Hack the Route Start free Open app Detection and response
Honeypot
A decoy host or service nobody legitimate uses, so any touch of it is a high-confidence alert.
A honeypot is a system with no real purpose — fake SSH, telnet or admin ports — placed where attackers will find it. Because nothing legitimate ever connects, every connection is suspicious by definition, giving alerts with almost no false positives. A low-interaction honeypot only answers a banner and logs the source; a high-interaction one is a fuller system that watches what an intruder does, at more risk and cost. The log of who touched it, and when, is the whole value.