tpotce VS smbeagle

Have a look at tpot created by Deutsche Telekom. https://github.com/telekom-security/tpotce

After installing proxmox, I created a VM on it containing t-pot, an (.iso) packaged group of containerized honeypots with a compelling aggregation of logs, attack attempts, a heatmap showing attack/scan locations, ips, and numerous other criteria logged and viewable in pretty elasticsearch dashboards.

The Data for https://www.sicherheitstacho.eu/start/main comes from their Honeypot Software https://github.com/telekom-security/tpotce

As for blue team, there is tpotce which is a fully integrated Linux distro that deploys multiple honeypot containers and connects them back up into Elastic Search, but you'd need a device with 8GB+ RAM facing the internet unrestricted in a DMZ or something similar - https://github.com/telekom-security/tpotce

T-Pot - The All In One Honeypot Platform - T-Pot

I use it to run Splunk at home for testing. You can also run honeypots or use TPot.

Check this https://github.com/telekom-security/tpotce

If you want a live threat map/Honeypot and get a feel for what's attacking your network while also looking amazing, set up the T-pot - https://github.com/telekom-security/tpotce

SMBeagle is another quickly evolving share scanner that’s worth looking at if you haven’t seen it. It supports a lot of nice features. It doesn’t generate IAMish summary reports (yet?), but does export results to csv and elasticsearch which is pretty cool. https://github.com/punk-security/smbeagle