How it works

Cloud VPSes in several regions expose SSH/Telnet (Cowrie) and a custom HTTP(S) honeypot that impersonates Fortinet, Palo Alto, Ivanti, Citrix, routers, WordPress and more on 10 ports.

Vector tails the JSON logs and batches them over a WireGuard tunnel to the core, with a disk buffer so nothing is lost if the core restarts.

FastAPI authenticates each sensor by token and appends raw records to a Redis Stream, so ingestion never blocks on enrichment.

A consumer-group worker normalizes every honeypot format into one event schema, geolocates the source IP, and runs the signature + ATT&CK engines.

TimescaleDB hypertable with compression and continuous aggregates. KEV and EPSS feeds sync daily; AbuseIPDB and MalwareBazaar lookups stay within free-tier rate limits.

This Next.js app: REST for aggregates, a WebSocket fan-out from Redis pub/sub for the live map.

• 85 CVE signatures modelled on public PoCs and observed exploit traffic, each unit-tested with a positive payload and benign negatives.
• Every match is cross-referenced with the CISA KEV catalog (exploited in the wild, ransomware use) and the EPSS exploit-probability score.
• 30+ MITRE ATT&CK technique mappings for post-login shell activity: discovery, persistence, defense evasion, resource hijacking.
• Recon classification: secret-file hunting, VCS exposure, webshell probes, scanner fingerprints.
• Session triage: each closed session gets an actor / intent / severity verdict. Verdicts come from rules over the session's logins, commands, exploits and downloads, and bots replaying the same script are grouped by fingerprint.

• Honeypots run unprivileged in read-only containers with all capabilities dropped, on an isolated bridge whose egress is firewalled.
• Nothing an attacker sends is executed: Cowrie emulates the shell, and the HTTP honeypot only returns canned responses.
• SSH port-forwarding is disabled, so the honeypot cannot be used as a relay.
• Malware is stored as hashes only; URLs and IPs inside payloads are defanged before display.

Honeyjar is built by Velislav Rumenov, a backend software engineer who is applying that background to security: the sensors, the ingest and enrichment pipeline, the CVE and ATT&CK detection rules, the deployment and this dashboard. The full source is public.