Sentinel and T-Pot

[Jeroenvdbroek]

Hello all.

I found a old manual how to make sentinel and t-pot work together. https://swiftsolves.substack.com/p/how-to-wire-t-pot-events-to-microsoft

But that one is not relevant anymore since the latest version of t-pot. I managed to convert and do most config work. But what i can not get to work is the installment of the of the sentinel log stash output plugin.

I added it to the Docker file of logstash so in: tpotce/docker/elk/logstash/Dockerfile
i added: bin/logstash-plugin install microsoft-sentinel-log-analytics-logstash-output-plugin

And in the tpotce/docker-compose.yml
I added under ##logstash service
build:
context: /home/azureuser/tpotce/docker/elk/logstash
dockerfile: ./Dockerfile

But this seems not to work. The t-pot service will also not start.

If this is all to difficult or not possible i have a other questrion.
Can t-pot just log the attacks (just that there is a attack is already enough info) outside the container so i can pick it up there with azure monitor?

[Ganesh-403]

@Jeroenvdbroek
There are actually two separate questions here.

1. Installing the Microsoft Sentinel Logstash output plugin

Your approach is conceptually correct—you need a custom Logstash image if you want to install additional plugins. However, if tpot.service won't start after adding the build: section, it usually means the image failed to build or the plugin installation failed during the Docker build.

A few things to verify:

1. Build the image manually to see the actual error:

   cd ~/tpotce
   docker compose build logstash

   or:

   docker build -t tpot-logstash-custom docker/elk/logstash

2. Check that your bundled Logstash version is supported by the Microsoft plugin. Microsoft only supports specific Logstash versions, and version mismatches can cause plugin installation failures. :contentReference[oaicite:0]{index=0}

3. If the build succeeds, confirm the plugin is installed:

   docker run --rm tpot-logstash-custom \
     bin/logstash-plugin list | grep microsoft

The plugin itself is installed using:

bin/logstash-plugin install microsoft-sentinel-log-analytics-logstash-output-plugin

which is the documented installation method. :contentReference[oaicite:1]{index=1}

---

2. Can T-Pot simply write logs outside the container?

Yes, and this is probably the simpler solution.

T-Pot already persists honeypot logs on the host through Docker bind mounts. From there you can use the Azure Monitor Agent (AMA) or another collector to ingest them into Microsoft Sentinel, without modifying the Logstash container.

Depending on the honeypot, you'll find JSON logs under directories such as:

~/tpotce/data/<honeypot>/log/

For example:

~/tpotce/data/cowrie/log/cowrie.json

These files are continuously updated by the containers and are intended to persist outside the container lifecycle.

If your goal is simply:

"Notify Sentinel that an attack occurred"

then collecting these JSON log files with AMA (or another supported agent) is considerably simpler than replacing T-Pot's Logstash output pipeline.

---

Which approach would I recommend?

Unless you specifically want Logstash → Sentinel as your only output, I'd recommend leaving the T-Pot ELK pipeline intact and letting Azure Monitor collect either:

• the raw honeypot JSON logs from the host, or
• the Elasticsearch indices (if that's a better fit for your environment).

This keeps your T-Pot installation closer to the supported deployment model while still getting the events into Microsoft Sentinel.

One question that would help determine the best solution:

• Are you trying to replace Elasticsearch entirely with Sentinel, or do you simply want a copy of the attack events to appear in Sentinel while continuing to use Kibana locally?

If this solves your problem, feel free to mark it as the accepted answer so others can find it easily.