Executive Summary

This project demonstrates the deployment of a cloud-native threat intelligence pipeline in Amazon Web Services (AWS). By pairing a multi-container T-Pot honeypot instance with a central Wazuh SIEM manager, the lab actively captures live internet attack vectors, routes system and service telemetry through custom security groups, and visualizes real-world threat actor behavior inside a central security operations dashboard.

Technical Architecture & Network Design

Infrastructure Components

  • Decoy Node (AWS EC2): Running T-Pot CE (Community Edition), leveraging Docker containers to emulate diverse vulnerable services (SSH, HTTP, RDP, SMB, Telnet).
  • SIEM Node (AWS EC2): Running Wazuh Manager & Indexer to ingest, parse, and correlate attack telemetry.

Security Group & Network Segmentation

To safely isolate decoy traffic from internal SIEM management pipelines, custom AWS Security Groups were engineered to enforce strict network separation:

Traffic Type Source / Origin Destination Port Range / Protocol Security Intent
Public Decoy Access Any (0.0.0.0/0) T-Pot EC2 Varied Trap Ports (e.g., 22, 80, 445) Allows internet threat actors to interact with honeypot containers.
Telemetry Pipeline T-Pot EC2 Security Group Wazuh EC2 TCP 1514 / 1515 (or Syslog UDP 514) Encrypted, restricted inter-instance log forwarding to the SIEM.
Admin Management Admin Public IP Only (/32) Both EC2 Nodes SSH 22 / 64295 & Web UI 443 Enforces Strict Least Privilege; administration endpoints are hidden from public scans.

Threat Intelligence & Telemetry Analysis

The lab setup provides visual data on active scans, exploit attempts, and centralized log ingestion across the environment.

1. Attack Surface & Honeypot Monitoring

The T-Pot home screen and live threat map provide immediate visibility into active scanning, exploit attempts, and geo-location origins targeting the exposed AWS EC2 instance.

T-Pot Home Screen Figure 1: T-Pot Honeypot dashboard home screen.

T-Pot Live Threat Map Figure 2: Real-time global threat map displaying honeypot probe origins.

2. Centralized Security Analytics (SIEM)

Raw logs generated by the T-Pot honeypot containers are continuously forwarded across security groups to the central Wazuh Manager instance for real-time indexing and alerting.

Wazuh SIEM Dashboard Figure 3: Centralized Wazuh SIEM dashboard displaying ingested log telemetry and alert counts.

Implementation Highlights

1. EC2 Provisioning & Hardening

  • Deployed Linux EC2 instances sized to handle memory-intensive Docker workloads (T-Pot) and indexing pipelines (Wazuh).
  • Configured EBS volumes and swap memory to prevent resource exhaustion during heavy brute-force or scan events.

2. Log Ingestion & Pipeline Configuration

  • Configured log forwarders on the T-Pot instance to ship underlying container logs (Ewsposter / Cowrie / Dionaea) directly to the central manager.
  • Verified real-time connection status between the T-Pot agent and the Wazuh manager instance.

Key Security Takeaways

  • Perimeter Control: Demonstrates how granular AWS Security Group rules prevent public attack traffic from pivoting into cloud management planes or adjacent SIEM infrastructure.
  • Threat Intelligence: Provides hands-on exposure to live attack metrics, IoC (Indicator of Compromise) collection, and SIEM dashboard customization.