CAAP + T-Pot – Proof of Concept Deployment

This repository contains a complete, self-contained proof of concept combining:

• T-Pot MINI – honeypot platform capturing real attack traffic
• CAAP – Captured Artifact Analysis Pipeline – static analysis, YARA detection, and threat intelligence on top of T-Pot data

A live deployment is available at caap.bajco.sk (BasicAuth protected).

---

Repository Structure

caap-poc/
├── tpot/                        # T-Pot MINI configuration
│   ├── docker-compose.yml       # MINI edition (reduced honeypot set)
│   ├── .env.example             # T-Pot configuration template
│   └── README.md                # T-Pot setup notes
└── caap/                        # CAAP – full source + deployment
    ├── docker-compose.simple.yml # Simple deploy (port 5000, no reverse proxy)
    ├── docker-compose.yml        # Production deploy (Traefik + TLS)
    ├── .env.example              # API keys template
    ├── Dockerfile
    ├── main.py / dashboard.py / config.py
    ├── modules/                  # Pipeline modules (monitor, worker, analysis…)
    ├── templates/                # Flask HTML templates
    ├── yara_rules/               # 29 custom YARA detection rules
    └── README.md                 # CAAP-specific docs

---

Full Deployment Guide

Requirements

• Ubuntu 22.04 / Debian 12 server (amd64 or arm64)
• Minimum 8 GB RAM, 128 GB disk (for T-Pot + Elasticsearch + CAAP data)
• Docker + Docker Compose v2
• Ports 1–64000 open inbound (honeypots), 64295/64297 for management

---

Step 1 – Install T-Pot

# Clone T-Pot upstream
git clone https://github.com/telekom-security/tpotce ~/tpotce
cd ~/tpotce

# Generate web UI credentials (copy output for next step)
./genuser.sh

# Replace compose file with the MINI edition from this repo
cp /path/to/caap-poc/tpot/docker-compose.yml ~/tpotce/docker-compose.yml

# Set up .env
cp /path/to/caap-poc/tpot/.env.example ~/tpotce/.env
nano ~/tpotce/.env

Required .env settings:

# Paste output from genuser.sh here
WEB_USER=

# Edition (keep MINI for this POC)
TPOT_TYPE=MINI

Then install and start:

./install.sh
# T-Pot will be available at https://<server-ip>:64297
# SSH access moves to port 64295

Note: After install.sh, SSH is on port 64295. Standard port 22 is taken by the Cowrie honeypot.

---

Step 2 – Deploy CAAP

cd /path/to/caap-poc/caap

# Copy and configure API keys
cp .env.example .env
nano .env

.env contents:

# T-Pot data root (adjust to your username)
TPOT_DATA_DIR=/home/<youruser>/tpotce/data

# Optional but recommended for full enrichment
VT_API_KEY=
ABUSEIPDB_API_KEY=
SHODAN_API_KEY=

Start CAAP:

export TPOT_DATA_DIR=/home/<youruser>/tpotce/data
docker compose -f docker-compose.simple.yml up -d

Dashboard available at http://<server-ip>:5000

---

Step 3 – Initial Data Sync

On first run, trigger manual sync to process existing T-Pot logs:

# Parse ~1M HoneyTrap payloads (takes 2–5 minutes)
curl -X POST http://localhost:5000/api/honeytrap/sync

# Parse ADBHoney sessions
curl -X POST http://localhost:5000/api/adbhoney/sync

The worker runs continuously in the background, processing new artifacts automatically.

---

CAAP Volume Mounts

CAAP reads T-Pot data via read-only Docker volume mounts:

Container path	T-Pot source	Data
/watch/honeytrap/attacks	$TPOT_DATA_DIR/honeytrap/attacks	Raw TCP payloads
/watch/honeytrap/log	$TPOT_DATA_DIR/honeytrap/log	HoneyTrap JSON logs
/watch/adbhoney	$TPOT_DATA_DIR/adbhoney	Android session logs
/watch/dionaea/binaries	$TPOT_DATA_DIR/dionaea/binaries	Captured malware binaries
/watch/cowrie/downloads	$TPOT_DATA_DIR/cowrie/downloads	SSH session downloads

If a honeypot is not running (e.g. Cowrie/Dionaea not in MINI), comment out its volume lines in docker-compose.simple.yml.

---

Architecture Overview

Internet → T-Pot Honeypots (HoneyTrap, ADBHoney, ConPot, CiscoASA, Medpot, Dicompot)
                │
                │  writes to ~/tpotce/data/
                ▼
┌──────────────────────────────────────────────────────┐
│                     CAAP Pipeline                    │
│                                                      │
│  caap-monitor  →  caap-worker  →  SQLite DB          │
│  (watchdog)       ├── triage (hash + filetype)       │
│                   ├── static_analysis (YARA/PE/ent.) │
│                   ├── threat_intel (VT/AbuseIPDB/Sh) │
│                   └── honeytrap/adbhoney parsers     │
│                                                      │
│  caap-dashboard  →  Flask :5000                      │
│  (read from DB)     └── 7 dashboard pages            │
└──────────────────────────────────────────────────────┘

---

Dashboard Pages

URL	Description
/	Main dashboard – stats, global attack map, YARA timeline
/browse	Artifact browser – filter by file type, YARA rule, CVE
/artifact/<sha256>	Artifact detail with YARA highlights, VT/AbuseIPDB/Shodan
/honeytrap	1M+ payload browser – port stats, YARA filter, payload viewer
/adbhoney	Android attack sessions – map, commands, URLhaus enrichment
/ips	All attacker IPs with composite threat score
/ip/<ip>	Per-IP detail – campaign detection, timeline, all sessions

---

T-Pot MINI Honeypots

Honeypot	Protocol / Purpose	Port(s)
HoneyTrap	Generic TCP (catches everything)	all unbound ports
ADBHoney	Android Debug Bridge	5555
Honeypots	Multi-protocol (SSH, FTP, HTTP, RDP…)	21, 22, 80, 443, 3389…
ConPot	ICS/SCADA (IEC104, IPMI, Kamstrup)	161/udp, 623/udp, 2404, 1025
CiscoASA	Cisco ASA VPN	5000/udp, 8443
Dicompot	Medical imaging (DICOM)	104, 11112
Medpot	Medical protocol (HL7/FHIR)	2575

---

Management Ports

Port	Service
64295	SSH to host
64297	T-Pot Web UI (Kibana, AttackMap, CyberChef)
5000	CAAP Dashboard (simple deploy)

---

Stopping / Starting

# Stop T-Pot honeypots (keeps CAAP running)
cd ~/tpotce && docker compose down

# Stop CAAP
cd /path/to/caap-poc/caap && docker compose -f docker-compose.simple.yml down

# Restart T-Pot
cd ~/tpotce && docker compose up -d

# Restart CAAP
cd /path/to/caap-poc/caap && docker compose -f docker-compose.simple.yml up -d

---

API Keys

Service	Free tier	Used for
VirusTotal	4 req/min	File hash reputation
AbuseIPDB	1000 req/day	IP reputation + country
Shodan	100 req/month	IP open ports + org
URLhaus (abuse.ch)	unlimited	Malware URL lookup (no key needed)