work on permissions, folders and tpotinit

Rework .env / env.example
Add more functions to customizer.py (improve port and service checks, improve user output) Adjust docker-compose files
2025-07-02 01:27:27 -04:00 · 2024-02-14 19:04:05 +01:00 · 2024-02-13 19:02:40 +01:00 · 2024-02-12 19:18:57 +01:00 · 2024-02-06 13:45:12 +01:00 · 2024-01-05 22:07:19 +01:00
246 changed files with 15218 additions and 611 deletions
--- a/.env
+++ b/.env
@ -0,0 +1,121 @@
+# T-Pot config file. Do not remove.
+
+###############################################
+# T-Pot Base Settings - Adjust to your needs. #
+###############################################
+
+# Set Web username and password here, it will be used to create the Nginx password file nginxpasswd.
+#  Use 'htpasswd -n <username>' to create the WEB_USER if you want to manually deploy T-Pot
+#  Example: 'htpasswd -n tsec' will print tsec:$apr1$TdJGdsss$6yLsxPmOcXb2kaEZ7lKva0
+#  Copy the string and replace WEB_USER='tsec:$apr1$TdJGdsss$6yLsxPmOcXb2kaEZ7lKva0'
+WEB_USER='change:me'
+
+# T-Pot Blackhole
+#  ENABLED: T-Pot will download a db of known mass scanners and nullroute them
+#           Be aware, this will put T-Pot off the map for stealth reasons and
+#           you will get less traffic. Routes will active until reboot and will
+#           be re-added with every T-Pot start until disabled.
+#  DISABLED: This is the default and no stealth efforts are in place.
+TPOT_BLACKHOLE=DISABLED
+
+# T-Pot Persistence
+# on: This is the default. T-Pot will keep the honeypot logfiles and rotate
+#     with logrotate for 30 days.
+# off: This is recommended for Raspberry Pi or setups with weaker CPUs or
+#      if you just do not need any of the logfiles.
+TPOT_PERSISTENCE=on
+
+# T-Pot Type
+# HIVE: This is the default and offers everything to connect T-Pot sensors.
+# SENSOR: This needs to be used when running a sensor. Be aware to adjust all other
+#         settings as well.
+#         1. You will need to copy compose/sensor.yml to ./docker-comopose.yml
+#         2. From HIVE host you will need to copy ~/tpotce/data/nginx/cert/nginx.crt to
+#            your SENSOR host to ~/tpotce/data/hive.crt
+#         3. On HIVE: Create a web user per SENSOR on HIVE and provide credentials below
+#            Create credentials with 'htpasswd ~/tpotce/data/nginx/conf/lswebpasswd <username>'
+#         4. On SENSOR: Provide username / password from (3) for TPOT_HIVE_USER as base64 encoded string:
+#                       "echo -n 'username:password' | base64"
+TPOT_TYPE=HIVE
+
+# T-Pot Hive User (only relevant for SENSOR deployment)
+# <empty>: This is empty by default.
+# <base64 encoded string>: Provide a base64 encoded string "echo -n 'username:password' | base64"
+#                          i.e. TPOT_HIVE_USER='dXNlcm5hbWU6cGFzc3dvcmQ='
+TPOT_HIVE_USER=
+
+# T-Pot Hive IP (only relevant for SENSOR deployment)
+# <empty>: This is empty by default.
+# <IP, FQDN>: This can be either a IP (i.e. 192.168.1.1) or a FQDN (i.e. foo.bar.local)
+TPOT_HIVE_IP=
+
+# T-Pot AttackMap Text Output
+#  ENABLED: This is the default and the docker container map_data will print events to the console.
+#  DISABLED: Printing events to the console is disabled.
+TPOT_ATTACKMAP_TEXT=ENABLED
+
+# T-Pot AttackMap Text Output Timezone
+#  UTC: (T-Pot default) This is usually the best option.
+#  Continent/City: In Linux you can check our timezone with `readlink` /etc/localtime or
+#                  see the full list here: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
+#  Examples: America/New_York, Asia/Taipei, Australia/Melbourne, Europe/Athens, Europe/Berlin
+TPOT_ATTACKMAP_TEXT_TIMEZONE=UTC
+
+###################################################################################
+# Honeypots / Tools settings
+###################################################################################
+# Some services / tools offer adjustments using ENVs which can be adjusted here.
+###################################################################################
+
+# SentryPeer P2P mode
+# Exchange bad actor data via DHT / P2P mode by setting the ENV to true (1)
+# In some cases (i.e. internally deployed T-Pots) this might be confusing as SentryPeer will show
+# the bad actors in its logs. Therefore this option is opt-in based.
+# 0: This is the default, P2P mode is disabled.
+# 1: Enable P2P mode.
+SENTRYPEER_PEER_TO_PEER=0
+
+# Suricata ET Pro ruleset
+# OPEN: This is the default and will the ET Open ruleset
+# OINKCODE: Replace OPEN with your Oinkcode to use the ET Pro ruleset
+OINKCODE=OPEN
+
+
+###################################################################################
+# NEVER MAKE CHANGES TO THIS SECTION UNLESS YOU REALLY KNOW WHAT YOU ARE DOING!!! #
+###################################################################################
+
+# T-Pot Landing page provides Cockpit Link
+COCKPIT=false
+
+# docker.sock Path
+TPOT_DOCKER_SOCK=/var/run/docker.sock
+
+# docker compose .env
+TPOT_DOCKER_ENV=./.env
+
+# Docker-Compose file
+TPOT_DOCKER_COMPOSE=./docker-compose.yml
+
+# T-Pot Repo
+# Depending on where you are located you may choose between DockerHub and GHCR
+# dtagdevsec: This will use the DockerHub image registry
+# ghcr.io/telekom-security: This will use the GitHub container registry
+TPOT_REPO=ghcr.io/telekom-security
+
+# T-Pot Version Tag
+TPOT_VERSION=dev
+
+# T-Pot Pull Policy
+#  always: (T-Pot default) Compose implementations SHOULD always pull the image from the registry.
+#  never: Compose implementations SHOULD NOT pull the image from a registry and SHOULD rely on the platform cached image.
+#  missing: Compose implementations SHOULD pull the image only if it's not available in the platform cache.
+#  build: Compose implementations SHOULD build the image. Compose implementations SHOULD rebuild the image if already present.
+TPOT_PULL_POLICY=always
+
+# T-Pot Data Path
+TPOT_DATA_PATH=./data
+
+# OSType (linux, mac, win)
+#  Most docker features are available on linux
+TPOT_OSTYPE=linux
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,4 @@
+# Ignore data folder
+data/
+**/.DS_Store
+.idea
--- a/CITATION.cff
+++ b/CITATION.cff
@ -0,0 +1,43 @@
+# This CITATION.cff file was generated with cffinit.
+# Visit https://bit.ly/cffinit to generate yours today!
+
+cff-version: 1.2.0
+title: T-Pot DEV
+message: >-
+  If you use this software, please cite it using the
+  metadata from this file.
+type: software
+authors:
+  - name: Deutsche Telekom Security GmbH
+    address: Bonner Talweg 100
+    city: Bonn
+    country: DE
+    post-code: '53113'
+    website: 'https://github.com/telekom-security'
+  - given-names: Marco
+    family-names: Ochse
+    affiliation: Deutsche Telekom Security GmbH
+identifiers:
+  - type: url
+    value: >-
+      https://github.com/telekom-security/tpotce/releases/tag/22.04.0
+    description: T-Pot Release 22.04.0
+repository-code: 'https://github.com/telekom-security/tpotce'
+abstract: >-
+  T-Pot is the all in one, optionally distributed, multiarch
+  (amd64, arm64) honeypot plattform, supporting 20+
+  honeypots and countless visualization options using the
+  Elastic Stack, animated live attack maps and lots of
+  security tools to further improve the deception
+  experience.
+keywords:
+  - honeypot
+  - deception
+  - t-pot
+  - telekom security
+  - docker
+  - elk
+license: GPL-3.0
+commit: unreleased, under heavy development
+version: 2x.yy.z
+date-released: '202x-yy-zz'
--- a/PREVIEW.md
+++ b/PREVIEW.md
@ -0,0 +1,205 @@
+# T-Pot - Dev Preview
+
+T-Pot will be turning 10 years next year and this milestone will be celebrated when the time comes, which brings us today to the best time to reflect on how technology advanced, what this means for the project and how we can ensure T-Pot will meet the current and future requirements of the community.
+<br><br>
+
+# TL;DR
+1. [Download](#choose-your-distro) or use a running, supported distribution
+2. Install the ISO with as minimal packages / services as possible (SSH required!)
+3. Install curl: `$ sudo [apt, dnf, zypper] install curl` if not installed already
+4. Run installer as non-root:
+```
+/bin/bash -c "$(curl -sL https://github.com/telekom-security/tpotce/raw/dev/install.sh)"
+```
+   * Follow instructions, read messages, check for possible port conflicts and reboot
+5. [Start](#start-t-pot) T-Pot as non-root for the first time:
+```
+cd tpotce/preview/
+docker compose up
+```
+
+
+# Table of Contents
+- [Disclaimer](#disclaimer)
+- [Last Time Departed](#last-time-departed)
+- [Present Time](#present-time)
+- [Destination Time](#destination-time)
+- [Technical Preview](#technical-preview)
+  - [Architecture](#architecture)
+- [Installation](#installation)
+  - [Choose your distro](#choose-your-distro)
+  - [Get and Install T-Pot](#get-and-install-t-pot)
+  - [T-Pot Config File](#t-pot-config-file)
+  - [macOS & Windows](#macos--windows)
+- [Start T-Pot](#start-t-pot)
+- [Stop T-Pot](#stop-t-pot)
+- [Uninstall T-Pot](#uninstall-t-pot)
+- [Feedback](#uninstall-t-pot)
+
+<br><br>
+
+# Disclaimer
+- This is a Technical Preview, a very very early stage in the development T-Pot. You have been warned - there will be dragons steering flying time machines possibly causing paradoxes.
+- The T-Pot [disclaimer](https://github.com/telekom-security/tpotce/blob/master/README.md#disclaimer) and [documentation](https://github.com/telekom-security/tpotce/blob/master/README.md) apply.
+<br><br>
+
+# Last Time Departed
+Jumping back to 2014 T-Pot was born as the direct ancestor of our Raspberry Pi images we used to offer for download (which probably by now only insiders will remember 😅). Docker was just the new kid on the block with the shiny new container engine everyone desperately unknowingly waited for and thus taking the dev-world by storm. At that point we wanted to ensure that T-Pot was something tangible, tethered to a physical device (Hello NUC my old friend 👋) while using latest technologies ensuring an easy transition should we ever leave hardware based installations (or VMs for that matter). And Oh-My-Zsh as you all know that day came faster than anticipated! (Special thanks @vorband, @shaderecker and @tmariuss for all of their contributions!)  
+<br><br>
+
+# Present Time
+Flash Forward to today, T-Pot offers support for Debian, both as an ISO based installation or a post installation method (install your own Debian Server), support for OTC, AWS and other clouds through Ansible and Terraform Support. All of this in many different flavors and even a distributed installation. At the same time we are still relying on the same base concept we originally started with which does not seem fit for the foreseeable future.<br>
+In the last couple of years being independent of a certain platform was the one feature that stood out by far. The reason for this, until today, is the simple fact that T-Pot, although relying heavily on Docker, still relies on a fully controlled environment. This has its advantages but can not meet a demand where cloud based installations need different settings than we can provide (we can only run limited platform tests), companies follow different guidelines for allowed distributions or hosters simply offer Debian images slightly adjusted to their environments causing issues with the setting T-Pot relies on. Roll the dice or ask the Magic-8-Ball.     
+<br><br>
+
+# Destination Time
+Back to the future of T-Pot. For a brief time we had the idea of T-Pot Light which should compensate for the missing platform support. A concept was whipped up to support all of T-Pot's dockered services on minimal installations of Debian, Fedora, OpenSuse and Ubuntu Server. And it worked! It worked so good that we have almost achieved feature parity for this Technical Preview and decided that this is the best candidate for the future of the development of T-Pot<br>
+We are thrilled to share this now, so you can test, provide us with feedback, open issues and discussions and give us the chance to make the next T-Pot the best T-Pot we have ever released!
+<br><br>
+
+## Technical Preview
+For the purpose of the Technical Preview T-Pot will still use the 22.04 images and for a great part rely on the 22.04 release. This will lay the groundwork though for the next T-Pot release by just relying on the latest Docker package repositories (yes, the distros mostly do not offer Docker's bleeding edge features), some tiny modifications on the host (installer and uninstaller provided!) and move all of T-Pot's core in its own Docker image with a simple, user adjustable, configuration.<br>
+<br><br>
+
+## Architecture
+While the basic architecture still remains, the Technical Preview of T-Pot is mostly independent of the underlying OS with only some basic requirements:
+1. Underlying OS is available as supported distribution:
