Home › Docs › Reference

Reference

Reference materials for the honeypot system

Reference Categories

Definitions Glossary Core concepts, detection terms, architecture terms, scoring terms and operations terms in one searchable page. 5 sections Workarounds Known Issues & Corrections Current issues, historical bugs that were fixed, and the correction process for documentation. Severity + workaround Planning Roadmap Near-, mid- and long-term work, including the deliberate choice to keep detection rule-based for now. 3 horizons History Changelog Detection pipeline changes, routing and pooling work, and security fixes with the reasoning behind them. Unreleased + historical Sources Primary Literature Academic foundations, technical references for Suricata, AbuseIPDB and Kibana, and related work. Academic + technical Quick lookup Reference Hub A compact page of key terms and tables for when you do not want to read a full section. One screen

Architecture Reference

The decision logic lives in pure *_rules.lua modules with no ngx.* dependency, each with a matching test_*.lua suite; thin adapters do the I/O. The module table (pure module, adapter and purpose) is on Architecture → Lua Modules, and their run-time behaviour is on Lua Internals.

Honest Assessment

Strengths: comprehensive, explainable rule-based detection; a pure/adapter split that keeps the decision logic unit-tested; per-session adversary isolation on dedicated pools; a privacy-preserving, consent-gated device signature; a choice of honeypot layer; and full telemetry through the SIEM pipeline.

Limitations: same-host testing gap (unverified against genuine external traffic); decay complexity (four tunable parameters); honeytoken coverage (five types); no ML; a Redis dependency on the state path; pool scaling bounded by the memory / CPU / count budget; the database layer cannot isolate file-upload or RCE attacks; and dashboard drift between offline and live state. See Known Issues for the full list and workarounds.