Overview
A honeypot in Honeypot Service must be associated with an exposure probe before it can run properly. There is no required order for creating the two. You can create either one first and then associate the other with it. This document describes how to create and manage honeypots.
Creating a Honeypot Service
1. Log in to the CFW console. In the left sidebar, click Network Honeypot > Honeypot Service. 2. On the Honeypot Service page, click Create honeypot.
3. In the creation window, select a creation method and click Next.
Create a honeynet: select from the preset templates under the honeynet category.
Create a honeypot: select the desired honeypot service type.
4. Configure the relevant parameters based on the selected creation method.
If you select honeynet: a honeynet corresponds to a complete simulation scenario (public network entry honeypot + private network member honeypots). Internal networking and decoy orchestration are automatically completed by the system, so no item-by-item configuration is required. You only need to set Region. Information such as the entry honeypot, member honeypots, and quota consumption is automatically populated based on the selected template.
If you select honeypot: configure the relevant parameters according to the following table. The available options for interaction type, decoy, and custom decoy vary by honeypot type, and the page dynamically displays the options supported by the current type.
|
Honeypot service | Displays the default open ports and detailed information of the selected honeypot. |
Region | Supports all regions in China and cannot be changed after the instance is created. |
Instance name | Customize the instance name. |
Interaction type | Select the interaction depth of the honeypot. Real service is high-interaction, where the backend runs real services and decoys, and responds to every attacker request in real time. Simulated service is medium-interaction, where the backend runs simulated services and decoys, generates simulated responses based on some attacker requests, and lures the attacker to continue. |
Bait | Select from the decoys provided by the system for this honeypot type. Some honeypot types do not provide decoys. |
Custom bait | Select from the custom decoy options provided by the system for this honeypot type to configure personalized decoys such as login credentials. Some honeypot types do not provide this option. |
5. Bind an exposure probe.
Select from existing probes: Select the desired probe instance and port number, and click OK.
Configure later: do not bind a probe and click OK.
Note:
A honeypot service takes effect only after it is bound to a probe. If you select Do not set now, you can rebind the probe by editing the honeypot after creating it, or bind the honeypot to a probe on the probe page. Honeypots in a honeynet do not support individual probe binding. After creating the honeynet, bind the public-facing entry honeypot of the honeynet to a probe as a whole by using Create an Exposure Probe. 6. You can enable honeypots individually or in batches.
Single: select the target honeypot, click the toggle icon in the toggle column, and click OK in the confirmation dialog to enable the current honeypot service.
Batch: select one or more honeypots, click Enable Honeypot, and click OK in the confirmation dialog to enable the selected honeypot services.
Note:
When you enable a single honeypot in a honeynet, all honeypots in the honeynet are enabled simultaneously.
Managing Honeypot Services
Editing a Configuration
2. In the Edit Honeypot Service dialog, you can modify the instance name and the associated exposure probe. Click OK to save the changes.
Note:
Honeypots in a honeynet cannot be edited individually, and their configurations are managed by the honeynet. To make adjustments, delete the honeynet and create it again.
Deleting a Honeypot
Single: select the target honeypot, click Delete in the operation column, and click OK in the confirmation dialog to delete the honeypot.
Batch: select one or more honeypots, click Delete, and click OK in the confirmation dialog to delete the selected honeypots.
Note:
Deleting a honeypot is a high-risk operation and cannot be undone. When you delete any member honeypot in a honeynet, the system cascades the deletion to all honeypots and probes in the honeynet and releases the corresponding quotas simultaneously. Make sure to check the members to be deleted in the confirmation dialog before you proceed.
Filtering/Sorting
On the Honeypot Service page, click the search box and filter honeypot service events by keywords such as honeypot ID, honeypot name, and honeynet ID. Click the Honeypot Service, Region, and Interaction type column headers in the honeypot service list to filter honeypot service events. You can filter by Honeynet ID or Honeynet Type to quickly locate all honeypots in the same honeynet. For regular honeypots that do not belong to a honeynet, this field displays -.
Click the Associated probes, Hit count, and Captured attackers column headers in the honeypot service list to display honeypot service events in ascending or descending order.
Honeypot Settings
1. Log in to the CFW console. In the left sidebar, select Network Honeypot, and click Honeypot settings in the upper-right corner. 2. In Honeypot Settings, configure the automatic rebuild policy after a honeypot is compromised:
Automatic Reconstruction: After this feature is enabled, a compromised honeypot is automatically rebuilt after the specified delay.
Delay time: The delay before a compromised honeypot is rebuilt after the first detection of a compromise event. Select as needed. If you select Immediate, the honeypot is automatically rebuilt after the system detects in the background that the attacker has initiated a large number of malicious outbound connections.