the network, never attack data.

    Related solutions

    Intrusion detection (IDS)Suricata IDS inspects network traffic packet by packet and alerts you to intrusion attempts, malware and exploits. DNS, HTTP, TLS and FTP included.Network anomaly detection17 detections over network flows every minute: port scans, floods, data exfiltration, beaconing, lateral movement, tunnels.SIEM and log managementLogs from servers, workstations and network devices in one place. Search, detection rules and alerts on your own server.
    How FlowPro NG compares to Wazuh, Elastic, Splunk and Flowmon

    Try it on your own network

    The 14-day Enterprise trial unlocks every module. You install it on your own server, no credit card needed.

    Start Free TrialOnline Demo