T-Pot Integration Guide

T-Pot is an all-in-one honeypot platform developed by Deutsche Telekom Security that combines multiple honeypot daemons and tools for threat intelligence gathering. This guide walks you through integrating T-Pot with NxtFireGuard using a Feed Aggregator.

Prerequisites

• A running T-Pot instance
• Access to T-Pot's Elasticsearch endpoint

Integration Architecture

T-Pot logs all attack data to its internal Elasticsearch instance. To integrate with NxtFireGuard, a Feed Aggregator running a Logstash container will:

1. Pull events from T-Pot's Elasticsearch
2. Transform the data into NxtFireGuard's format
3. Forward threat events to NxtFireGuard's ingestion endpoint

Supported Honeypot Daemons

Not all T-Pot honeypot daemons are currently supported. The following are processed by NxtFireGuard:

Events from unsupported daemons will not be processed even if they appear in T-Pot's Elasticsearch.

Setup Instructions

Step 1: Create or Configure a Feed Aggregator

You have two options depending on your current setup:

Option A: Create a New Feed Aggregator

If you don't have an existing aggregator:

1. Navigate to Feed Aggregators under Data Ingestion in the sidebar.
2. Click Create Aggregator and give it a descriptive name (e.g., "T-Pot Aggregator").
3. Proceed through the setup wizard and enable Run Logstash Container on Step 3.
4. Complete the creation process.
5. Locate your newly created aggregator, click Edit, then click View Instructions and follow the installation guide.

Note: When starting the Logstash container for the first time, it may take a while to appear due to the size of the Logstash Docker image.

Option B: Use an Existing Feed Aggregator

If you already have a Feed Aggregator (for example, one used for Cisco FTD or Cisco ISE):

1. Navigate to Feed Aggregators and locate your existing aggregator.
2. Click Edit and enable Run Logstash Container if not already enabled.
3. Save the changes, then click Logs to verify the Logstash container started successfully.

Note: A single Feed Aggregator can run both Logstash and Syslog containers simultaneously, so you can aggregate T-Pot and Cisco devices through the same aggregator.

Step 2: Verify Hostname Matching

The Threat Sensor hostname must exactly match your T-Pot instance hostname — this is required for correct event correlation.

1. Check your T-Pot instance hostname.
2. Go to Threat Sensors, find your T-Pot sensor, and click Edit.
3. Confirm the Threat Sensor Hostname field matches exactly, including casing.

Step 3: Verify Data Flow

After completing the setup:

1. Wait 5-10 minutes for the pipeline to establish.
2. Navigate to Threat Events in the sidebar.
3. Check for incoming events from your T-Pot instance.

Additional Resources

• T-Pot Documentation: https://github.com/telekom-security/tpotce

---

For integration issues, reach out via the contact form.