HoneyDash | Configuration

Honeypot Connection

Sensor type, host, port & connection mode

Not Tested

Honeypot Type

Connection Mode

Sensor Name

Host / IP

Port

Protocol

Log File Path (on sensor)

Notes (optional)

Import Log File

Upload a Cowrie JSON log to ingest historical events

Cowrie JSON · max 50 MB

Select Log File

Choose file

Cowrie cowrie.json format — one event per line

Alert Rules

Define conditions that trigger notifications

Rule Name

Condition

Threshold

Severity

Rule Name	Condition	Threshold	Severity	Status	Actions
Loading rules…

Alerts & Notifications

Webhook, Email and Telegram delivery channels

Webhook

Webhook URL (Slack, Teams, custom)

Enable webhook

Email (SMTP)

Send Alerts To

SMTP Host

Port

Enable

SMTP Username

SMTP Password / App Password

Bot Token (from @BotFather)

Chat ID (@userinfobot)

Enable

Minimum Severity to Notify

API Integrations

GeoIP enrichment and VirusTotal malware scanning

GeoIP — ip-api.com

Free tier · 45 req/min · No key required. Runs automatically for each new attacker IP.

Active

VirusTotal

Malware reputation scoring. API key is loaded from the server environment — it cannot be changed here.

Env-configured

Configure key via VT_API_KEY in backend/.env, then restart the backend.

Data Retention

How long to keep events, sessions and enrichments

Raw Events — keep for

Sessions — keep for

IP Enrichments — keep for

Auto-purge runs daily at startup.