Spot trouble early with honeypots and Suricata

A practitioner deployed a T-Pot honeypot with Suricata in a DMZ for three days, ingesting 1.4M alerts via the Elastic stack and observing widespread automated scanning—frequently from cloud IP ranges—and rapid probing for recent and older CVEs (e.g., CVE-2024-6387, CVE-2020-11910) without clear attribution. The report outlines the containerized honeypot services, Suricata rule management, common targets (e.g., 443, 53), and odd payloads, then distills blue-team lessons: focus honeypot scope, enrich telemetry with ASN/cloud tags, tune rules to reduce noise, and integrate outputs into detection, blocklists, and analyst training.