Beelzebub

Beelzebub is a Go-based honeypot framework where services are declared in YAML configuration, with optional Go plugins for custom behavior. It supports SSH, HTTP, TCP, Telnet, and MCP, with example configurations for services such as MySQL and Redis, and an optional integration routes interactive prompts to an LLM so attackers receive plausible responses. The same company sells Beelzebub Platform, a managed product built on the open source framework.

Quickly standing up protocol decoys with configuration files, including experiments with AI-driven interaction.

• +Low-code setup: services and responses are defined in YAML.
• +Optional LLM-generated responses for interactive decoys.
• +Runs as a local Go binary, with Docker Compose, or on Kubernetes with Helm.

• +Many example decoys return banners and selected responses rather than full interactive exchanges.
• +LLM-driven responses require a configured model provider.

Decoy services that log attacker activity for investigation.