Repolode
Submit
telekom-security

telekom-security/tpotce

All-in-one multi-honeypot platform that runs 20+ honeypots with Elastic Stack dashboards, live attack maps and security tools.

View on GitHub
Stars
9,618
Forks
1,404
Open issues
0
Last commit
2 hours ago

What is it?

T-Pot is a honeypot platform that deploys a collection of deception services on one host, so security teams can observe real attack traffic against many protocols at once. It runs its honeypots as Docker containers managed with docker compose, and the README lists more than 20 of them, including Cowrie, Dionaea, Conpot, Heralding and Log4Pot, plus LLM-based options such as Beelzebub and Galah.

Captured events are ingested into Elasticsearch through Logstash and shown in Kibana dashboards. The platform also bundles CyberChef, Elasticvue, an animated attack map, Spiderfoot, Suricata, P0f and Fatt, so analysts can inspect and enrich the data in the same place. It supports amd64 and arm64, and can run as a standalone system, as a central hive, or as distributed sensors reporting to a hive.

The installer targets supported Linux distributions, and T-Pot can also run in a VM or on macOS and Windows with Docker Desktop, within the limits of that environment. Deployments need a dedicated host with substantial RAM and disk, and the honeypots are intentionally exposed to the internet.

Key features

  • 01Runs 20+ honeypot services as Docker containers under one platform.
  • 02Ships Elastic Stack (Elasticsearch, Logstash, Kibana) dashboards for captured events.
  • 03Includes an animated live attack map and Spiderfoot for OSINT.
  • 04Adds Suricata, P0f and Fatt for network security monitoring and traffic fingerprinting.
  • 05Supports standalone, hive and distributed sensor deployments on amd64 and arm64.

Use cases

  • Studying real-world attack patterns against exposed SSH, Telnet, web and industrial protocols.
  • Running a honeypot sensor network that reports to a central hive.
  • Teaching threat detection and log analysis with a ready-made Kibana dashboard set.
  • Evaluating LLM-based honeypots such as Beelzebub or Galah with a local Ollama instance.

Quick start

  1. 1

    Install curl if not already installed

    sudo [apt, dnf, zypper] install curl
  2. 2

    Run the official installer as a non-root user from $HOME

Things to know

  • Needs at least 8-16 GB RAM and 128 GB free disk space, and a working internet connection.
  • Installation is done on a dedicated Linux install, and the installer is a remote script that runs on your system.
  • Honeypots expose the host to attacks, so the system can be compromised.
  • By default it submits data to Sicherheitstacho unless you remove the ewsposter section.

Topics

#honeypot#network-security#threat-detection#docker#elasticsearch#kibana#intrusion-detection#deception#elk#security

FAQ

What is tpotce?
All-in-one multi-honeypot platform that runs 20+ honeypots with Elastic Stack dashboards, live attack maps and security tools. T-Pot is a honeypot platform that deploys a collection of deception services on one host, so security teams can observe real attack traffic against many protocols at once. It runs its honeypots as Docker containers managed with docker compose, and the README lists more than 20 of them, including Cowrie, Dionaea, Conpot, Heralding and Log4Pot, plus LLM-based options such as Beelzebub and Galah.
Is tpotce free to use? What license does it have?
tpotce is open source under the GPL-3.0 license. Check the license terms before using it in commercial products.
Is tpotce still maintained?
Actively maintained. The last commit to tpotce was on Oct 21, 2026.
What can I use tpotce for?
Studying real-world attack patterns against exposed SSH, Telnet, web and industrial protocols. Running a honeypot sensor network that reports to a central hive. Teaching threat detection and log analysis with a ready-made Kibana dashboard set. Evaluating LLM-based honeypots such as Beelzebub or Galah with a local Ollama instance.
How do I install tpotce?
Install curl if not already installed: sudo [apt, dnf, zypper] install curl Run the official installer as a non-root user from $HOME
Where can I get tpotce?
The source code and installation instructions are on GitHub: https://github.com/telekom-security/tpotce

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects