We are very happy to announce The Honeynet Project Workshop 2025, scheduled to take place in Prague, Czech Republic, from June 2nd to 4th. The event will be hosted at the National Technical Library (NTK) and will feature a combination of cybersecurity briefings and advanced hands-on training sessions.
We are thrilled to announce The Honeynet Project Workshop 2024, scheduled to take place in Copenhagen, Denmark, from May 27th to 29th. The event will be hosted at the Mødecenter of the Technical University of Denmark and will feature a combination of cybersecurity briefings and hands-on training sessions.
IntelOwl’s analyzers do the heavy lifting of threat intelligence i.e. scanning observables against dozens of services and producing structured results. But analysis in isolation is only half the picture. The connectors are what close the loop: they take those results and push them out to external platforms like MISP, OpenCTI, and YETI for further correlation, or to communication tools like Slack for real-time alerting.
Our GSoC student Krishna Awasthi spent three months working under the supervision of Tim Leonhard on GreedyBear and a new companion project, tpot-payload-server, building a complete pipeline to capture, quarantine, and share the malware payload files that T-Pot honeypots collect from live attackers.
Read on for an overview of the project, the technical decisions behind it, and what shipped.
Student: Krishna Awasthi (opbot-xd)
Mentors: Tim Leonhard
Organization: The Honeynet Project
Project: GreedyBear · tpot-payload-server
I spent this summer as a GSoC contributor on GreedyBear under the mentorship of Tim Leonhard, refactoring its hardcoded dashboard into a configuration-driven widget system with a drag-and-drop admin editor and backend persistence.
Mentor: Tim Leonhard
Organization: The Honeynet Project
Project: GreedyBear: Dashboard Modularization
The goal of my project was to modularize the GreedyBear dashboard.
Before this project, every widget - its type, data source, position, and column span was hardcoded directly in Dashboard.jsx. Adding a new chart meant editing the layout file by hand, and there was no way for an admin to customize the dashboard without touching source code and redeploying.
Our GSoC student Dorna Raj Gyawali spent three months working under the supervision of Tim Leonhard on the GreedyBear project, focusing on introducing an Event Collector API to make it easier for external honeypots and sensors to submit IOC events to GreedyBear.
Read on for an overview of their achievements and how they successfully contributed towards GreedyBear and some considerations for the future.
Student: Dorna Raj Gyawali (drona-gyawali)
Mentors: Tim Leonhard
Contributor: Francesco Berardi
Mentors: Matteo Lodi
An analyst opens IntelOwl, types “is job #40 malicious?”, and gets back:
Job #40 is classified as malicious with a reliability score of 7 out of 10. The verdict was supported by 2 analyzers and contradicted by 1 analyzer, while the remaining 3 analyzers did not provide an opinion (silent).
No API key. No token bill. No byte of that observable ever left the machine.
That is what I built for Google Summer of Code 2026 with The Honeynet Project: a conversational interface embedded in IntelOwl, running entirely on a locally-hosted LLM. This post explains how it works, what I measured, and what did not work.
For several years The Honeynet Project has operated a network of distributed honeypots. While operating a sensor network over multiple years, we’ve improved our ability to leverage orchestration to deploy in a variety of environments, manage the various sensors, and improve them over time.
An early problem was simply how to manage honeypots running the same sensor software but deployed in very different environments. Further, the sensors needed to be lightweight and require as few resources as possible (so that we could deploy as many as possible). Luckily this effort didn’t require very much net-new orchestration and started out by relying on what had already been developed for tpot. Putting it all together, Ansible has really served as the backbone for bringing up new systems, and making it very easy to customize the sensors and deploy changes. Better yet, the effort into orchestration efforts make the individual sensors semi-disposable; their data is valuable but the sensors themselves are disposable and easily replaced by spinning up more instances.
Contributor: Kunal Gurtatta Mentors: Lorena Goldoni, Federico Foschini
As a Python developer and security enthusiast, I always wanted to contribute to open-source security projects. When I learned about GSoC from one of my seniors, I started searching for security organizations and came across Honeynet. They had just announced their ideas for this year’s GSoC, and one of them was BuffaLogs, which matched my tech stack perfectly. I began contributing in late Feb'25, submitting PRs to implement alerters and making small refactors to get familiar with the codebase. Since my early contributions focused on alerters, I decided to continue working on integrating more of them and improving the alerting logic in my proposal.
Contributor: Onunwa Goodness Mentors: Lorena Goldoni, Federico Foschini
September 1, 2025 officially marks the end of the Google Summer of Code (GSoC) 2025 coding period. Over the past four months, I’ve had the privilege of contributing as a developer to The BuffaLogs Project under The Honeynet Project. It’s been four months of doing what I love most—building and shipping code.