2.1 Dashboard Overview
The Guardpots module serves as the central management interface for all deployed honeypot instances. Each honeypot is displayed as a card or list item containing operational details, as shown in Figure 2.2-1.
Figure 2.2-1 – Guardpots Management Interface
2.2.1 Toolbar Functions
The top toolbar provides comprehensive management controls for the honeypot fleet, as highlighted in Figure 2.2.1-1.
Figure 2.2.1-1 – Guardpots Toolbar Overview
Button | Function |
|---|---|
Search Guardpots | Search honeypots by name or IP address with real-time filtering |
Grid View | Display honeypots as cards in a grid layout |
List View | Display honeypots in a tabular list format |
Sort (↑↓) | Sort by Name (A-Z, Z-A), Date, or Status |
Filter | Filter by status: Active, Passive, Offline, or Update etc. |
2.2.2 Searching and Filtering Guardpots
The Search Guardpots field, located in the top toolbar as shown in Figure 2.2.2-1, allows you to quickly locate specific honeypots by name or IP address. As you type, the displayed cards filter in real time to match your search query.
Figure 2.2.2-1 – Search Guardpots Field
The Sort dropdown (↑↓) enables ordering the displayed honeypots by the following criteria:
Sort Option | Description |
|---|---|
Name (A-Z) | Alphabetical ascending order by honeypot name |
Name (Z-A) | Alphabetical descending order by honeypot name |
Status | Grouped by current operational state (Active, Passive, Offline) |
Version | Ordered by software version number |
Location | Grouped by geographic location assignment |
ID | Ordered by system-assigned unique identifier |
The Filter dropdown restricts the view to specific honeypot states:
Filter Option | Description |
|---|---|
Active | Currently running and responsive honeypots |
Passive | Deployed but not actively engaging with traffic |
Offline | Non-responsive or powered-off instances |
Update Available | Honeypots with pending software updates |
2.2.3 Creating a New Guardpot
To deploy a new honeypot, click the New button located in the top toolbar, as shown in Figure 2.2.3-1. The system offers two distinct installation methods.
The Guardpot Pool button provides access to pre-configured machine templates for rapid honeypot deployment, as shown in Figure 2.2.6-1. This pool displays all managed machines available for honeypot installation.
Figure 2.2.3-1 – New Guardpot Button
2.2.3.1 Remote Install Method
The Remote Install method provides the simplest deployment experience. Guardpot automatically connects to the target machine via SSH and performs the installation on your behalf. This method requires root-level SSH access to the target system.
To use Remote Install, provide the following parameters as shown in Figure 2.2.3.1-1:
Figure 2.2.3.1-1 – Remote Install Configuration
Parameter | Description |
|---|---|
Server IP | IP address of the target machine where Guardpot will be installed |
SSH Port | SSH service port on the target machine (default: 22) |
SSH Username | User account with root or sudo privileges |
SSH Password | Password for the specified user account |
Once submitted, Guardpot establishes an SSH connection to the target machine, downloads and installs the honeypot agent, and automatically registers it with the management panel.
Important: The specified user must have root privileges, as the installation process requires system-level access to configure services and network interfaces.
2.2.3.2 Serial Key Method
The Serial Key method requires manual installation of the Guardpot agent on the target machine, after which it is linked to the management panel using a unique serial key. Choose this method when SSH access is not available or when you prefer to perform the installation manually.
To use Serial Key installation, provide the following parameters as shown in Figure 2.2.3.2-1:
Figure 2.2.3.2-1 – Serial Key Installation Configuration
Parameter | Description |
|---|---|
Name | A descriptive name for the new honeypot instance |
Description | Optional details about the honeypot's purpose or location |
Location | Geographic location assignment for regional organization |
Serial Number or Waiting List ID | Unique identifier to authenticate and link the agent to the panel |
Type | Honeypot type selection based on the services to be emulated |
After completing the form, the system generates a serial key. You must then manually install the Guardpot agent on the target machine using the generated key. The agent authenticates to the management panel securely upon first connection.
Note: For detailed manual installation instructions, refer to the Guide section described in 2.2.4.
2.2.4 Accessing the Installation Guide
The Guide button opens comprehensive installation documentation for all supported operating systems, as shown in Figure 2.2.4-1. This resource is essential when using the Serial Key installation method.
Figure 2.2.4-1 – Installation Guide Interface
The guide provides step-by-step installation instructions for the following platforms:
Platform | Coverage |
|---|---|
Windows | Installation and configuration on Windows Server and Desktop editions |
BSD | FreeBSD, OpenBSD, and NetBSD setup procedures |
Linux | Debian, Ubuntu, CentOS, RHEL, and other major distributions |
2.2.5 Managing Locations
The Location List button organizes honeypots by geographic region, as illustrated in Figure 2.2.5-1. This feature allows you to assign and manage physical or logical locations for your honeypot fleet, enabling region-based filtering, reporting, and attack origin correlation.
