honeypot-SKILL.md

Deploy honeypot networks by configuring OpenCanary, Cowrie, or T-Pot on Linux hosts to attract and observe attacker activity. This skill coordinates multiple deception technologies to detect unauthorized access and lateral movement within enterprise networks, providing structured outputs for incident response.

Extract threat intelligence from honeypot data by integrating honeypot logs with SIEM and threat intel workflows. This skill supports logging and threat intel extraction from deployed OpenCanary and Cowrie instances to derive actionable indicators of compromise for incident response.

Yes, this honeypot deployment supports OpenCanary, Cowrie, and T-Pot simultaneously. The skill coordinates multiple deception technologies, allowing security operators to configure and manage these platforms together to observe credential theft and attacker reconnaissance.

Configure Cowrie through this skill to attract and log attacker interactions, enabling the study of attacker techniques and credential stuffing experiments. It provides a structured output for incident response by observing unauthorized access attempts and capturing attacker activity.

Yes, you can integrate honeypot logs with existing SIEM workflows. The skill supports logging and threat intel extraction, allowing security operators to feed indicators of compromise derived from OpenCanary or T-Pot data directly into broader security monitoring and incident response pipelines.