Overview
Beelzebub
A secure low code honeypot framework, leveraging AI for System Virtualization. https://github.com/mariocandela/beelzebub
Beelzebub is an advanced honeypot framework designed to provide a highly secure environment for detecting and analyzing cyber attacks. It offers a low code approach for easy implementation and uses AI to mimic the behavior of a high-interaction honeypot.
Highlights
- LLM honeypot, AI Honeypot, Deception, Decoy, MCP Honeypot, SSH Honeypot
- https://github.com/mariocandela/beelzebub
Details
Unlock automation with AI agent solutions

Features and programs
Financing for AWS Marketplace purchases
Pricing
Vendor refund policy
Always
How can we make this page better?
Legal
Vendor terms and conditions
Content disclaimer
Delivery details
Beelzebub container
- Amazon ECS
- Amazon EKS
- Amazon ECS Anywhere
Container image
Containers are lightweight, portable execution environments that wrap server application software in a filesystem that includes everything it needs to run. Container applications run on supported container runtimes and orchestration services, such as Amazon Elastic Container Service (Amazon ECS) or Amazon Elastic Kubernetes Service (Amazon EKS). Both eliminate the need for you to install and operate your own container orchestration software by managing and scheduling containers on a scalable cluster of virtual machines.
Version release notes
Add and configure decoy MCP tools to detect prompt injection attacks against LLM agents. Collect attack prompts in real time and use them for guardrail fine-tuning.
Additional details
Usage instructions
Official docs: http://docs.beelzebub.cloud/Â
Resources
Vendor resources
Support
Vendor support
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Customer reviews
Honeypots have transformed network security with advanced traps for API-side attacks
What is our primary use case?
I mainly use Beelzebub as traps within my internal network, and I also find the API honeypot feature very useful. For example, I have set up honeypot routes such as /v3/ on my API Gateway. Thanks to this configuration, I am able to catch more sophisticated API-side attacks.
How has it helped my organization?
Thanks to these traps, we are much more confident about preventing lateral movement.
What is most valuable?
One of the most interesting features is the LLM Honeypot. It feels like having a high-interaction honeypot with all the benefits of a low-interaction one. I can leave it running 24/7 without any monitoring.
What needs improvement?
Beelzebub could be improved by providing a SaaS or monitoring dashboard for the various honeypots.
For how long have I used the solution?
I have been using this honeypot for about two years, and now it can finally be integrated into AWS with just a few clicks.
Which solution did I use previously and why did I switch?
I used to run real EC2Â servers as high-interaction honeypots, but I dropped that approach because Beelzebub is much smarter. With a simple YAML file, I can spin up a fleet of highly realistic and secure honeypots.
What's my experience with pricing, setup cost, and licensing?
Beelzebub is open-source, and this AWSÂ integration is also free. I hope this integration continues to be free.
Which other solutions did I evaluate?
I have not used any alternate solutions.
What other advice do I have?
Beelzebub would benefit from having a SaaS or monitoring dashboard for the various honeypots.