7.1 Guardpot Agent Overview
A Guardpot Agent is a lightweight, deployable honeypot instance that runs on a target machine and reports all activity back to the Guardpot Manager. Each agent operates independently, emulating vulnerable services to attract and capture attacker behavior in real time, as illustrated in Figure 2.1-1.
Once deployed, a Guardpot Agent continuously monitors incoming connections, records credentials, commands, and file transfers, and forwards this telemetry to the central management panel for analysis and alerting.
2.1.1 Agent Architecture#
A Guardpot Agent consists of two core components:
Component | Description |
|---|---|
Service Emulation Layer | Simulates network services (SSH, HTTP, RDP, FTP, etc.) to attract attackers |
Telemetry Engine | Captures and forwards interaction data, credentials, and session logs to Guardpot Manager |
2.1.2 Deployment Methods#
Guardpot Agents can be deployed using two methods. The appropriate method depends on your network access and operational requirements.
Method | Description |
|---|---|
Remote Install | Guardpot Manager automatically connects to the target machine via SSH and installs the agent. Requires root-level SSH access. |
Serial Key | The agent is manually installed on the target machine and linked to the management panel using a unique serial key. Suitable when SSH access is not available. |
Note: For detailed deployment instructions, refer to 2.2 Adding a Guardpot Agent to Guardpot Manager.
2.1.3 Agent Lifecycle States#
After deployment, each agent operates in one of the following states:
State | Description |
|---|---|
Active | The agent is running and responsive, actively emulating services and capturing attack data |
Passive | The agent is deployed but not actively engaging with incoming traffic |
Offline | The agent is non-responsive or the host machine is powered off |
Update Available | A software update is pending for this agent instance |
2.1.4 Supported Platforms#
Guardpot Agents can be installed on the following operating systems:
Platform | Supported Distributions |
|---|---|
Linux | Debian, Ubuntu, CentOS, RHEL, and other major distributions |
Windows | Windows Server and Desktop editions |
BSD | FreeBSD, OpenBSD, and NetBSD |
Agents are managed centrally through the Guardpots Module, described in 2.2 Adding a Guardpot Agent to Guardpot Manager.
Was this article helpful?
Your feedback helps us improve the documentation.