Beelzebub Low-Code Honeypot Framework

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Beelzebub is an open source, low-code honeypot and deception framework. It stands up low-interaction decoy services that look like real infrastructure - a fake SSH shell, a fake web server, a fake database - so that any connection to them is, by definition, suspicious. Every interaction is captured as a structured event and exposed as Prometheus metrics, giving you an early-warning tripwire for reconnaissance and intrusion attempts inside your network, all defined in simple YAML. This image delivers it fully installed and running under systemd, so a working deception layer is listening within minutes of launch.

Unlike multi-container honeypot stacks that require orchestration expertise, or single-protocol tools that cover only SSH, this AMI gives you multiple decoy protocols from a single Go binary with no container runtime, no build toolchain, and no manual systemd or nginx configuration required.

## Deception and Attack Capture

Out of the box the image runs three decoy services - an SSH decoy, an HTTP decoy and a database decoy - each defined by an editable YAML file you can extend or replace with your own decoys. When something connects, Beelzebub records the interaction as a structured event and increments its Prometheus counters, so you can scrape the activity into your SIEM, dashboards and alerting. Because nothing legitimate should ever touch a honeypot, every event is worth investigating. The decoys use static, built-in responses, so no external API key is needed; the optional AI-backed shell is disabled by default and is enabled only if you choose to supply your own key.

## Two Separate Surfaces, Secure by Default

A honeypot's decoy services are meant to be inviting, and they run inside Beelzebub's own sandbox so they grant no real access to the host. This image keeps your real administrative SSH on its own standard port, entirely separate from the decoy SSH, so deploying the honeypot never interferes with how you manage the instance. The Prometheus metrics endpoint is bound to the loopback interface and served through an nginx reverse proxy that is ready for your TLS certificate. An unauthenticated health endpoint is available for load balancer probes, while the metrics endpoint requires a password. There are no shared or default credentials - a unique password is generated on each instance's first boot and written to a root-only file. The shipped security group opens only the administrative SSH port and the metrics port; the decoy ports are closed until you deliberately open them.

## Hardened, Minimal Image

The Go binary is compiled from the pinned upstream release during image build, and the compiler and source tree are removed before the image is captured, so what ships is a single static binary with no build toolchain left behind. The daemon runs as a dedicated non-root user under a hardened systemd unit, and the operating system ships fully patched with unattended security updates enabled.

## Ready to Use

Connect over SSH on the administrative port and the honeypot is already running. Read the welcome notes for your first-boot metrics password and the decoy port numbers, open the decoy ports to the networks you want to observe, scrape the metrics, and watch an interaction being logged. The paired deployment guide walks through retrieving the metrics password, scraping the metrics, watching a capture land in the event log, and adding your own decoy services.

Want a guided walkthrough before you commit? Contact cloudimg support to schedule a brief deployment consultation at no extra charge.

## Use Cases

• SOC tripwire in production VPCs - Place a decoy in each subnet alongside your application tier. When lateral movement from a compromised host touches the honeypot, your SOC analyst receives a Prometheus alert routed through Alertmanager or Amazon SNS within seconds, triggering your incident response playbook before the attacker reaches real assets.

• Security research sensor - Deploy one or more instances in a public-facing subnet to study scanning patterns, credential-stuffing dictionaries, and post-authentication commands. Export structured events to Amazon S3 or OpenSearch for longitudinal analysis of attacker behaviour across campaigns.

• Deception layer for regulated environments - Financial services and healthcare teams use honeypots to satisfy detection-in-depth controls. Place decoys alongside sensitive workloads so that any unauthorized internal access attempt generates an auditable alert, supporting compliance narratives for frameworks that require intrusion detection capabilities.

## cloudimg Support

24/7 technical support by email and live chat.