beelzebub

Why we included this project

Most honeypots just sit there logging who poked at your network, but Beelzebub talks back. It pairs each decoy with an LLM backend (OpenAI or Ollama) so probing connections get drawn into realistic exchanges across SSH, HTTP, TCP, TELNET, and MCP, which keeps attackers busy long enough to learn how they actually operate. The MCP support is what makes it interesting for teams guarding AI agents: you can stand up decoy tooling that baits intruders and surfaces prompt injection attempts. Services are defined in YAML with regex-based command matching, so a new decoy takes no coding, and the plugin system plus Docker and Helm packaging make it easy to slot into a broader deception environment. Security engineers and researchers who want proactive defense rather than passive logging will find the Prometheus and RabbitMQ hooks handy for feeding captured events into an existing detection pipeline.