Most honeypots log what happened. Echidra tells you what kind of attacker you're looking at.
It simulates SSH, HTTP, FTP, and Telnet services with a believable Linux persona, then runs every session through a deterministic classifier — actor type, risk score, MITRE ATT&CK technique, intent — before it hits your dashboard. Nothing attackers type ever touches the real host.
Here's the part that actually mattered, and why I made the calls I did.
The part that actually solved my original problem
Every session gets run through a classifier when it ends. It's rule-based right now, not ML — a set of YAML rules that map session features to an actor type, a risk score, a MITRE ATT&CK technique, and a guess at intent. So instead of opening a log file, I open a dashboard and see which sessions were credential-stuffing bots, which were somebody manually poking around, and which looked like they were trying to establish persistence.
A rule looks roughly like this — you're matching on session features (commands run, timing, protocol) and mapping them straight to a classification:
- id: credential_stuffing_bot
match:
protocol: ssh
auth_attempts: ">5"
session_duration_seconds: "<3"
commands_run: 0
classify:
actor_type: automated_bot
risk_score: 40
mitre_technique: T1110 # Brute Force
intent: credential_access
Nothing fancy — no model, no training data. Just enough structure that when a session comes in with five failed logins in under three seconds and zero commands, I don't have to open a log file to know it's a script, not a person. The rules I've hand-tuned so far already sort out the obvious bots from sessions where someone is actually looking around, checking whoami, poking at /etc/passwd — the ones worth a closer look.
Setup
pip install -e .
echidra init
echidra start
That's it — runs the listeners and the dashboard together. If you don't have Postgres configured it just logs to
logs/sessions.jsonl
and still works fine, Postgres just gets you the full dashboard history.
Things I'd still call rough
The classifier rules are hand-tuned, not learned, so they're only as good as what I've seen hit my own honeypot so far. If you run one of your own I'd like to know what patterns you're seeing that this doesn't catch — new attacker behavior means new rules, and right now that loop is entirely manual.
Repo's here if you want to look at the rule engine or just run it:
Qyleron
/
EchidraOSS
Open-source deceptive honeypot & attacker-behavior classifier — SSH/HTTP/FTP/Telnet decoys with MITRE ATT&CK-tagged threat intelligence and a live dashboard.
Echidra — Multi-Protocol Honeypot & Attacker Behavior Classifier
Echidra is an open-source deceptive honeypot and threat-intelligence platform that simulates attacker-facing SSH, HTTP, FTP, and Telnet services, captures real attacker behavior, classifies it against MITRE ATT&CK techniques, and surfaces the result in a web dashboard — without ever executing real commands or exposing real data.
Docs & full setup guide · Console guide
What Is Echidra?
Echidra pretends to be a Linux server. Attackers connect over SSH-style TCP HTTP, FTP, or Telnet and see a believable, persona-driven system: real-looking banners, users, files, running processes, and (for the shell) an interactive fake command set. Nothing they type touches the real host or filesystem.
Every completed session is logged, classified (actor type, risk, MITRE ATT&CK
technique, intent), geolocated, and stored in PostgreSQL — or logs/sessions.jsonl
if PostgreSQL isn't configured — for review in the dashboard.
Features
- Honeypot listeners — SSH-style fake shell, HTTP…
Top comments (0)