+    * Only the bare minimum of services and packages are installed to avoid possible port conflicts with T-Pot's services
+    * Debian, Fedora, OpenSuse and Ubuntu Server are currently supported, others might follow if the requirements will be met
+2. Latest Docker Engine from Docker's repositories is supported
+    * Only the latest Docker Engine packages offer all the features needed for T-Pot
+    * Docker Desktop does not offer host network capabilities and thus only a limited T-Pot experience (not available for the Technical Preview, but planned to even get started faster!)
+3. Changes to the host
+    * Some changes to the host are necessary but will be kept as minimalistic as possible, just enough T-Pot will be able to run
+    * There are uninstallers available this time 😁
+<br><br>
+
+# System Requirements
+The known T-Pot hardware (CPU, RAM, SSD) requirements and recommendations still apply.
+<br><br>
+
+# Installation
+[Download](#choose-your-distro) one of the supported Linux distro images, `git clone` the T-Pot repository and run the installer specific to your system. Running T-Pot on top of a running and supported Linux system is possible, but a clean installation is recommended to avoid port conflicts with running services.
+<br><br>
+
+## Choose your distro
+Choose a supported distro of your choice. It is recommended to use the minimum / netiso installers linked below and only install a minimalistic set of packages. SSH is mandatory or you will not be able to connect to the machine remotely.
+
+| Distribution Name                              | x64                                                                                                                                   | arm64 
+|:-----------------------------------------------|:--------------------------------------------------------------------------------------------------------------------------------------|:--------------
+| [AlmaLinux](https://almalinux.org)             | [download](https://mirrors.almalinux.org/isos/x86_64/9.2.html)                                                                        | [download](https://mirrors.almalinux.org/isos/aarch64/9.2.html)
+| [Debian](https://www.debian.org/index.en.html) | [download](https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-12.0.0-amd64-netinst.iso)                                 | [download](https://cdimage.debian.org/debian-cd/current/arm64/iso-cd/debian-12.0.0-arm64-netinst.iso)
+| [DietPi](https://dietpi.com/#home)             |                                                                                                                                       | [download](https://dietpi.com/downloads/images/DietPi_RPi-ARMv8-Bookworm.7z)
+| [Fedora](https://fedoraproject.org)            | [download](https://download.fedoraproject.org/pub/fedora/linux/releases/38/Server/x86_64/iso/Fedora-Server-netinst-x86_64-38-1.6.iso) | [download](https://download.fedoraproject.org/pub/fedora/linux/releases/38/Server/aarch64/iso/Fedora-Server-netinst-aarch64-38-1.6.iso)
+| [OpenSuse](https://www.opensuse.org)           | [download](https://download.opensuse.org/tumbleweed/iso/openSUSE-Tumbleweed-NET-x86_64-Current.iso)                                   | [download](https://download.opensuse.org/ports/aarch64/tumbleweed/iso/openSUSE-Tumbleweed-NET-aarch64-Current.iso)
+| [Rocky Linux](https://rockylinux.org)          | [download](https://download.rockylinux.org/pub/rocky/9/isos/x86_64/Rocky-9.2-x86_64-minimal.iso)                                      | [download](https://download.rockylinux.org/pub/rocky/9/isos/aarch64/Rocky-9.2-aarch64-minimal.iso)
+| [Ubuntu](https://ubuntu.com)                   | [download](https://releases.ubuntu.com/22.04.2/ubuntu-22.04.2-live-server-amd64.iso)                                                  | [download](https://cdimage.ubuntu.com/releases/22.04/release/ubuntu-22.04.2-live-server-arm64.iso)
+
+## Raspberry Pi 4 (8GB) Support
+| Distribution Name                              | arm64                                                                                                                                               | Notes                                                                                                                                 
+|:-----------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------|:--------------
+| [DietPi](https://dietpi.com/#home)             | [download](https://dietpi.com/downloads/images/DietPi_RPi-ARMv8-Bookworm.7z)                                                                        | In DietPi config you need to choose OpenSSH instead of Dropbear or T-Pot will fail to install
+| [Raspberry Pi OS](https://www.raspberrypi.com) | [download](https://downloads.raspberrypi.org/raspios_lite_arm64/images/raspios_lite_arm64-2023-05-03/2023-05-03-raspios-bullseye-arm64-lite.img.xz) | Recommended, everything incl. Wifi works as expected right away (when using Raspberry Pi Imager)
+
+<br><br> 
+
+## Get and install T-Pot
+1. Clone the GitHub repository: `$ git clone https://github.com/telekom-security/tpotce`
+2. Change into the **tpotce/preview/installer** folder: `$ cd tpotce/preview/installer`
+3. Locate your distribution, i.e. `fedora`: `$ cd fedora`
+4. Run the installer as non-root: `$ ./install.sh`:
+   * ⚠️ ***Depending on your Linux distribution of choice the installer will:***
+     * Change the SSH port to `tcp/64295`
+     * Disable the DNS Stub Listener to avoid port conflicts with honeypots
+     * Set SELinux to Monitor Mode
+     * Set the firewall target for the public zone to ACCEPT
+     * Add Docker's repository and install Docker
+     * Install recommended packages
+     * Remove package known to cause issues
+     * Add the current user to the docker group (allow docker interaction without `sudo`)
+     * Add `dps` and `dpsw` aliases (`grc docker ps -a`, `watch -c "grc --colour=on docker ps -a`)
+     * Display open ports on the host (compare with T-Pot [required](https://github.com/telekom-security/tpotce#required-ports) ports)
+5. Follow the installer instructions, you will have to enter your password at least once
+6. Check the installer messages for errors and open ports that might cause port conflicts
+7. Reboot: `$ sudo reboot`
+<br><br>
+
+## T-Pot Config File
+T-Pot offers a configuration file providing environment variables not only for the docker services (i.e. honeypots and tools) but also for the docker compose environment. The configuration file is hidden in the `preview` folder and is called `.env`. There is however an example file (`env.example`) which holds the default configuration.<br> Before the first start set the `WEB_USER` and `WEB_PW`. Once T-Pot was initialized it is recommended to remove the password and set `WEB_PW=<changeme>`. Other settings are available also, these however should only be changed if you are comfortable with possible errors 🫠 as some of the features are not fully integrated and tested yet.
+```
+# T-Pot config file. Do not remove.
+
+# Set Web username and password here, only required for first run
+#  Removing the password after first run is recommended
+#  You can always add or remove users as you see fit using htpasswd:
+#  htpasswd -b -c /<data_folder>/nginx/conf/nginxpasswd <username> <password>
+WEB_USER=<changeme>
+WEB_PW=<changeme>
+
+# T-Pot Blackhole
+#  ENABLED: T-Pot will download a db of known mass scanners and nullroute them
+#           Be aware, this will put T-Pot off the map for stealth reasons and
+#           you will get less traffic. Routes will active until reboot and will
+#           be re-added with every T-Pot start until disabled.
+#  DISABLED: This is the default and no stealth efforts are in place.
+TPOT_BLACKHOLE=DISABLED
+```
+
+## macOS & Windows
+Sometimes it is just nice if you can spin up a T-Pot instance on macOS or Windows, i.e. for development, testing or just the fun of it. While Docker Desktop is rather limited not all honeypot types or T-Pot features are supported. Also remember, by default the macOS and Windows firewall are blocking access from remote, so testing is limited to the host. For production it is recommended to run T-Pot on Linux.<br>
+To get things up and running just follow these steps:
+1. Install Docker Desktop for [macOS](https://docs.docker.com/desktop/install/mac-install/) or [Windows](https://docs.docker.com/desktop/install/windows-install/)
+2. Clone the GitHub repository: `$ git clone https://github.com/telekom-security/tpotce`
+2. Change into the **tpotce/preview/compose** folder: `$ cd tpotce/preview/compose`
+3. Copy **mac_win.yml** to the **tpotce/preview** folder by overwriting **docker-compose.yml**: `$ cp mac_win.yml ../docker-compose.yml`
+4. Adjust the **.env** file by changing **TPOT_OSTYPE** to either **mac** or **win**:
+```
+# OSType (linux, mac, win)
+#  Most docker features are available on linux
+TPOT_OSTYPE=mac
+```
+5. You have to ensure on your own there are no port conflicts keeping T-Pot from starting up.
+You can follow the README on how to [Start T-Pot](#start-t-pot), however you may skip the **crontab**.
+
+
+# Start T-Pot
+1. Change into the **tpotce/preview/** folder: `$ cd tpotce/preview/`
+2. Run: `$ docker compose up` (notice the missing dash, `docker-compose` no longer exists with the latest Docker installation)
+   * You can also run `$ docker compose -f /<path_to_tpot>/tpotce/preview/docker-compose.yml up` directly if you want to avoid to change into the `preview` folder or add an alias of your choice.
+3. `docker compose` will now download all the necessary images to run the T-Pot Docker containers
+4. On the first run T-Pot (`tpotinit`) will initialize and create the `data` folder in the path specified (by default it is located in `tpotce/preview/data/`):
+   * It takes about 2-3 minutes to bring all the containers up (should port conflicts arise `docker compose` will simply abort)
+   * Once all containers have started successfully for the first time you can access T-Pot as described [here](https://github.com/telekom-security/tpotce#remote-access-and-tools) or cancel with `CTRL-C` ...
+5. ... and run T-Pot in the background: `$ docker compose up -d`
+   * Unless you run `docker compose down -v` T-Pot's Docker service will remain persistent and restart with a reboot
+   * You can however add a crontab entry with `crontab -e` which will also add some container and image management.
+```
+@reboot docker compose -f /<path_to_tpot_>/tpotce/preview/docker-compose.yml down -v; \
+docker container prune -f; \
+docker image prune -f; \
+docker compose -f /<path_to_tpot_>/tpotce/preview/docker-compose.yml up -d
+```
+6. By default Docker will always check if the local and remote docker images match, if not, Docker will either revert to a fitting locally cached image or download the image from remote. This ensures T-Pot images will always be up-to-date
+
+# Stop T-Pot
+1. Change into the **tpotce/preview/** folder: `$ cd tpotce/preview/`
+2. Run: `$ docker compose down -v` (notice the missing dash, `docker-compose` no longer exists with the latest docker installation)
+3. Docker will now stop all running T-Pot containers and disable reboot persistence (unless you made a [crontab entry](#start-t-pot)
+   * You can also run `$ docker compose -f /<path_to_tpot>/tpotce/preview/docker-compose.yml down -v` directly if you want to avoid to change into the `preview` folder or add an alias of your choice.
+ 
+# Uninstall T-Pot
+1. Change into the **tpotce/preview/uninstaller/** folder: `$ cd tpotce/preview/uninstaller/`
+2. Locate your distribution, i.e. `fedora`: `$ cd fedora`
+3. Run the installer as non-root: `$ ./uninstall.sh`:
+   * The uninstaller will reverse the installation steps
+4. Follow the uninstaller instructions, you will have to enter your password at least once
+5. Check the uninstaller messages for errors
+6. Reboot: `$ sudo reboot`
+<br><br>
+
+# Feedback
+To ensure the next T-Pot release will be everything we and you - The T-Pot Community - have in mind please feel free to leave comments in the `Technical Preview` [discussion](https://github.com/telekom-security/tpotce/discussions/1325) pinned on our GitHub [Discussions](https://github.com/telekom-security/tpotce/discussions) section. Please bear in mind that this Technical Preview is made public in the earliest stage of the T-Pot development process at your convenience for ***your*** valuable input.
+<br><br>
+Thank you for testing 💖
+
+Special thanks to all the [contributors](https://github.com/telekom-security/tpotce/graphs/contributors) and [developers](https://github.com/telekom-security/tpotce#credits) making this project possible!
--- a/README.md
+++ b/README.md
@ -1,4 +1,4 @@
-# T-Pot - The All In One Multi Honeypot Plattform
+# T-Pot - The All In One Multi Honeypot Platform

