Verdict check with stored data

[pranay1015]

Is it possible to add additional honeypot servers with extra containers to a standard installation setup? Furthermore, if I wish to do a verdict check with my honeypot data, how to do it?

[Ganesh-403]

@pranay1015
Yes, both are possible, but they involve different parts of the T-Pot architecture.

1. Can I add additional honeypot servers/containers to a standard installation?

Yes.

T-Pot is built on Docker Compose, so you can extend a standard installation by adding additional containerized honeypots. The project also provides a customizer to generate your own compose configuration and avoid port conflicts, rather than modifying the running containers directly. :contentReference[oaicite:0]{index=0}

If your additional honeypot is on the same host, you can:

• Add it as another service in docker-compose.yml, or
• Generate a custom compose file using the T-Pot customizer and include your service there.

If the honeypot is on a different server, the recommended architecture is to deploy it as a Sensor and forward its events to a central Hive instance, rather than trying to merge multiple standalone installations. :contentReference[oaicite:1]{index=1}

---

2. How can I perform a verdict check on the stored honeypot data?

That depends on what you mean by "verdict check."

If you're referring to checking indicators (IPs, domains, hashes, URLs) against threat intelligence sources, T-Pot does not include a built-in verdict engine for historical events.

A common approach is to:

1. Query the stored events from Elasticsearch.
2. Extract the indicators of interest (e.g. src_ip, hashes, URLs).
3. Enrich them using external services such as:
   • VirusTotal
   • AbuseIPDB
   • AlienVault OTX
   • MISP
   • or another internal threat intelligence platform.
4. Store the enrichment results back into Elasticsearch or use them in your own dashboards.

Since T-Pot persists all honeypot data and indexes it into Elasticsearch, you can retrieve the data using the Elasticsearch REST API or Kibana for this kind of post-processing. :contentReference[oaicite:2]{index=2}

For example, using Python:

from elasticsearch import Elasticsearch

es = Elasticsearch("http://localhost:64298")

result = es.search(
    index="*",
    query={"match_all": {}}
)

for hit in result["hits"]["hits"]:
    print(hit["_source"])

You can then enrich fields such as source IPs or file hashes before generating your own verdicts.

Could you clarify one thing?

When you say "verdict check", do you mean:

• checking captured IPs/files against external threat intelligence (e.g. VirusTotal, AbuseIPDB),
• running malware analysis on downloaded samples,
• or classifying attacks using your own detection logic?

The recommended solution depends on which type of verdict you're looking for.

If this solves your problem, feel free to mark it as the accepted answer so others can find it easily.