Introducing HoneyBee: How We Automate Honeypot Deployment for Threat Research

This post announces HoneyBee, an open-source framework that auto-generates intentionally insecure Docker/Compose setups and Nuclei templates to create realistic, observable honeypots for cloud applications. It details how Wiz uses HoneyBee to validate detection rules, orchestrate network-monitored honeypots, and conduct security research and training, highlighting observed real-world misuse such as JDWP-driven cryptomining deployments and attacks on weak PostgreSQL instances, all aimed at improving detections and defensive capabilities.