 ![T-Pot](doc/tpotsocial.png)

@ -7,7 +7,7 @@ T-Pot is the all in one, optionally distributed, multiarch (amd64, arm64) honeyp

 # TL;DR
 1. Meet the [system requirements](#system-requirements). The T-Pot installation needs at least 8-16 GB RAM and 128 GB free disk space as well as a working (outgoing non-filtered) internet connection.
-2. Download the T-Pot ISO from [GitHub](https://github.com/telekom-security/tpotce/releases) acording to your architecture (amd64, arm64) or [create it yourself](#create-your-own-iso-image).
+2. Download the T-Pot ISO from [GitHub](https://github.com/telekom-security/tpotce/releases) according to your architecture (amd64, arm64) or [create it yourself](#create-your-own-iso-image).
 3. Install the system in a [VM](#running-in-a-vm) or on [physical hardware](#running-on-hardware) with [internet access](#system-placement).
 4. Enjoy your favorite beverage - [watch](https://sicherheitstacho.eu) and [analyze](#kibana-dashboard).
 <br><br>
@ -25,29 +25,29 @@ T-Pot is the all in one, optionally distributed, multiarch (amd64, arm64) honeyp
  - [Required Ports](#required-ports)
 - [System Placement](#system-placement)
 - [Installation](#installation)
-  - [ISO Based](#isoinstall)
-    - [Download ISO Image](#downloadiso)
-    - [Build your own ISO Image](#makeiso)
+  - [ISO Based](#iso-based)
+    - [Download ISO Image](#download-iso-image)
+    - [Create your own ISO Image](#create-your-own-iso-image)
  - [Post Install](#post-install)
    - [Download Debian Netinstall Image](#download-debian-netinstall-image)
-    - [User](#post-install-user-method)
-    - [Auto](#postauto)
-  - [T-Pot Installer](#tpotinstaller)
-    - [Installation Types](#installtypes)
-    - [Standalone](#standalonetype)
-    - [Distributed](#distributedtype)
-  - [Cloud Deployments](#cloud)
-    - [Ansible](#ansible-deployment)
-    - [Terraform](#terraform-configuration)
+    - [Post Install User Method](#post-install-user-method)
+    - [Post Install Auto Method](#post-install-auto-method)
+  - [T-Pot Installer](#t-pot-installer)
+    - [Installation Types](#installation-types)
+    - [Standalone](#standalone)
+    - [Distributed](#distributed)
+  - [Cloud Deployments](#cloud-deployments)
+    - [Ansible Deployment](#ansible-deployment)
+    - [Terraform Configuration](#terraform-configuration)
 - [First Start](#first-start)
  - [Standalone Start](#standalone-first-start)
  - [Distributed Deployment](#distributed-deployment)
  - [Community Data Submission](#community-data-submission)
  - [Opt-In HPFEEDS Data Submission](#opt-in-hpfeeds-data-submission)
 - [Remote Access and Tools](#remote-access-and-tools)
-  - [SSH and Cockpit](#ssh)
+  - [SSH and Cockpit](#ssh-and-cockpit)
  - [T-Pot Landing Page](#t-pot-landing-page)
-  - [Kibana Dashboard](#kibana-dashboardibana)
+  - [Kibana Dashboard](#kibana-dashboard)
  - [Attack Map](#attack-map)
  - [Cyberchef](#cyberchef)
  - [Elasticvue](#elasticvue)
@ -103,7 +103,7 @@ T-Pot offers docker images for the following honeypots ...
 * [ciscoasa](https://github.com/Cymmetria/ciscoasa_honeypot),
 * [citrixhoneypot](https://github.com/MalwareTech/CitrixHoneypot),
 * [conpot](http://conpot.org/),
-* [cowrie](http://www.micheloosterhof.com/cowrie/),
+* [cowrie](https://github.com/cowrie/cowrie),
 * [ddospot](https://github.com/aelth/ddospot),
 * [dicompot](https://github.com/nsmfoo/dicompot),
 * [dionaea](https://github.com/DinoTools/dionaea),
@ -127,11 +127,11 @@ T-Pot offers docker images for the following honeypots ...
 * [Cockpit](https://cockpit-project.org/running) for a lightweight and secure WebManagement and WebTerminal.
 * [Cyberchef](https://gchq.github.io/CyberChef/) a web app for encryption, encoding, compression and data analysis.
 * [Elastic Stack](https://www.elastic.co/videos) to beautifully visualize all the events captured by T-Pot.
-* [Elasticvue](https://github.com/cars10/elasticvue/) a web front end for browsing and interacting with an Elastic Search cluster.
+* [Elasticvue](https://github.com/cars10/elasticvue/) a web front end for browsing and interacting with an Elasticsearch cluster.
 * [Fatt](https://github.com/0x4D31/fatt) a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic.
-* [Geoip-Attack-Map](https://github.com/eddie4/geoip-attack-map) a beautifully animated attack map [optimized](https://github.com/t3chn0m4g3/geoip-attack-map) for T-Pot.
+* [T-Pot-Attack-Map](https://github.com/t3chn0m4g3/t-pot-attack-map) a beautifully animated attack map for T-Pot.
 * [P0f](https://lcamtuf.coredump.cx/p0f3/) is a tool for purely passive traffic fingerprinting.
-* [Spiderfoot](https://github.com/smicallef/spiderfoot) a open source intelligence automation tool.
+* [Spiderfoot](https://github.com/smicallef/spiderfoot) an open source intelligence automation tool.
 * [Suricata](http://suricata-ids.org/) a Network Security Monitoring engine.

 ... to give you the best out-of-the-box experience possible and an easy-to-use multi-honeypot appliance.
@ -150,17 +150,17 @@ The individual Dockerfiles and configurations are located in the [docker folder]
 T-Pot offers a number of services which are basically divided into five groups:
 1. System services provided by the OS
    * SSH for secure remote access.
-    * Cockpit for web based remote acccess, management and web terminal.
+    * Cockpit for web based remote access, management and web terminal.
 2. Elastic Stack
    * Elasticsearch for storing events.
    * Logstash for ingesting, receiving and sending events to Elasticsearch.
-    * Kibana for displaying events on beautyfully rendered dashboards.
+    * Kibana for displaying events on beautifully rendered dashboards.
 3. Tools
-    * NGINX for providing secure remote access (reverse proxy) to Kibana, CyberChef, Elasticvue, GeoIP AttackMap and Spiderfoot.
+    * NGINX provides secure remote access (reverse proxy) to Kibana, CyberChef, Elasticvue, GeoIP AttackMap and Spiderfoot.
    * CyberChef a web app for encryption, encoding, compression and data analysis.
-    * Elasticvue a web front end for browsing and interacting with an Elastic Search cluster.
-    * Geoip Attack Map a beautifully animated attack map for T-Pot.
-    * Spiderfoot a open source intelligence automation tool.
+    * Elasticvue a web front end for browsing and interacting with an Elasticsearch cluster.
+    * T-Pot Attack Map a beautifully animated attack map for T-Pot.
+    * Spiderfoot an open source intelligence automation tool.
 4. Honeypots
    * A selection of the 22 available honeypots based on the selected edition and / or setup.
 5. Network Security Monitoring (NSM)
@ -207,7 +207,7 @@ All T-Pot installations will require ...
 <br><br>

 ## Running in a VM
-T-Pot is reported to run with with the following hypervisors, however not each and every combination is tested.
+T-Pot is reported to run with the following hypervisors, however not each and every combination is tested.
 * [UTM (Intel & Apple Silicon)](https://mac.getutm.app/)
 * [VirtualBox](https://www.virtualbox.org/)
 * [VMWare vSphere / ESXi](https://kb.vmware.com/s/article/2107518)
@ -237,7 +237,7 @@ Some users report working installations on other clouds and hosters, i.e. Azure
 <br><br>

 ## Required Ports
-Besides the ports generally needed by the OS, i.e. obtaining a DHCP lease, DNS, etc. T-Pot will require the following ports for incomding / outgoing connections. Review the [T-Pot Architecure](#technical-architecture) for a visual representation. Also some ports will show up as duplicates, which is fine since used in different editions.
+Besides the ports generally needed by the OS, i.e. obtaining a DHCP lease, DNS, etc. T-Pot will require the following ports for incoming / outgoing connections. Review the [T-Pot Architecture](#technical-architecture) for a visual representation. Also some ports will show up as duplicates, which is fine since used in different editions.
 | Port        | Protocol | Direction | Description                                                   |
 | :---        | :---     | :---      | :---                                                          |
 | 80, 443     | tcp      | outgoing  | T-Pot Management: Install, Updates, Logs (i.e. Debian, GitHub, DockerHub, PyPi, Sicherheitstacho, etc. |
@ -269,20 +269,20 @@ Besides the ports generally needed by the OS, i.e. obtaining a DHCP lease, DNS,
 | 80          | tcp      | incoming  | Honeypot: Snare (Tanner)                                      |


-Ports and availability of SaaS services may vary based on your geographical location. Also during first install outgoing ICMP / TRACEROUTE is required additionally to find the closest and fastest mirror to you.
+Ports and availability of SaaS services may vary based on your geographical location. Also during the first install outgoing ICMP / TRACEROUTE is required additionally to find the closest and fastest mirror to you.

 For some honeypots to reach full functionality (i.e. Cowrie or Log4Pot) outgoing connections are necessary as well, in order for them to download the attackers malware. Please see the individual honeypot's documentation to learn more by following the [links](#technical-concept) to their repositories.

 <br><br>

 # System Placement
-It is recommended to get yourself familiar how T-Pot and the honeypots work before you start exposing towards the interet. For a quickstart run a T-Pot installation in a virtual machine.
+It is recommended to get yourself familiar with how T-Pot and the honeypots work before you start exposing towards the internet. For a quickstart run a T-Pot installation in a virtual machine.
 <br><br>
-Once you are familiar how things work you should choose a network you suspect intruders in or from (i.e. the internet). Otherwise T-Pot will most likely not capture any attacks (unless you want to proof a point)! For starters it is recommended to put T-Pot in an unfiltered zone, where all TCP and UDP traffic is forwarded to T-Pot's network interface. To avoid probing for T-Pot's management ports you can put T-Pot behind a firewall and forward all TCP / UDP traffic in the port range of 1-64000 to T-Pot while allowing access to ports > 64000 only from trusted IPs and / or only expose the [ports](#required-ports) relevant to your use-case. If you wish to catch malware traffic on unknown ports you should not limit the ports you forward since glutton and honeytrap dynamically bind any TCP port that is not covered by other honeypot daemons and thus give you a better representation what risks your setup is exposed to.
+Once you are familiar with how things work you should choose a network you suspect intruders in or from (i.e. the internet). Otherwise T-Pot will most likely not capture any attacks (unless you want to prove a point)! For starters it is recommended to put T-Pot in an unfiltered zone, where all TCP and UDP traffic is forwarded to T-Pot's network interface. To avoid probing for T-Pot's management ports you can put T-Pot behind a firewall and forward all TCP / UDP traffic in the port range of 1-64000 to T-Pot while allowing access to ports > 64000 only from trusted IPs and / or only expose the [ports](#required-ports) relevant to your use-case. If you wish to catch malware traffic on unknown ports you should not limit the ports you forward since glutton and honeytrap dynamically bind any TCP port that is not covered by other honeypot daemons and thus give you a better representation of the risks your setup is exposed to.
 <br><br>

 # Installation
-The T-Pot installation is offered in different variations. While the overall installation of T-Pot is straight forward it heavily depends on a working, non-proxied (unless you made modifications) up and running internet connection (also see [required outgoing ports](#required-ports)). If these conditions are not met the installation **will fail!** either during the execution of the Debian Installer, after the first reboot before the T-Pot Installer is starting up or while the T-Pot installer is trying to download all the necessary dependencies.
+The T-Pot installation is offered in different variations. While the overall installation of T-Pot is straightforward it heavily depends on a working, non-proxied (unless you made modifications) up and running internet connection (also see [required outgoing ports](#required-ports)). If these conditions are not met the installation **will fail!** either during the execution of the Debian Installer, after the first reboot before the T-Pot Installer is starting up or while the T-Pot installer is trying to download all the necessary dependencies.
 <br><br>

 ## ISO Based
@ -337,7 +337,7 @@ cd tpotce/iso/installer/
 The installation will now start, you can now move on to the [T-Pot Installer](#t-pot-installer) section.
 <br><br>

-### **Post-Install Auto**
+### **Post-Install Auto Method**
 You can also let the installer run automatically if you provide your own `tpot.conf`. An example is available in `tpotce/iso/installer/tpot.conf.dist`. This should make things easier in case you want to automate the installation i.e. with **Ansible**.

 Just follow these steps while adjusting `tpot.conf` to your needs:
@ -359,7 +359,7 @@ In the past T-Pot was only available as a [standalone](#standalone) solution wit
 <br><br>

 ### **Standalone**
-With T-Pot Standalone all services, tools, honeypots, etc. will be installed on to a single host. Make sure to meet the [system requirements](#system-requirements). You can choose from various pre-defined T-Pot editions (or flavors) depending on your personal use-case (you can always adjust `/opt/tpot/etc/tpot.yml` to your needs).
+With T-Pot Standalone all services, tools, honeypots, etc. will be installed on to a single host. Make sure to meet the [system requirements](#system-requirements). You can choose from various predefined T-Pot editions (or flavors) depending on your personal use-case (you can always adjust `/opt/tpot/etc/tpot.yml` to your needs).
 Once the installation is finished you can proceed to [First Start](#first-start).
 <br><br>

@ -544,7 +544,7 @@ T-Pot is designed to be low maintenance. Basically there is nothing you have to
 <br><br>

 ## Updates
-While security update are installed automatically by the OS and docker images are pulled once per day (`/etc/crontab`) to check for updated images, T-Pot offers the option to be updated to the latest master and / or upgrade a previous version. Updating and upgrading always introduces the risk of loosing your data, so it is heavily encouraged you backup your machine before proceeding.
+While security updates are installed automatically by the OS and docker images are pulled once per day (`/etc/crontab`) to check for updated images, T-Pot offers the option to be updated to the latest master and / or upgrade a previous version. Updating and upgrading always introduces the risk of losing your data, so it is heavily encouraged to backup your machine before proceeding.
 <br><br>
 Should an update fail, opening an issue or a discussion will help to improve things in the future, but the solution will always be to perform a ***fresh install*** as we simply ***cannot*** provide any support for lost data!
 <br>
@ -561,13 +561,8 @@ The update script will ...


 ### **Update from 20.06.x**
-If you are running T-Pot 20.06.x you simply follow these commands ***after you backed up any relevant data***:
-```
-sudo su -
-cd /opt/tpot/
-wget -O update.sh https://raw.githubusercontent.com/telekom-security/tpotce/master/update.sh
-./update.sh
-```
+Due to massive changes in Elasticsearch automated updates from 20.06.x are no longer available. If you have not upgraded already a fresh install with 22.04.x is required.
+

 ### **Updates for 22.04.x**
 If you are already running T-Pot 22.04.x you simply run the update script ***after you backed up any relevant data***:
@ -698,7 +693,7 @@ Some T-Pot updates will require you to update the Kibana objects. Either to supp
 1. Go to Kibana
 2. Click on "Stack Management"
 3. Click on "Saved Objects"
-4. Click on "Export <no.> objetcs"
+4. Click on "Export <no.> objects"
 5. Click on "Export all"
 This will export a NDJSON file with all your objects. Always run a full export to make sure all references are included.