Figure 2.2.5-1 – Location List View
2.2.6 Guardpot Pool
The Guardpot Pool button provides access to pre-configured machine templates for rapid honeypot deployment, as shown in Figure 2.2.6-1. This pool lists all managed machines that can host honeypot instances.
Figure 2.2.6-1 – Guardpot Pool Interface
2.2.6.1 Machine Details
Clicking the Detail button (blue) on a machine entry displays comprehensive system information, as shown in Figure 2.2.6.1-1.
Figure 2.2.6.1-1 – Machine Details View
The Details panel displays the following machine information:
Field | Description |
|---|---|
IP Address | The machine's network address (e.g., 8.8.8.0) |
Username | Configured SSH username (displays N/A if not set) |
SSH Port | SSH service port (default: 22) |
Total Guardpots | Number of honeypots deployed on this machine versus maximum capacity (e.g., 0/0) |
CPU | Processor utilization and specifications |
Memory | RAM usage and total capacity |
Disk | Storage usage and total capacity |
The Network Interfaces section at the bottom of the Details panel provides interface and VLAN data. If no data has been fetched yet, the following message is displayed:
🛰️ No Network Interfaces We couldn't detect any interfaces yet. Fetch the configuration to populate interface and VLAN data for this machine.
2.2.6.2 Editing a Machine
To modify a machine's configuration, click the Edit button on the corresponding machine entry, as shown in Figure 2.2.6.2-1. The edit form allows you to update the following parameters:
Figure 2.2.6.2-1 – Edit Machine Configuration
Parameter | Description |
|---|---|
Name * | Machine display name (required) |
IP Address * | Network address of the machine (required) |
Username | SSH username for remote management |
Password | SSH password for authentication |
Port | SSH service port (default: 22) |
2.2.6.3 Deleting a Machine
To remove a machine from the pool, click the Delete (red) button on the corresponding entry. Confirm the deletion when prompted. This action removes the machine from the pool but does not uninstall any Guardpot agents running on it.
2.2.7 G-Hosts Management
The G-Hosts button opens the managed host inventory for QEMU/KVM virtualization support, as shown in Figure 2.2.7-1. If no hosts have been configured, the following empty state is displayed:
No G-host found. Add a host to get started.
Figure 2.2.7-1 – G-Hosts Empty State
2.2.7.1 Adding a New G-Host
To add a new virtualization host, click the New Host button located in the top-right corner of the G-Hosts panel, as shown in Figure 2.2.7.1-1. This opens the G-Host creation form.
Figure 2.2.7.1-1 – New G-Host Button
The G-Host form allows Guardpot to manage QEMU/KVM virtual machines on the specified host. Configure the following parameters:
Figure 2.2.7.1-2 – New G-Host Configuration Form
Parameter | Description |
|---|---|
Name * | A descriptive name for the virtualization host (required) |
Host Address * | IP address or hostname of the KVM/QEMU server (required) |
SSH Username | User account with virtualization management privileges |
SSH Port | SSH service port (default: 22) |
SSH Password | Password for the specified user account |
Max VMs | Maximum number of virtual machines allowed on this host |
Session Snapshot | When enabled, takes a VM disk snapshot after each session. The latest snapshot per session is stored and downloadable from the forensic screen |
Note: The Session Snapshot feature provides forensic preservation capability. When enabled, a snapshot of the virtual machine disk is automatically captured after each attacker session, allowing detailed post-incident analysis. The most recent snapshot for each session is retained and available for download from the forensic investigation interface.
2.2.8 Updating All Guardpots
The Update All button, located in the top toolbar as shown in Figure 2.2.8-1, applies available software updates to all honeypot instances simultaneously. This bulk operation ensures the entire honeypot fleet runs the latest version with current threat signatures and security patches.
Figure 2.2.8-1 – Update All Button
When clicked, the system initiates the update process across all managed honeypots. Progress is displayed per instance, and a summary report indicates successful updates and any failures that may require manual intervention.
2.2.9 Honeypot Card Structure
Each honeypot card displays key operational information at a glance, as shown in Figure 2.2.9-1.
Figure 2.2.9-1 – Honeypot Card Detail
Field | Description |
|---|---|
Name | Assigned honeypot name (e.g., "Auto Detected", "onur2", "Test") |
Status | Active (green indicator) or Passive (red indicator) |
Version | Software version (e.g., 0.1.177, 0.1.176) |
Location | Geographic city assignment (e.g., Bursa, Ankara) |
OS | Operating system emulation (Linux, macOS) |
Public IP | External IP address with copy button |
2.2.10 Action Buttons
Each honeypot card includes three action buttons for managing the instance:
Button | Color | Function |
|---|---|---|
Detail | Blue | Open detailed inspection and analytics view for this honeypot |
Log | Yellow | View logs and generate reports specific to this honeypot |
Delete | Red | Remove the honeypot instance from the management panel |