I mainly use Beelzebub as traps within my internal network, and I also find the API honeypot feature very useful. For example, I have set up honeypot routes such as /v3/ on my API Gateway. Thanks to this configuration, I am able to catch more sophisticated API-side attacks.
Honeypots have transformed network security with advanced traps for API-side attacks
What is our primary use case?
How has it helped my organization?
Thanks to these traps, we are much more confident about preventing lateral movement.
What is most valuable?
One of the most interesting features is the LLM Honeypot. It feels like having a high-interaction honeypot with all the benefits of a low-interaction one. I can leave it running 24/7 without any monitoring.
What needs improvement?
Beelzebub could be improved by providing a SaaS or monitoring dashboard for the various honeypots.
For how long have I used the solution?
I have been using this honeypot for about two years, and now it can finally be integrated into AWS with just a few clicks.
Which solution did I use previously and why did I switch?
I used to run real EC2 servers as high-interaction honeypots, but I dropped that approach because Beelzebub is much smarter. With a simple YAML file, I can spin up a fleet of highly realistic and secure honeypots.
What's my experience with pricing, setup cost, and licensing?
Beelzebub is open-source, and this AWS integration is also free. I hope this integration continues to be free.
Which other solutions did I evaluate?
I have not used any alternate solutions.
What other advice do I have?
Beelzebub would benefit from having a SaaS or monitoring dashboard for the various honeypots.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
showing 1 - 1