@ -728,7 +723,7 @@ reboot
 <br><br>

 ## Adjust tpot.yml
-Maybe the avaialble T-Pot editions do not apply to your use-case or you need a different set of honeypots. You can adjust `/opt/tpot/etc/tpot.yml` to your own preference. If you need examples how this works, just follow the configuration of the existing editions (docker-compose files) in `/opt/tpot/etc/compose` and follow the [Docker Compose Specification](https://docs.docker.com/compose/compose-file/).
+Maybe the available T-Pot editions do not apply to your use-case or you need a different set of honeypots. You can adjust `/opt/tpot/etc/tpot.yml` to your own preference. If you need examples of how this works, just follow the configuration of the existing editions (docker-compose files) in `/opt/tpot/etc/compose` and follow the [Docker Compose Specification](https://docs.docker.com/compose/compose-file/).
 ```
 sudo su -
 systemctl stop tpot
@ -744,13 +739,13 @@ You can enable two-factor-authentication for Cockpit by running `2fa.sh`.
 <br><br>

 # Troubleshooting
-Generally T-Pot is offered ***as is*** without any committment regarding support. Issues and discussions can opened, but be prepared to include basic necessary info, so the community is able to help.
+Generally T-Pot is offered ***as is*** without any commitment regarding support. Issues and discussions can be opened, but be prepared to include basic necessary info, so the community is able to help.
 <br><br>

 ## Logging
 * Check if your containers are running correctly: `dps.sh`

-* Check if your system ressources are not exhausted: `htop`, `glances`
+* Check if your system resources are not exhausted: `htop`, `glances`

 * Check if there is a port conflict:
 ```
@ -808,13 +803,13 @@ If there are any banned IPs you can unban these with `fail2ban-client unban --al

 ## RAM and Storage
 The Elastic Stack is hungry for RAM, specifically `logstash` and `elasticsearch`. If the Elastic Stack is unavailable, does not receive any logs or simply keeps crashing it is most likely a RAM or Storage issue.
-While T-Pot keeps trying to restart the services / containers run `docker logs -f <container_name>` (either `logstash` or `elasticsearch`) and check if there any warnings or failures involving RAM.
+While T-Pot keeps trying to restart the services / containers run `docker logs -f <container_name>` (either `logstash` or `elasticsearch`) and check if there are any warnings or failures involving RAM.

 Storage failures can be identified easier via `htop` or `glances`. 
 <br><br>

 # Contact
-T-Pot is provided ***as is*** open source ***without*** any committment regarding support ([see the disclaimer](#disclaimer)).
+T-Pot is provided ***as is*** open source ***without*** any commitment regarding support ([see the disclaimer](#disclaimer)).

 If you are a company or institution and wish a personal contact aside from [issues](#issues) and [discussions](#discussions) please get in contact with our [sales team](https://www.t-systems.com/de/en/security).

@ -824,7 +819,7 @@ If you are a security researcher and want to responsibly report an issue please
 ## Issues
 Please report issues (errors) on our [GitHub Issues](https://github.com/telekom-security/tpotce/issues), but [troubleshoot](#troubleshooting) first. Issues not providing information to address the error will be closed or converted into [discussions](#discussions).

-Feel free to use the search function, it is possible a similar issues has been adressed already, with the solution just a search away.
+Feel free to use the search function, it is possible a similar issue has been addressed already, with the solution just a search away.
 <br><br>

 ## Discussions
@ -840,7 +835,7 @@ The software that T-Pot is built on uses the following licenses.
 <br>Apache 2 License: [cyberchef](https://github.com/gchq/CyberChef/blob/master/LICENSE), [dicompot](https://github.com/nsmfoo/dicompot/blob/master/LICENSE), [elasticsearch](https://github.com/elasticsearch/elasticsearch/blob/master/LICENSE.txt), [logstash](https://github.com/elasticsearch/logstash/blob/master/LICENSE), [kibana](https://github.com/elasticsearch/kibana/blob/master/LICENSE.md), [docker](https://github.com/docker/docker/blob/master/LICENSE)
 <br>MIT license: [ciscoasa](https://github.com/Cymmetria/ciscoasa_honeypot/blob/master/LICENSE), [ddospot](https://github.com/aelth/ddospot/blob/master/LICENSE), [elasticvue](https://github.com/cars10/elasticvue/blob/master/LICENSE), [glutton](https://github.com/mushorg/glutton/blob/master/LICENSE), [hellpot](https://github.com/yunginnanet/HellPot/blob/master/LICENSE), [maltrail](https://github.com/stamparm/maltrail/blob/master/LICENSE)
 <br> Unlicense: [endlessh](https://github.com/skeeto/endlessh/blob/master/UNLICENSE)
-<br> Other: [citrixhoneypot](https://github.com/MalwareTech/CitrixHoneypot#licencing-agreement-malwaretech-public-licence), [cowrie](https://github.com/micheloosterhof/cowrie/blob/master/LICENSE.md), [mailoney](https://github.com/awhitehatter/mailoney), [Debian licensing](https://www.debian.org/legal/licenses/), [Elastic License](https://www.elastic.co/licensing/elastic-license)
+<br> Other: [citrixhoneypot](https://github.com/MalwareTech/CitrixHoneypot#licencing-agreement-malwaretech-public-licence), [cowrie](https://github.com/cowrie/cowrie/blob/master/LICENSE.rst), [mailoney](https://github.com/awhitehatter/mailoney), [Debian licensing](https://www.debian.org/legal/licenses/), [Elastic License](https://www.elastic.co/licensing/elastic-license)
 <br> AGPL-3.0: [honeypots](https://github.com/qeeqbox/honeypots/blob/main/LICENSE)
 <br><br>

@ -856,7 +851,7 @@ Without open source and the fruitful development community (we are proud to be a
 * [citrixhoneypot](https://github.com/MalwareTech/CitrixHoneypot/graphs/contributors)
 * [cockpit](https://github.com/cockpit-project/cockpit/graphs/contributors)
 * [conpot](https://github.com/mushorg/conpot/graphs/contributors)
-* [cowrie](https://github.com/micheloosterhof/cowrie/graphs/contributors)
+* [cowrie](https://github.com/cowrie/cowrie/graphs/contributors)
 * [ddospot](https://github.com/aelth/ddospot/graphs/contributors)
 * [debian](http://www.debian.org/)
 * [dicompot](https://github.com/nsmfoo/dicompot/graphs/contributors)
@ -906,3 +901,5 @@ And from @robcowart (creator of [ElastiFlow](https://github.com/robcowart/elasti
 ***"#TPot is one of the most well put together turnkey honeypot solutions. It is a must-have for anyone wanting to analyze and understand the behavior of malicious actors and the threat they pose to your organization."***
 <br><br>
 **Thank you!**
+
+![Alt](https://repobeats.axiom.co/api/embed/642a1032ac85996c81b12cf9f6393103058b8a04.svg "Repobeats analytics image")
--- a/SECURITY.md
+++ b/SECURITY.md
@ -0,0 +1,20 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+|---------| ------------------ |
+| 23.12.x | :white_check_mark: |
+
+
+## Reporting a Vulnerability
+
+We take security of T-Pot very seriously. If one of T-Pot's components is affected, it is most likely that a upstream component we rely on is involved, such as a honeypot, docker image, tool or package. Together we will find the best possible way to remedy the situation.
+
+Before you submit a possible vulnerability, please ensure you have done the following:
+1. You have checked the documentation, issues and discussions if the detected behavior is typical and does not revolve around other issues. I.e. Cowrie will be detected with outgoing conncection requests or T-Pot opening all possible TCP ports which Honeytrap enabled install flavors will do as a feature.
+2. You have identified the vulnerable component and isolated your finding (honeypot, docker image, tool, package, etc.).
+3. You have a detailed description including log files, possibly debug files, with all steps necessary for us to reproduce / trigger the behaviour or vulnerability. At best you already have a possible solution, hotfix, fix or patch to remedy the situation and want to submit a PR. 
+4. You have checked if the possible vulnerability is known upstream. If a fix / patch is already available, please provide the necessary info.
+
+We will get back to you as fast as possible. In case you think this is an emergency for the whole T-Pot community feel free to speed things up by **responsibly** informing our [CERT](https://www.telekom.com/en/corporate-responsibility/data-protection-data-security/security/details/introducing-deutsche-telekom-cert-358316).
--- a/_deprecated/bin/2fa.sh
+++ b/_deprecated/bin/2fa.sh
--- a/_deprecated/bin/backup_es_folders.sh
+++ b/_deprecated/bin/backup_es_folders.sh
--- a/_deprecated/bin/blackhole.sh
+++ b/_deprecated/bin/blackhole.sh
--- a/_deprecated/bin/change_ews_config.sh
+++ b/_deprecated/bin/change_ews_config.sh
--- a/_deprecated/bin/clean.sh
+++ b/_deprecated/bin/clean.sh
@ -117,7 +117,7 @@ fuCOWRIE () {
 # Let's create a function to clean up and prepare ddospot data
 fuDDOSPOT () {
  if [ "$myPERSISTENCE" != "on" ]; then rm -rf /data/ddospot/log; fi
-  mkdir -p /data/ddospot/log
+  mkdir -p /data/ddospot/bl /data/ddospot/db /data/ddospot/log
  chmod 770 /data/ddospot -R
  chown tpot:tpot /data/ddospot -R
 }
--- a/_deprecated/bin/deploy.sh
+++ b/_deprecated/bin/deploy.sh
--- a/_deprecated/bin/deprecated/export_kibana-objects.sh
+++ b/_deprecated/bin/deprecated/export_kibana-objects.sh
--- a/_deprecated/bin/deprecated/hptest.sh
+++ b/_deprecated/bin/deprecated/hptest.sh
--- a/_deprecated/bin/deprecated/import_kibana-objects.sh
+++ b/_deprecated/bin/deprecated/import_kibana-objects.sh
--- a/_deprecated/bin/dps.sh
+++ b/_deprecated/bin/dps.sh
@ -11,7 +11,7 @@ fi
 myPARAM="$1"
 if [[ $myPARAM =~ ^([1-9]|[1-9][0-9]|[1-9][0-9][0-9])$ ]];
  then
-    watch --color -n $myPARAM "dps.sh"
+    watch --color -n $myPARAM "$0"
    exit
 fi

--- a/_deprecated/bin/dump_es.sh
+++ b/_deprecated/bin/dump_es.sh
--- a/_deprecated/bin/hpfeeds_optin.sh
+++ b/_deprecated/bin/hpfeeds_optin.sh
--- a/_deprecated/bin/hptest.sh
+++ b/_deprecated/bin/hptest.sh
--- a/_deprecated/bin/myip.sh
+++ b/_deprecated/bin/myip.sh
--- a/_deprecated/bin/mytopips.sh
+++ b/_deprecated/bin/mytopips.sh
--- a/_deprecated/bin/restore_es.sh
+++ b/_deprecated/bin/restore_es.sh
--- a/_deprecated/bin/rules.sh
+++ b/_deprecated/bin/rules.sh
@ -1,7 +1,7 @@
 #!/bin/bash

 ### Vars, Ports for Standard services
-myHOSTPORTS="7634 64294 64295"
+myHOSTPORTS="7634 64294 64295 64297 64304"
 myDOCKERCOMPOSEYML="$1"
 myRULESFUNCTION="$2"

