- Home
- Tools
- Security Operations
- Honeypots & Deception
- mhn-core-docker
mhn-core-docker
A Docker-based honeypot network implementation featuring cowrie and dionaea honeypots with centralized event collection, geolocation enrichment, and real-time attack visualization.

mhn-core-docker
A Docker-based honeypot network implementation featuring cowrie and dionaea honeypots with centralized event collection, geolocation enrichment, and real-time attack visualization.
mhn-core-docker Description
A Docker-based implementation of a subset of the Modern Honey Network project that provides a containerized honeypot infrastructure. The system consists of multiple Docker containers working together: - A broker container that runs an hpfeeds broker, allowing clients to publish to channels or subscribe to channels - A cowrie container that runs the cowrie SSH/Telnet honeypot and connects to the broker to publish attack events - A dionaea container that runs the dionaea multi-protocol honeypot, connects to the broker, publishes events, and stores captured malware binaries Additional components include: - A geoloc application that subscribes to cowrie channel events and adds geolocation information - A honeymap application that creates a visual map of attacks by subscribing to the geoloc channel and serving it on port 3000 The setup requires creating a Docker network with static IP addressing and building the broker image from the provided repository. The system provides real-time visualization of honeypot activity through the web-based honeymap interface.
mhn-core-docker FAQ
Common questions about mhn-core-docker including features, pricing, alternatives, and user reviews.
mhn-core-docker is A Docker-based honeypot network implementation featuring cowrie and dionaea honeypots with centralized event collection, geolocation enrichment, and real-time attack visualization.. It is a Security Operations solution designed to help security teams with Visualization, Attack Detection.