T-Pot
All-in-one honeypot platform that Dockerizes more than twenty honeypots with an ELK dashboard.
Technical Architecture & Overview
T-Pot, maintained by Deutsche Telekom Security, packages honeypots such as Cowrie, Dionaea, and Heralding into a single Docker Compose deployment with shared logging, an Elastic stack, and attack map dashboards. A standard install turns one host into a multi-protocol sensor, and attack data is submitted to the Sicherheitstacho community feed by default unless that component is removed. The latest tagged release is 24.04.1, with ongoing commits to the master branch since.
Targeted Technical Use Cases
Running a broad external-facing sensor platform on a single host to collect attacker tradecraft.
Evaluation & Trade-offs
Core Strengths
- +Many honeypots in one maintained deployment.
- +Dashboards and storage included.
- +Active maintenance by a corporate security team.
Trade-Offs & Limitations
- -Needs at least 8 to 16 GB RAM and 128 GB of free disk space.
- -Placement guidance assumes an unfiltered zone with all TCP and UDP traffic forwarded to the sensor.
Defensive Security Application
Observing real attacker behavior in the wild.
Frequently Asked Questions
What is T-Pot?→
T-Pot, maintained by Deutsche Telekom Security, packages honeypots such as Cowrie, Dionaea, and Heralding into a single Docker Compose deployment with shared logging, an Elastic stack, and attack map dashboards. A standard install turns one host into a multi-protocol sensor, and attack data is submitted to the Sicherheitstacho community feed by default unless that component is removed. The latest tagged release is 24.04.1, with ongoing commits to the master branch since.
What is T-Pot used for?→
Running a broad external-facing sensor platform on a single host to collect attacker tradecraft.
What are the strengths of T-Pot?→
- +Many honeypots in one maintained deployment.
- +Dashboards and storage included.
- +Active maintenance by a corporate security team.
What are the limitations of T-Pot?→
- +Needs at least 8 to 16 GB RAM and 128 GB of free disk space.
- +Placement guidance assumes an unfiltered zone with all TCP and UDP traffic forwarded to the sensor.
How is T-Pot used defensively?→
Observing real attacker behavior in the wild.