--- a/_deprecated/bin/tpdclean.sh
+++ b/_deprecated/bin/tpdclean.sh
--- a/_deprecated/bin/tped.sh
+++ b/_deprecated/bin/tped.sh
--- a/_deprecated/bin/unlock_es.sh
+++ b/_deprecated/bin/unlock_es.sh
--- a/_deprecated/bin/updateip.sh
+++ b/_deprecated/bin/updateip.sh
@ -3,7 +3,7 @@
 # If the external IP cannot be detected, the internal IP will be inherited.
 source /etc/environment
 myCHECKIFSENSOR=$(head -n 1 /opt/tpot/etc/tpot.yml | grep "Sensor" | wc -l)
-myUUID=$(lsblk -o MOUNTPOINT,UUID | grep "/" | awk '{ print $2 }')
+myUUID=$(lsblk -o MOUNTPOINT,UUID | grep -e "^/ " | awk '{ print $2 }')
 myLOCALIP=$(hostname -I | awk '{ print $1 }')
 myEXTIP=$(/opt/tpot/bin/myip.sh)
 if [ "$myEXTIP" = "" ];
--- a/_deprecated/cloud/.gitignore
+++ b/_deprecated/cloud/.gitignore
--- a/_deprecated/cloud/ansible/README.md
+++ b/_deprecated/cloud/ansible/README.md
--- a/_deprecated/cloud/ansible/doc/otc_1_project.gif
+++ b/_deprecated/cloud/ansible/doc/otc_1_project.gif
--- a/_deprecated/cloud/ansible/doc/otc_2_user.gif
+++ b/_deprecated/cloud/ansible/doc/otc_2_user.gif
--- a/_deprecated/cloud/ansible/doc/otc_3_login.gif
+++ b/_deprecated/cloud/ansible/doc/otc_3_login.gif
--- a/_deprecated/cloud/ansible/doc/otc_4_import_key.gif
+++ b/_deprecated/cloud/ansible/doc/otc_4_import_key.gif
--- a/_deprecated/cloud/ansible/doc/putty_agent_forwarding.png
+++ b/_deprecated/cloud/ansible/doc/putty_agent_forwarding.png
--- a/_deprecated/cloud/ansible/openstack/ansible.cfg
+++ b/_deprecated/cloud/ansible/openstack/ansible.cfg
--- a/_deprecated/cloud/ansible/openstack/deploy_tpot.yaml
+++ b/_deprecated/cloud/ansible/openstack/deploy_tpot.yaml
--- a/_deprecated/cloud/ansible/openstack/my_os_cloud.yaml
+++ b/_deprecated/cloud/ansible/openstack/my_os_cloud.yaml
--- a/_deprecated/cloud/ansible/openstack/requirements.yaml
+++ b/_deprecated/cloud/ansible/openstack/requirements.yaml
--- a/_deprecated/cloud/ansible/openstack/roles/check/tasks/main.yaml
+++ b/_deprecated/cloud/ansible/openstack/roles/check/tasks/main.yaml
--- a/_deprecated/cloud/ansible/openstack/roles/create_net/tasks/main.yaml
+++ b/_deprecated/cloud/ansible/openstack/roles/create_net/tasks/main.yaml
--- a/_deprecated/cloud/ansible/openstack/roles/create_vm/tasks/main.yaml
+++ b/_deprecated/cloud/ansible/openstack/roles/create_vm/tasks/main.yaml
--- a/_deprecated/cloud/ansible/openstack/roles/create_vm/vars/main.yaml
+++ b/_deprecated/cloud/ansible/openstack/roles/create_vm/vars/main.yaml
--- a/_deprecated/cloud/ansible/openstack/roles/custom_ews/tasks/main.yaml
+++ b/_deprecated/cloud/ansible/openstack/roles/custom_ews/tasks/main.yaml
--- a/_deprecated/cloud/ansible/openstack/roles/custom_ews/templates/ews.cfg
+++ b/_deprecated/cloud/ansible/openstack/roles/custom_ews/templates/ews.cfg
--- a/_deprecated/cloud/ansible/openstack/roles/custom_hpfeeds/files/hpfeeds.cfg
+++ b/_deprecated/cloud/ansible/openstack/roles/custom_hpfeeds/files/hpfeeds.cfg
--- a/_deprecated/cloud/ansible/openstack/roles/custom_hpfeeds/tasks/main.yaml
+++ b/_deprecated/cloud/ansible/openstack/roles/custom_hpfeeds/tasks/main.yaml
--- a/_deprecated/cloud/ansible/openstack/roles/install/tasks/main.yaml
+++ b/_deprecated/cloud/ansible/openstack/roles/install/tasks/main.yaml
--- a/_deprecated/cloud/ansible/openstack/roles/install/vars/main.yaml
+++ b/_deprecated/cloud/ansible/openstack/roles/install/vars/main.yaml
--- a/_deprecated/cloud/ansible/openstack/roles/reboot/tasks/main.yaml
+++ b/_deprecated/cloud/ansible/openstack/roles/reboot/tasks/main.yaml
--- a/_deprecated/cloud/terraform/README.md
+++ b/_deprecated/cloud/terraform/README.md
--- a/_deprecated/cloud/terraform/aws/.terraform.lock.hcl
+++ b/_deprecated/cloud/terraform/aws/.terraform.lock.hcl
--- a/_deprecated/cloud/terraform/aws/main.tf
+++ b/_deprecated/cloud/terraform/aws/main.tf
--- a/_deprecated/cloud/terraform/aws/outputs.tf
+++ b/_deprecated/cloud/terraform/aws/outputs.tf
--- a/_deprecated/cloud/terraform/aws/variables.tf
+++ b/_deprecated/cloud/terraform/aws/variables.tf
--- a/_deprecated/cloud/terraform/aws/versions.tf
+++ b/_deprecated/cloud/terraform/aws/versions.tf
--- a/_deprecated/cloud/terraform/aws_multi_region/_provider.tf
+++ b/_deprecated/cloud/terraform/aws_multi_region/_provider.tf
--- a/_deprecated/cloud/terraform/aws_multi_region/main.tf
+++ b/_deprecated/cloud/terraform/aws_multi_region/main.tf
--- a/_deprecated/cloud/terraform/aws_multi_region/modules/multi-region/main.tf
+++ b/_deprecated/cloud/terraform/aws_multi_region/modules/multi-region/main.tf
--- a/_deprecated/cloud/terraform/aws_multi_region/modules/multi-region/outputs.tf
+++ b/_deprecated/cloud/terraform/aws_multi_region/modules/multi-region/outputs.tf
--- a/_deprecated/cloud/terraform/aws_multi_region/modules/multi-region/variables.tf
+++ b/_deprecated/cloud/terraform/aws_multi_region/modules/multi-region/variables.tf
--- a/_deprecated/cloud/terraform/aws_multi_region/modules/multi-region/versions.tf
+++ b/_deprecated/cloud/terraform/aws_multi_region/modules/multi-region/versions.tf
--- a/_deprecated/cloud/terraform/aws_multi_region/outputs.tf
+++ b/_deprecated/cloud/terraform/aws_multi_region/outputs.tf
--- a/_deprecated/cloud/terraform/aws_multi_region/variables.tf
+++ b/_deprecated/cloud/terraform/aws_multi_region/variables.tf
--- a/_deprecated/cloud/terraform/cloud-init.yaml
+++ b/_deprecated/cloud/terraform/cloud-init.yaml
--- a/_deprecated/cloud/terraform/otc/.terraform.lock.hcl
+++ b/_deprecated/cloud/terraform/otc/.terraform.lock.hcl
--- a/_deprecated/cloud/terraform/otc/main.tf
+++ b/_deprecated/cloud/terraform/otc/main.tf
--- a/_deprecated/cloud/terraform/otc/outputs.tf
+++ b/_deprecated/cloud/terraform/otc/outputs.tf
--- a/_deprecated/cloud/terraform/otc/provider.tf
+++ b/_deprecated/cloud/terraform/otc/provider.tf
--- a/_deprecated/cloud/terraform/otc/variables.tf
+++ b/_deprecated/cloud/terraform/otc/variables.tf
--- a/_deprecated/cloud/terraform/otc/versions.tf
+++ b/_deprecated/cloud/terraform/otc/versions.tf
--- a/_deprecated/etc/compose/collector.yml
+++ b/_deprecated/etc/compose/collector.yml
@ -0,0 +1,260 @@
+# T-Pot (Collector)
+# Do not erase ports sections, these are used by /opt/tpot/bin/rules.sh to setup iptables ACCEPT rules for NFQ (honeytrap / glutton)
+version: '2.3'
+
+networks:
+  heralding_local:
+  ewsposter_local:
+  spiderfoot_local:
+
+services:
+
+##################
+#### Honeypots
+##################
+
+# Heralding service
+  heralding:
+    container_name: heralding
+    restart: always
+    tmpfs:
+     - /tmp/heralding:uid=2000,gid=2000
+    networks:
+     - heralding_local
+    ports:
+     - "21:21"
+     - "22:22"
+     - "23:23"
+     - "25:25"
+     - "80:80"
+     - "110:110"
+     - "143:143"
+     - "443:443"
+     - "465:465"
+     - "993:993"
+     - "995:995"
+     - "1080:1080"
+     - "3306:3306"
+     - "3389:3389"
+     - "5432:5432"
+     - "5900:5900"
+    image: "dtagdevsec/heralding:2204"
+    read_only: true
+    volumes:
+     - /data/heralding/log:/var/log/heralding
+
+# Honeytrap service
+  honeytrap:
+    container_name: honeytrap
+    restart: always
+    tmpfs:
+     - /tmp/honeytrap:uid=2000,gid=2000
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+    image: "dtagdevsec/honeytrap:2204"
+    read_only: true
+    volumes:
+     - /data/honeytrap/attacks:/opt/honeytrap/var/attacks
+     - /data/honeytrap/downloads:/opt/honeytrap/var/downloads
+     - /data/honeytrap/log:/opt/honeytrap/var/log
+
+
+##################
+#### NSM
+##################
+
+# Fatt service
+  fatt:
+    container_name: fatt
+    restart: always
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+     - SYS_NICE
+     - NET_RAW
+    image: "dtagdevsec/fatt:2204"
+    volumes:
+     - /data/fatt/log:/opt/fatt/log
+
+# P0f service
+  p0f:
+    container_name: p0f
+    restart: always
+    network_mode: "host"
+    image: "dtagdevsec/p0f:2204"
+    read_only: true
+    volumes:
+     - /data/p0f/log:/var/log/p0f
+
+# Suricata service
+  suricata:
+    container_name: suricata
+    restart: always
+    environment:
+    # For ET Pro ruleset replace "OPEN" with your OINKCODE
+     - OINKCODE=OPEN
+    # Loading externel Rules from URL 
+    # - FROMURL="https://username:password@yoururl.com|https://username:password@otherurl.com"
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+     - SYS_NICE
+     - NET_RAW
+    image: "dtagdevsec/suricata:2204"
+    volumes:
+     - /data/suricata/log:/var/log/suricata
+
+
+##################
+#### Tools
+##################
+
+#### ELK
+## Elasticsearch service
+  elasticsearch:
+    container_name: elasticsearch
+    restart: always
+    environment:
+     - bootstrap.memory_lock=true
+     - ES_JAVA_OPTS=-Xms2048m -Xmx2048m
+     - ES_TMPDIR=/tmp
+    cap_add:
+     - IPC_LOCK
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+      nofile:
+        soft: 65536
+        hard: 65536
+    mem_limit: 4g
+    ports:
+     - "127.0.0.1:64298:9200"
+    image: "dtagdevsec/elasticsearch:2204"
+    volumes:
+     - /data:/data
+
+## Kibana service
+  kibana:
+    container_name: kibana
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    mem_limit: 1g
+    ports:
+     - "127.0.0.1:64296:5601"
+    image: "dtagdevsec/kibana:2204"
+
+## Logstash service
+  logstash:
+    container_name: logstash
+    restart: always
+    environment:
+     - LS_JAVA_OPTS=-Xms1024m -Xmx1024m
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    mem_limit: 2g
+    image: "dtagdevsec/logstash:2204"
+    volumes:
+     - /data:/data
+
+## Map Redis Service
+  map_redis:
+    container_name: map_redis
+    restart: always
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/redis:2204"
+    read_only: true
+
+## Map Web Service
+  map_web:
+    container_name: map_web
+    restart: always
+    environment:
+     - MAP_COMMAND=AttackMapServer.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    ports:
+     - "127.0.0.1:64299:64299"
+    image: "dtagdevsec/map:2204"
+
+## Map Data Service
+  map_data:
+    container_name: map_data
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    environment:
+     - MAP_COMMAND=DataServer_v2.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/map:2204"
+#### /ELK
+
+# Ewsposter service
+  ewsposter:
+    container_name: ewsposter
+    restart: always
+    networks:
+     - ewsposter_local
+    environment:
+     - EWS_HPFEEDS_ENABLE=false
+     - EWS_HPFEEDS_HOST=host
+     - EWS_HPFEEDS_PORT=port
+     - EWS_HPFEEDS_CHANNELS=channels
+     - EWS_HPFEEDS_IDENT=user
+     - EWS_HPFEEDS_SECRET=secret
+     - EWS_HPFEEDS_TLSCERT=false
+     - EWS_HPFEEDS_FORMAT=json
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    image: "dtagdevsec/ewsposter:2204"
+    volumes:
+     - /data:/data
+     - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip
+
+# Nginx service
+  nginx:
+    container_name: nginx
+    restart: always
+    tmpfs:
+     - /var/tmp/nginx/client_body
+     - /var/tmp/nginx/proxy
+     - /var/tmp/nginx/fastcgi
+     - /var/tmp/nginx/uwsgi
+     - /var/tmp/nginx/scgi
+     - /run
+     - /var/lib/nginx/tmp:uid=100,gid=82
+    network_mode: "host"
+      #    ports:
+      #     - "64297:64297"
+      #     - "127.0.0.1:64304:64304"
+    image: "dtagdevsec/nginx:2204"
+    read_only: true
+    volumes:
+     - /data/nginx/cert/:/etc/nginx/cert/:ro
+     - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro
+     - /data/nginx/log/:/var/log/nginx/
+
+# Spiderfoot service
+  spiderfoot:
+    container_name: spiderfoot
+    restart: always
+    networks:
+     - spiderfoot_local
+    ports:
+     - "127.0.0.1:64303:8080"
+    image: "dtagdevsec/spiderfoot:2204"
+    volumes:
