How can I add my own honeypot to T-POT?

[alfonsogomezmartinez]

I have developed my own honeypot, which works similarly to the ICS pot. Is there any way to integrate it into T-pot? Maybe using docker containers?

[Ganesh-403]

@alfonsogomezmartinez
Yes, you can integrate your own honeypot into T-Pot, and Docker is the recommended way to do it.

T-Pot itself is essentially an orchestration platform built around Docker Compose. Each bundled honeypot runs as its own container, so a custom honeypot can be integrated by adding it as another service in the T-Pot compose stack rather than modifying the T-Pot source code. :contentReference[oaicite:0]{index=0}

A typical approach would be:

1. Containerize your honeypot

   • Create a Dockerfile for your application.
   • Ensure it writes logs to a predictable location (JSON is ideal if you want to ingest them into Elasticsearch).

2. Add it as a service

   • Either modify ~/tpotce/docker-compose.yml, or
   • Use the built-in compose/customizer.py to generate a customized compose file and then add your service to it. The T-Pot documentation recommends this workflow for tailoring installations and avoiding port conflicts. :contentReference[oaicite:1]{index=1}

A simplified example might look like:

services:
  myhoneypot:
    image: myhoneypot:latest
    container_name: myhoneypot
    restart: always
    ports:
      - "502:502"
    volumes:
      - ./data:/data
    networks:
      - myhoneypot_local

3. Integrate logging (optional but recommended)

If you want your honeypot's events to appear in Kibana alongside the built-in honeypots, you'll also need to configure Logstash (or another ingestion mechanism) to parse your logs and send them to Elasticsearch.

For example, if your honeypot produces JSON logs:

input {
  file {
    path => "/data/myhoneypot/events.json"
    codec => json
    type => "MyHoneypot"
  }
}

From there you can add filters (if needed) and send the events to Elasticsearch so they become searchable in Kibana.

Things to keep in mind

• Make sure your honeypot doesn't expose ports already used by another T-Pot service—the customizer helps detect these conflicts. :contentReference[oaicite:2]{index=2}
• If your honeypot has special networking requirements, you can attach it to the existing T-Pot Docker networks or define a dedicated network in the compose file.
• Any changes made directly inside running containers are ephemeral. It's better to build your own Docker image and manage it through Docker Compose.

One question that would help provide more specific guidance:

• Is your honeypot network-facing (e.g. an ICS/OT protocol server like Modbus, DNP3, S7, etc.), or is it an application that consumes traffic/logs? The integration approach is slightly different depending on whether it needs to expose ports or simply generate events.

If this solves your problem, feel free to mark it as the accepted answer so others can find it easily.