+     - /data/spiderfoot:/home/spiderfoot/.spiderfoot
--- a/_deprecated/etc/compose/hive.yml
+++ b/_deprecated/etc/compose/hive.yml
@ -0,0 +1,141 @@
+# T-Pot (Hive)
+# Do not erase ports sections, these are used by /opt/tpot/bin/rules.sh to setup iptables ACCEPT rules for NFQ (honeytrap / glutton)
+version: '2.3'
+
+networks:
+  spiderfoot_local:
+
+services:
+
+##################
+#### Tools
+##################
+
+#### ELK
+## Elasticsearch service
+  elasticsearch:
+    container_name: elasticsearch
+    restart: always
+    environment:
+     - bootstrap.memory_lock=true
+     - ES_JAVA_OPTS=-Xms2048m -Xmx2048m
+     - ES_TMPDIR=/tmp
+    cap_add:
+     - IPC_LOCK
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+      nofile:
+        soft: 65536
+        hard: 65536
+#    mem_limit: 4g
+    ports:
+     - "127.0.0.1:64298:9200"
+    image: "dtagdevsec/elasticsearch:2204"
+    volumes:
+     - /data:/data
+
+## Kibana service
+  kibana:
+    container_name: kibana
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+#    mem_limit: 1g
+    ports:
+     - "127.0.0.1:64296:5601"
+    image: "dtagdevsec/kibana:2204"
+
+## Logstash service
+  logstash:
+    container_name: logstash
+    restart: always
+    environment:
+     - LS_JAVA_OPTS=-Xms2048m -Xmx2048m
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    ports:
+     - "127.0.0.1:64305:64305"
+#    mem_limit: 2g
+    image: "dtagdevsec/logstash:2204"
+    volumes:
+     - /data:/data
+
+## Map Redis Service
+  map_redis:
+    container_name: map_redis
+    restart: always
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/redis:2204"
+    read_only: true
+
+## Map Web Service
+  map_web:
+    container_name: map_web
+    restart: always
+    environment:
+     - MAP_COMMAND=AttackMapServer.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    ports:
+     - "127.0.0.1:64299:64299"
+    image: "dtagdevsec/map:2204"
+
+## Map Data Service
+  map_data:
+    container_name: map_data
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    environment:
+     - MAP_COMMAND=DataServer_v2.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/map:2204"
+#### /ELK
+
+# Nginx service
+  nginx:
+    container_name: nginx
+    restart: always
+    tmpfs:
+     - /var/tmp/nginx/client_body
+     - /var/tmp/nginx/proxy
+     - /var/tmp/nginx/fastcgi
+     - /var/tmp/nginx/uwsgi
+     - /var/tmp/nginx/scgi
+     - /run
+     - /var/lib/nginx/tmp:uid=100,gid=82
+    network_mode: "host"
+      #    ports:
+      #     - "64297:64297"
+      #     - "127.0.0.1:64304:64304"
+    image: "dtagdevsec/nginx:2204"
+    read_only: true
+    volumes:
+     - /data/nginx/cert/:/etc/nginx/cert/:ro
+     - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro
+     - /data/nginx/log/:/var/log/nginx/
+
+# Spiderfoot service
+  spiderfoot:
+    container_name: spiderfoot
+    restart: always
+    networks:
+     - spiderfoot_local
+    ports:
+     - "127.0.0.1:64303:8080"
+    image: "dtagdevsec/spiderfoot:2204"
+    volumes:
+     - /data/spiderfoot:/home/spiderfoot/.spiderfoot
--- a/_deprecated/etc/compose/hive_sensor.yml
+++ b/_deprecated/etc/compose/hive_sensor.yml
@ -374,10 +374,17 @@ services:
  sentrypeer:
    container_name: sentrypeer
    restart: always
+# SentryPeer offers to exchange bad actor data via DHT / P2P mode by setting the ENV to true (1)
+# In some cases (i.e. internally deployed T-Pots) this might be confusing as SentryPeer will show
+# the bad actors in its logs. Therefore this option is opt-in based.
+#    environment:
+#     - SENTRYPEER_PEER_TO_PEER=0
    networks:
     - sentrypeer_local
    ports:
+#     - "4222:4222/udp"
     - "5060:5060/udp"
+#     - "127.0.0.1:8082:8082"
    image: "dtagdevsec/sentrypeer:2204"
    read_only: true
    volumes:
--- a/_deprecated/etc/compose/industrial.yml
+++ b/_deprecated/etc/compose/industrial.yml
@ -0,0 +1,431 @@
+# T-Pot (Industrial)
+# Do not erase ports sections, these are used by /opt/tpot/bin/rules.sh to setup iptables ACCEPT rules for NFQ (honeytrap / glutton)
+version: '2.3'
+
+networks:
+  conpot_local_default:
+  conpot_local_IEC104:
+  conpot_local_guardian_ast:
+  conpot_local_ipmi:
+  conpot_local_kamstrup_382:
+  cowrie_local:
+  dicompot_local:
+  heralding_local:
+  medpot_local:
+  ewsposter_local:
+  spiderfoot_local:
+
+services:
+
+##################
+#### Honeypots
+##################
+
+# Conpot default service
+  conpot_default:
+    container_name: conpot_default
+    restart: always
+    environment:
+     - CONPOT_CONFIG=/etc/conpot/conpot.cfg
+     - CONPOT_JSON_LOG=/var/log/conpot/conpot_default.json
+     - CONPOT_LOG=/var/log/conpot/conpot_default.log
+     - CONPOT_TEMPLATE=default
+     - CONPOT_TMP=/tmp/conpot
+    tmpfs:
+     - /tmp/conpot:uid=2000,gid=2000
+    networks:
+     - conpot_local_default
+    ports:
+     - "69:69/udp"
+     - "80:80"
+     - "102:102"
+     - "161:161/udp"
+     - "502:502"
+#     - "623:623/udp"
+     - "21:21"
+     - "44818:44818"
+     - "47808:47808/udp"
+    image: "dtagdevsec/conpot:2204"
+    read_only: true
+    volumes:
+     - /data/conpot/log:/var/log/conpot
+
+# Conpot IEC104 service
+  conpot_IEC104:
+    container_name: conpot_iec104
+    restart: always
+    environment:
+     - CONPOT_CONFIG=/etc/conpot/conpot.cfg
+     - CONPOT_JSON_LOG=/var/log/conpot/conpot_IEC104.json
+     - CONPOT_LOG=/var/log/conpot/conpot_IEC104.log
+     - CONPOT_TEMPLATE=IEC104
+     - CONPOT_TMP=/tmp/conpot
+    tmpfs:
+     - /tmp/conpot:uid=2000,gid=2000
+    networks:
+     - conpot_local_IEC104
+    ports:
+#     - "161:161/udp"
+     - "2404:2404"
+    image: "dtagdevsec/conpot:2204"
+    read_only: true
+    volumes:
+     - /data/conpot/log:/var/log/conpot
+
+# Conpot guardian_ast service
+  conpot_guardian_ast:
+    container_name: conpot_guardian_ast
+    restart: always
+    environment:
+     - CONPOT_CONFIG=/etc/conpot/conpot.cfg
+     - CONPOT_JSON_LOG=/var/log/conpot/conpot_guardian_ast.json
+     - CONPOT_LOG=/var/log/conpot/conpot_guardian_ast.log
+     - CONPOT_TEMPLATE=guardian_ast
+     - CONPOT_TMP=/tmp/conpot
+    tmpfs:
+     - /tmp/conpot:uid=2000,gid=2000
+    networks:
+     - conpot_local_guardian_ast
+    ports:
+     - "10001:10001"
+    image: "dtagdevsec/conpot:2204"
+    read_only: true
+    volumes:
+     - /data/conpot/log:/var/log/conpot
+
+# Conpot ipmi
+  conpot_ipmi:
+    container_name: conpot_ipmi
+    restart: always
+    environment:
+     - CONPOT_CONFIG=/etc/conpot/conpot.cfg
+     - CONPOT_JSON_LOG=/var/log/conpot/conpot_ipmi.json
+     - CONPOT_LOG=/var/log/conpot/conpot_ipmi.log
+     - CONPOT_TEMPLATE=ipmi
+     - CONPOT_TMP=/tmp/conpot
+    tmpfs:
+     - /tmp/conpot:uid=2000,gid=2000
+    networks:
+     - conpot_local_ipmi
+    ports:
+     - "623:623/udp"
+    image: "dtagdevsec/conpot:2204"
+    read_only: true
+    volumes:
+     - /data/conpot/log:/var/log/conpot
+
+# Conpot kamstrup_382
+  conpot_kamstrup_382:
+    container_name: conpot_kamstrup_382
+    restart: always
+    environment:
+     - CONPOT_CONFIG=/etc/conpot/conpot.cfg
+     - CONPOT_JSON_LOG=/var/log/conpot/conpot_kamstrup_382.json
+     - CONPOT_LOG=/var/log/conpot/conpot_kamstrup_382.log
+     - CONPOT_TEMPLATE=kamstrup_382
+     - CONPOT_TMP=/tmp/conpot
+    tmpfs:
+     - /tmp/conpot:uid=2000,gid=2000
+    networks:
+     - conpot_local_kamstrup_382
+    ports:
+     - "1025:1025"
+     - "50100:50100"
+    image: "dtagdevsec/conpot:2204"
+    read_only: true
+    volumes:
+     - /data/conpot/log:/var/log/conpot
+
+# Cowrie service
+  cowrie:
+    container_name: cowrie
+    restart: always
+    tmpfs:
+     - /tmp/cowrie:uid=2000,gid=2000
+     - /tmp/cowrie/data:uid=2000,gid=2000
+    networks:
+     - cowrie_local
+    ports:
+     - "22:22"
+     - "23:23"
+    image: "dtagdevsec/cowrie:2204"
+    read_only: true
+    volumes:
+     - /data/cowrie/downloads:/home/cowrie/cowrie/dl
+     - /data/cowrie/keys:/home/cowrie/cowrie/etc
+     - /data/cowrie/log:/home/cowrie/cowrie/log
+     - /data/cowrie/log/tty:/home/cowrie/cowrie/log/tty
+
+# Dicompot service
+# Get the Horos Client for testing: https://horosproject.org/
+# Get Dicom images (CC BY 3.0): https://www.cancerimagingarchive.net/collections/
+# Put images (which must be in Dicom DCM format or it will not work!) into /data/dicompot/images
+  dicompot:
+    container_name: dicompot
+    restart: always
+    networks:
+     - dicompot_local
+    ports:
+     - "11112:11112"
+    image: "dtagdevsec/dicompot:2204"
+    read_only: true
+    volumes:
+     - /data/dicompot/log:/var/log/dicompot
+#     - /data/dicompot/images:/opt/dicompot/images
+
+# Heralding service
+  heralding:
+    container_name: heralding
+    restart: always
+    tmpfs:
+     - /tmp/heralding:uid=2000,gid=2000
+    networks:
+     - heralding_local
+    ports:
+    # - "21:21"
+    # - "22:22"
+    # - "23:23"
+    # - "25:25"
+    # - "80:80"
+    # - "110:110"
+    # - "143:143"
+    # - "443:443"
+    # - "465:465"
+    # - "993:993"
+    # - "995:995"
+    # - "3306:3306"
+    # - "3389:3389"
+    # - "5432:5432"
+     - "5900:5900"
+    image: "dtagdevsec/heralding:2204"
+    read_only: true
+    volumes:
+     - /data/heralding/log:/var/log/heralding
+
+# Honeytrap service
+  honeytrap:
+    container_name: honeytrap
+    restart: always
+    tmpfs:
+     - /tmp/honeytrap:uid=2000,gid=2000
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+    image: "dtagdevsec/honeytrap:2204"
+    read_only: true
+    volumes:
+     - /data/honeytrap/attacks:/opt/honeytrap/var/attacks
+     - /data/honeytrap/downloads:/opt/honeytrap/var/downloads
+     - /data/honeytrap/log:/opt/honeytrap/var/log
+
+# Medpot service
+  medpot:
+    container_name: medpot
+    restart: always
+    networks:
+     - medpot_local
+    ports:
+     - "2575:2575"
+    image: "dtagdevsec/medpot:2204"
+    read_only: true
+    volumes:
+     - /data/medpot/log/:/var/log/medpot
+
+##################
+#### NSM
+##################
+
+# Fatt service
+  fatt:
+    container_name: fatt
+    restart: always
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+     - SYS_NICE
+     - NET_RAW
+    image: "dtagdevsec/fatt:2204"
+    volumes:
+     - /data/fatt/log:/opt/fatt/log
+
+# P0f service
+  p0f:
+    container_name: p0f
+    restart: always
+    network_mode: "host"
+    image: "dtagdevsec/p0f:2204"
+    read_only: true
+    volumes:
+     - /data/p0f/log:/var/log/p0f
+
+# Suricata service
+  suricata:
+    container_name: suricata
+    restart: always
+    environment:
+    # For ET Pro ruleset replace "OPEN" with your OINKCODE
+     - OINKCODE=OPEN
+    # Loading externel Rules from URL 
+    # - FROMURL="https://username:password@yoururl.com|https://username:password@otherurl.com"
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+     - SYS_NICE
+     - NET_RAW
+    image: "dtagdevsec/suricata:2204"
+    volumes:
+     - /data/suricata/log:/var/log/suricata
+
+
+##################
+#### Tools
+##################
+
+#### ELK
+## Elasticsearch service
+  elasticsearch:
+    container_name: elasticsearch
+    restart: always
+    environment:
+     - bootstrap.memory_lock=true
+     - ES_JAVA_OPTS=-Xms2048m -Xmx2048m
+     - ES_TMPDIR=/tmp
+    cap_add:
+     - IPC_LOCK
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+      nofile:
+        soft: 65536
+        hard: 65536
+    mem_limit: 4g
+    ports:
+     - "127.0.0.1:64298:9200"
+    image: "dtagdevsec/elasticsearch:2204"
+    volumes:
+     - /data:/data
+
+## Kibana service
+  kibana:
+    container_name: kibana
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    mem_limit: 1g
+    ports:
+     - "127.0.0.1:64296:5601"
+    image: "dtagdevsec/kibana:2204"
+
+## Logstash service
+  logstash:
+    container_name: logstash
+    restart: always
+    environment:
+     - LS_JAVA_OPTS=-Xms1024m -Xmx1024m
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    mem_limit: 2g
+    image: "dtagdevsec/logstash:2204"
+    volumes:
+     - /data:/data
+
+## Map Redis Service
+  map_redis:
+    container_name: map_redis
+    restart: always
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/redis:2204"
+    read_only: true
+
+## Map Web Service
+  map_web:
+    container_name: map_web
+    restart: always
+    environment:
+     - MAP_COMMAND=AttackMapServer.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    ports:
+     - "127.0.0.1:64299:64299"
+    image: "dtagdevsec/map:2204"
+
+## Map Data Service
+  map_data:
+    container_name: map_data
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    environment:
+     - MAP_COMMAND=DataServer_v2.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/map:2204"
+#### /ELK
+
+# Ewsposter service
+  ewsposter:
+    container_name: ewsposter
+    restart: always
+    networks:
+     - ewsposter_local
+    environment:
+     - EWS_HPFEEDS_ENABLE=false
+     - EWS_HPFEEDS_HOST=host
+     - EWS_HPFEEDS_PORT=port
+     - EWS_HPFEEDS_CHANNELS=channels
+     - EWS_HPFEEDS_IDENT=user
+     - EWS_HPFEEDS_SECRET=secret
+     - EWS_HPFEEDS_TLSCERT=false
+     - EWS_HPFEEDS_FORMAT=json
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    image: "dtagdevsec/ewsposter:2204"
+    volumes:
+     - /data:/data
+     - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip
+
+# Nginx service
+  nginx:
+    container_name: nginx
+    restart: always
+    tmpfs:
+     - /var/tmp/nginx/client_body
+     - /var/tmp/nginx/proxy
+     - /var/tmp/nginx/fastcgi
+     - /var/tmp/nginx/uwsgi
+     - /var/tmp/nginx/scgi
+     - /run
+     - /var/lib/nginx/tmp:uid=100,gid=82
+    network_mode: "host"
+      #    ports:
+      #     - "64297:64297"
+      #     - "127.0.0.1:64304:64304"
+    image: "dtagdevsec/nginx:2204"
+    read_only: true
+    volumes:
+     - /data/nginx/cert/:/etc/nginx/cert/:ro
+     - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro
+     - /data/nginx/log/:/var/log/nginx/
+
+# Spiderfoot service
+  spiderfoot:
+    container_name: spiderfoot
+    restart: always
+    networks:
+     - spiderfoot_local
+    ports:
+     - "127.0.0.1:64303:8080"
+    image: "dtagdevsec/spiderfoot:2204"
+    volumes:
+     - /data/spiderfoot:/home/spiderfoot/.spiderfoot
--- a/_deprecated/etc/compose/log4j.yml
+++ b/_deprecated/etc/compose/log4j.yml
@ -0,0 +1,250 @@
+# T-Pot (Log4j)
+# Do not erase ports sections, these are used by /opt/tpot/bin/rules.sh to setup iptables ACCEPT rules for NFQ (honeytrap / glutton)
+version: '2.3'
+
+networks:
+  log4pot_local:
+  ewsposter_local:
+  spiderfoot_local:
+
+services:
+
+##################
+#### Honeypots
+##################
+
+# Log4pot service
+  log4pot:
+    container_name: log4pot
+    restart: always
+    tmpfs:
+     - /tmp:uid=2000,gid=2000
+    networks:
+     - log4pot_local
+    ports:
+     - "80:8080"
+     - "443:8080"
+     - "8080:8080"
+     - "9200:8080"
+     - "25565:8080"
+    image: "dtagdevsec/log4pot:2204"
+    read_only: true
+    volumes:
+     - /data/log4pot/log:/var/log/log4pot/log
+     - /data/log4pot/payloads:/var/log/log4pot/payloads
+
+# Honeytrap service
+  honeytrap:
+    container_name: honeytrap
+    restart: always
+    tmpfs:
+     - /tmp/honeytrap:uid=2000,gid=2000
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+    image: "dtagdevsec/honeytrap:2204"
+    read_only: true
+    volumes:
+     - /data/honeytrap/attacks:/opt/honeytrap/var/attacks
+     - /data/honeytrap/downloads:/opt/honeytrap/var/downloads
+     - /data/honeytrap/log:/opt/honeytrap/var/log
+
+
+##################
+#### NSM
+##################
+
+# Fatt service
+  fatt:
+    container_name: fatt
+    restart: always
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+     - SYS_NICE
+     - NET_RAW
+    image: "dtagdevsec/fatt:2204"
+    volumes:
+     - /data/fatt/log:/opt/fatt/log
+
+# P0f service
+  p0f:
+    container_name: p0f
+    restart: always
+    network_mode: "host"
+    image: "dtagdevsec/p0f:2204"
+    read_only: true
+    volumes:
+     - /data/p0f/log:/var/log/p0f
+
+# Suricata service
+  suricata:
+    container_name: suricata
+    restart: always
+    environment:
+    # For ET Pro ruleset replace "OPEN" with your OINKCODE
+     - OINKCODE=OPEN
+    # Loading externel Rules from URL 
+    # - FROMURL="https://username:password@yoururl.com|https://username:password@otherurl.com"
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+     - SYS_NICE
+     - NET_RAW
+    image: "dtagdevsec/suricata:2204"
+    volumes:
+     - /data/suricata/log:/var/log/suricata
+
+
+##################
+#### Tools
+##################
+
+#### ELK
+## Elasticsearch service
+  elasticsearch:
+    container_name: elasticsearch
+    restart: always
+    environment:
+     - bootstrap.memory_lock=true
+     - ES_JAVA_OPTS=-Xms2048m -Xmx2048m
+     - ES_TMPDIR=/tmp
+    cap_add:
+     - IPC_LOCK
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+      nofile:
+        soft: 65536
+        hard: 65536
+    mem_limit: 4g
+    ports:
+     - "127.0.0.1:64298:9200"
+    image: "dtagdevsec/elasticsearch:2204"
+    volumes:
+     - /data:/data
+
+## Kibana service
+  kibana:
+    container_name: kibana
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    mem_limit: 1g
+    ports:
+     - "127.0.0.1:64296:5601"
+    image: "dtagdevsec/kibana:2204"
+
+## Logstash service
+  logstash:
+    container_name: logstash
+    restart: always
+    environment:
+     - LS_JAVA_OPTS=-Xms1024m -Xmx1024m
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    mem_limit: 2g
+    image: "dtagdevsec/logstash:2204"
+    volumes:
+     - /data:/data
+
+## Map Redis Service
+  map_redis:
+    container_name: map_redis
+    restart: always
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/redis:2204"
+    read_only: true
+
+## Map Web Service
+  map_web:
+    container_name: map_web
+    restart: always
+    environment:
+     - MAP_COMMAND=AttackMapServer.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    ports:
+     - "127.0.0.1:64299:64299"
+    image: "dtagdevsec/map:2204"
+
+## Map Data Service
+  map_data:
+    container_name: map_data
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    environment:
+     - MAP_COMMAND=DataServer_v2.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/map:2204"
+#### /ELK
+
+# Ewsposter service
+  ewsposter:
+    container_name: ewsposter
+    restart: always
+    networks:
+     - ewsposter_local
+    environment:
+     - EWS_HPFEEDS_ENABLE=false
+     - EWS_HPFEEDS_HOST=host
+     - EWS_HPFEEDS_PORT=port
+     - EWS_HPFEEDS_CHANNELS=channels
+     - EWS_HPFEEDS_IDENT=user
+     - EWS_HPFEEDS_SECRET=secret
+     - EWS_HPFEEDS_TLSCERT=false
+     - EWS_HPFEEDS_FORMAT=json
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    image: "dtagdevsec/ewsposter:2204"
+    volumes:
+     - /data:/data
+     - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip
+
+# Nginx service
+  nginx:
+    container_name: nginx
+    restart: always
+    tmpfs:
+     - /var/tmp/nginx/client_body
+     - /var/tmp/nginx/proxy
+     - /var/tmp/nginx/fastcgi
+     - /var/tmp/nginx/uwsgi
+     - /var/tmp/nginx/scgi
+     - /run
+     - /var/lib/nginx/tmp:uid=100,gid=82
+    network_mode: "host"
+      #    ports:
+      #     - "64297:64297"
+      #     - "127.0.0.1:64304:64304"
+    image: "dtagdevsec/nginx:2204"
+    read_only: true
+    volumes:
+     - /data/nginx/cert/:/etc/nginx/cert/:ro
+     - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro
+     - /data/nginx/log/:/var/log/nginx/
+
+# Spiderfoot service
+  spiderfoot:
+    container_name: spiderfoot
+    restart: always
+    networks:
+     - spiderfoot_local
+    ports:
+     - "127.0.0.1:64303:8080"
+    image: "dtagdevsec/spiderfoot:2204"
+    volumes:
+     - /data/spiderfoot:/home/spiderfoot/.spiderfoot
--- a/_deprecated/etc/compose/medical.yml
+++ b/_deprecated/etc/compose/medical.yml
@ -0,0 +1,244 @@
+# T-Pot (Medical)
+# Do not erase ports sections, these are used by /opt/tpot/bin/rules.sh to setup iptables ACCEPT rules for NFQ (honeytrap / glutton)
+version: '2.3'
+
+networks:
+  dicompot_local:
+  medpot_local:
+  ewsposter_local:
+  spiderfoot_local:
+
+services:
+
+##################
+#### Honeypots
+##################
+
+# Dicompot service
+# Get the Horos Client for testing: https://horosproject.org/
+# Get Dicom images (CC BY 3.0): https://www.cancerimagingarchive.net/collections/
+# Put images (which must be in Dicom DCM format or it will not work!) into /data/dicompot/images
+  dicompot:
+    container_name: dicompot
+    restart: always
+    networks:
+     - dicompot_local
+    ports:
+     - "11112:11112"
+    image: "dtagdevsec/dicompot:2204"
+    read_only: true
+    volumes:
+     - /data/dicompot/log:/var/log/dicompot
+#     - /data/dicompot/images:/opt/dicompot/images
+
+# Medpot service
+  medpot:
+    container_name: medpot
+    restart: always
+    networks:
+     - medpot_local
+    ports:
+     - "2575:2575"
+    image: "dtagdevsec/medpot:2204"
+    read_only: true
+    volumes:
+     - /data/medpot/log/:/var/log/medpot
+
+##################
+#### NSM
+##################
+
+# Fatt service
+  fatt:
+    container_name: fatt
+    restart: always
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+     - SYS_NICE
+     - NET_RAW
+    image: "dtagdevsec/fatt:2204"
+    volumes:
+     - /data/fatt/log:/opt/fatt/log
+
+# P0f service
+  p0f:
+    container_name: p0f
+    restart: always
+    network_mode: "host"
+    image: "dtagdevsec/p0f:2204"
+    read_only: true
+    volumes:
+     - /data/p0f/log:/var/log/p0f
+
+# Suricata service
+  suricata:
+    container_name: suricata
+    restart: always
+    environment:
+    # For ET Pro ruleset replace "OPEN" with your OINKCODE
+     - OINKCODE=OPEN
+    # Loading externel Rules from URL 
+    # - FROMURL="https://username:password@yoururl.com|https://username:password@otherurl.com"
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+     - SYS_NICE
+     - NET_RAW
+    image: "dtagdevsec/suricata:2204"
+    volumes:
+     - /data/suricata/log:/var/log/suricata
+
+
+##################
+#### Tools
+##################
+
+#### ELK
+## Elasticsearch service
+  elasticsearch:
+    container_name: elasticsearch
+    restart: always
+    environment:
+     - bootstrap.memory_lock=true
+     - ES_JAVA_OPTS=-Xms2048m -Xmx2048m
+     - ES_TMPDIR=/tmp
+    cap_add:
+     - IPC_LOCK
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+      nofile:
+        soft: 65536
+        hard: 65536
+    mem_limit: 4g
+    ports:
+     - "127.0.0.1:64298:9200"
+    image: "dtagdevsec/elasticsearch:2204"
+    volumes:
+     - /data:/data
+
+## Kibana service
+  kibana:
+    container_name: kibana
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    mem_limit: 1g
+    ports:
+     - "127.0.0.1:64296:5601"
+    image: "dtagdevsec/kibana:2204"
+
+## Logstash service
+  logstash:
+    container_name: logstash
+    restart: always
+    environment:
+     - LS_JAVA_OPTS=-Xms1024m -Xmx1024m
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    mem_limit: 2g
+    image: "dtagdevsec/logstash:2204"
+    volumes:
+     - /data:/data
+
+## Map Redis Service
+  map_redis:
+    container_name: map_redis
+    restart: always
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/redis:2204"
+    read_only: true
+
+## Map Web Service
+  map_web:
+    container_name: map_web
+    restart: always
+    environment:
+     - MAP_COMMAND=AttackMapServer.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    ports:
+     - "127.0.0.1:64299:64299"
+    image: "dtagdevsec/map:2204"
+
+## Map Data Service
+  map_data:
+    container_name: map_data
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    environment:
+     - MAP_COMMAND=DataServer_v2.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/map:2204"
+#### /ELK
+
+# Ewsposter service
+  ewsposter:
+    container_name: ewsposter
+    restart: always
+    networks:
+     - ewsposter_local
+    environment:
+     - EWS_HPFEEDS_ENABLE=false
+     - EWS_HPFEEDS_HOST=host
+     - EWS_HPFEEDS_PORT=port
+     - EWS_HPFEEDS_CHANNELS=channels
+     - EWS_HPFEEDS_IDENT=user
+     - EWS_HPFEEDS_SECRET=secret
+     - EWS_HPFEEDS_TLSCERT=false
+     - EWS_HPFEEDS_FORMAT=json
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    image: "dtagdevsec/ewsposter:2204"
+    volumes:
+     - /data:/data
+     - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip
+
+# Nginx service
+  nginx:
+    container_name: nginx
+    restart: always
+    tmpfs:
+     - /var/tmp/nginx/client_body
+     - /var/tmp/nginx/proxy
+     - /var/tmp/nginx/fastcgi
+     - /var/tmp/nginx/uwsgi
+     - /var/tmp/nginx/scgi
+     - /run
+     - /var/lib/nginx/tmp:uid=100,gid=82
+    network_mode: "host"
+      #    ports:
+      #     - "64297:64297"
+      #     - "127.0.0.1:64304:64304"
+    image: "dtagdevsec/nginx:2204"
+    read_only: true
+    volumes:
+     - /data/nginx/cert/:/etc/nginx/cert/:ro
+     - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro
+     - /data/nginx/log/:/var/log/nginx/
+
+# Spiderfoot service
+  spiderfoot:
+    container_name: spiderfoot
+    restart: always
+    networks:
+     - spiderfoot_local
+    ports:
+     - "127.0.0.1:64303:8080"
+    image: "dtagdevsec/spiderfoot:2204"
+    volumes:
+     - /data/spiderfoot:/home/spiderfoot/.spiderfoot
--- a/_deprecated/etc/compose/mini.yml
+++ b/_deprecated/etc/compose/mini.yml
@ -0,0 +1,271 @@
+# T-Pot (Mini)
+# Do not erase ports sections, these are used by /opt/tpot/bin/rules.sh to setup iptables ACCEPT rules for NFQ (honeytrap / glutton)
+version: '2.3'
+
+networks:
+  honeypots_local:
+  ewsposter_local:
+  spiderfoot_local:
+
+services:
+
+##################
+#### Honeypots
+##################
+
+# qHoneypots service
+  honeypots:
+    container_name: honeypots
+    stdin_open: true
+    tty: true
+    restart: always
+    tmpfs:
+     - /tmp:uid=2000,gid=2000
+    networks:
+     - honeypots_local
+    ports:
+     - "21:21"
+     - "22:22"
+     - "23:23"
+     - "25:25"
+     - "53:53/udp"
+     - "80:80"
+     - "110:110"
+     - "123:123"
+     - "143:143"
+     - "161:161"
+     - "389:389"
+     - "443:443"
+     - "445:445"
+     - "1080:1080"
+     - "1433:1433"
+     - "1521:1521"
+     - "3306:3306"
+     - "5060:5060"
+     - "5432:5432"
+     - "5900:5900"
+     - "6379:6379"
+     - "6667:6667"
+     - "8080:8080"
+     - "9200:9200"
+     - "11211:11211"
+    image: "dtagdevsec/honeypots:2204"
+    read_only: true
+    volumes:
+     - /data/honeypots/log:/var/log/honeypots
+
+# Honeytrap service
+  honeytrap:
+    container_name: honeytrap
+    restart: always
+    tmpfs:
+     - /tmp/honeytrap:uid=2000,gid=2000
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+    image: "dtagdevsec/honeytrap:2204"
+    read_only: true
+    volumes:
+     - /data/honeytrap/attacks:/opt/honeytrap/var/attacks
+     - /data/honeytrap/downloads:/opt/honeytrap/var/downloads
+     - /data/honeytrap/log:/opt/honeytrap/var/log
+
+
+##################
+#### NSM
+##################
+
+# Fatt service
+  fatt:
+    container_name: fatt
+    restart: always
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+     - SYS_NICE
+     - NET_RAW
+    image: "dtagdevsec/fatt:2204"
+    volumes:
+     - /data/fatt/log:/opt/fatt/log
+
+# P0f service
+  p0f:
+    container_name: p0f
+    restart: always
+    network_mode: "host"
+    image: "dtagdevsec/p0f:2204"
+    read_only: true
+    volumes:
+     - /data/p0f/log:/var/log/p0f
+
+# Suricata service
+  suricata:
+    container_name: suricata
+    restart: always
+    environment:
+    # For ET Pro ruleset replace "OPEN" with your OINKCODE
+     - OINKCODE=OPEN
+    # Loading externel Rules from URL 
+    # - FROMURL="https://username:password@yoururl.com|https://username:password@otherurl.com"
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+     - SYS_NICE
+     - NET_RAW
+    image: "dtagdevsec/suricata:2204"
+    volumes:
+     - /data/suricata/log:/var/log/suricata
+
+
+##################
+#### Tools
+##################
+
+#### ELK
+## Elasticsearch service
+  elasticsearch:
+    container_name: elasticsearch
+    restart: always
+    environment:
+     - bootstrap.memory_lock=true
+     - ES_JAVA_OPTS=-Xms2048m -Xmx2048m
+     - ES_TMPDIR=/tmp
+    cap_add:
+     - IPC_LOCK
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+      nofile:
+        soft: 65536
+        hard: 65536
+    mem_limit: 4g
+    ports:
+     - "127.0.0.1:64298:9200"
+    image: "dtagdevsec/elasticsearch:2204"
+    volumes:
+     - /data:/data
+
+## Kibana service
+  kibana:
+    container_name: kibana
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    mem_limit: 1g
+    ports:
+     - "127.0.0.1:64296:5601"
+    image: "dtagdevsec/kibana:2204"
+
+## Logstash service
+  logstash:
+    container_name: logstash
+    restart: always
+    environment:
+     - LS_JAVA_OPTS=-Xms1024m -Xmx1024m
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    mem_limit: 2g
+    image: "dtagdevsec/logstash:2204"
+    volumes:
+     - /data:/data
+
+## Map Redis Service
+  map_redis:
+    container_name: map_redis
+    restart: always
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/redis:2204"
+    read_only: true
+
+## Map Web Service
+  map_web:
+    container_name: map_web
+    restart: always
+    environment:
+     - MAP_COMMAND=AttackMapServer.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    ports:
+     - "127.0.0.1:64299:64299"
+    image: "dtagdevsec/map:2204"
+
+## Map Data Service
+  map_data:
+    container_name: map_data
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    environment:
+     - MAP_COMMAND=DataServer_v2.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/map:2204"
+#### /ELK
+
+# Ewsposter service
+  ewsposter:
+    container_name: ewsposter
+    restart: always
+    networks:
+     - ewsposter_local
+    environment:
+     - EWS_HPFEEDS_ENABLE=false
+     - EWS_HPFEEDS_HOST=host
+     - EWS_HPFEEDS_PORT=port
+     - EWS_HPFEEDS_CHANNELS=channels
+     - EWS_HPFEEDS_IDENT=user
+     - EWS_HPFEEDS_SECRET=secret
+     - EWS_HPFEEDS_TLSCERT=false
+     - EWS_HPFEEDS_FORMAT=json
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    image: "dtagdevsec/ewsposter:2204"
+    volumes:
+     - /data:/data
+     - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip
+
+# Nginx service
+  nginx:
+    container_name: nginx
+    restart: always
+    tmpfs:
+     - /var/tmp/nginx/client_body
+     - /var/tmp/nginx/proxy
+     - /var/tmp/nginx/fastcgi
+     - /var/tmp/nginx/uwsgi
+     - /var/tmp/nginx/scgi
+     - /run
+     - /var/lib/nginx/tmp:uid=100,gid=82
+    network_mode: "host"
+      #    ports:
+      #     - "64297:64297"
+      #     - "127.0.0.1:64304:64304"
+    image: "dtagdevsec/nginx:2204"
+    read_only: true
+    volumes:
+     - /data/nginx/cert/:/etc/nginx/cert/:ro
+     - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro
+     - /data/nginx/log/:/var/log/nginx/
+
+# Spiderfoot service
+  spiderfoot:
+    container_name: spiderfoot
+    restart: always
+    networks:
+     - spiderfoot_local
+    ports:
+     - "127.0.0.1:64303:8080"
+    image: "dtagdevsec/spiderfoot:2204"
+    volumes:
+     - /data/spiderfoot:/home/spiderfoot/.spiderfoot
--- a/_deprecated/etc/compose/nextgen.yml
+++ b/_deprecated/etc/compose/nextgen.yml
@ -0,0 +1,575 @@
+# T-Pot (NextGen)
+# Do not erase ports sections, these are used by /opt/tpot/bin/rules.sh to setup iptables ACCEPT rules for NFQ (honeytrap / glutton)
+version: '2.3'
+
+networks:
+  adbhoney_local:
+  ciscoasa_local:
+  citrixhoneypot_local:
+  conpot_local_IEC104:
+  conpot_local_guardian_ast:
+  conpot_local_ipmi:
+  conpot_local_kamstrup_382:
+  ddospot_local:
+  dicompot_local:
+  dionaea_local:
+  elasticpot_local:
+  endlessh_local:
+  hellpot_local:
+  heralding_local:
+  ipphoney_local:
+  mailoney_local:
+  medpot_local:
+  redishoneypot_local:
+  ewsposter_local:
+  spiderfoot_local:
+
+services:
+
+##################
+#### Honeypots
+##################
+
+# Adbhoney service
+  adbhoney:
+    container_name: adbhoney
+    restart: always
+    networks:
+     - adbhoney_local
+    ports:
+     - "5555:5555"
+    image: "dtagdevsec/adbhoney:2204"
+    read_only: true
+    volumes:
+     - /data/adbhoney/log:/opt/adbhoney/log
+     - /data/adbhoney/downloads:/opt/adbhoney/dl
+
+# Ciscoasa service
+  ciscoasa:
+    container_name: ciscoasa
+    restart: always
+    tmpfs:
+     - /tmp/ciscoasa:uid=2000,gid=2000
+    networks:
+     - ciscoasa_local
+    ports:
+     - "5000:5000/udp"
+     - "8443:8443"
+    image: "dtagdevsec/ciscoasa:2204"
+    read_only: true
+    volumes:
+     - /data/ciscoasa/log:/var/log/ciscoasa
+
+# CitrixHoneypot service
+  citrixhoneypot:
+    container_name: citrixhoneypot
+    restart: always
+    networks:
+     - citrixhoneypot_local
+    ports:
+     - "443:443"
+    image: "dtagdevsec/citrixhoneypot:2204"
+    read_only: true
+    volumes:
+     - /data/citrixhoneypot/logs:/opt/citrixhoneypot/logs       
+
+# Conpot IEC104 service
+  conpot_IEC104:
+    container_name: conpot_iec104
+    restart: always
+    environment:
+     - CONPOT_CONFIG=/etc/conpot/conpot.cfg
+     - CONPOT_JSON_LOG=/var/log/conpot/conpot_IEC104.json
+     - CONPOT_LOG=/var/log/conpot/conpot_IEC104.log
+     - CONPOT_TEMPLATE=IEC104
+     - CONPOT_TMP=/tmp/conpot
+    tmpfs:
+     - /tmp/conpot:uid=2000,gid=2000
+    networks:
+     - conpot_local_IEC104
+    ports:
+     - "161:161/udp"
+     - "2404:2404"
+    image: "dtagdevsec/conpot:2204"
+    read_only: true
+    volumes:
+     - /data/conpot/log:/var/log/conpot
+
+# Conpot guardian_ast service
+  conpot_guardian_ast:
+    container_name: conpot_guardian_ast
+    restart: always
+    environment:
+     - CONPOT_CONFIG=/etc/conpot/conpot.cfg
+     - CONPOT_JSON_LOG=/var/log/conpot/conpot_guardian_ast.json
+     - CONPOT_LOG=/var/log/conpot/conpot_guardian_ast.log
+     - CONPOT_TEMPLATE=guardian_ast
+     - CONPOT_TMP=/tmp/conpot
+    tmpfs:
+     - /tmp/conpot:uid=2000,gid=2000
+    networks:
+     - conpot_local_guardian_ast
+    ports:
+     - "10001:10001"
+    image: "dtagdevsec/conpot:2204"
+    read_only: true
+    volumes:
+     - /data/conpot/log:/var/log/conpot
+
+# Conpot ipmi
+  conpot_ipmi:
+    container_name: conpot_ipmi
+    restart: always
+    environment:
+     - CONPOT_CONFIG=/etc/conpot/conpot.cfg
+     - CONPOT_JSON_LOG=/var/log/conpot/conpot_ipmi.json
+     - CONPOT_LOG=/var/log/conpot/conpot_ipmi.log
+     - CONPOT_TEMPLATE=ipmi
+     - CONPOT_TMP=/tmp/conpot
+    tmpfs:
+     - /tmp/conpot:uid=2000,gid=2000
+    networks:
+     - conpot_local_ipmi
+    ports:
+     - "623:623/udp"
+    image: "dtagdevsec/conpot:2204"
+    read_only: true
+    volumes:
+     - /data/conpot/log:/var/log/conpot
+
+# Conpot kamstrup_382
+  conpot_kamstrup_382:
+    container_name: conpot_kamstrup_382
+    restart: always
+    environment:
+     - CONPOT_CONFIG=/etc/conpot/conpot.cfg
+     - CONPOT_JSON_LOG=/var/log/conpot/conpot_kamstrup_382.json
+     - CONPOT_LOG=/var/log/conpot/conpot_kamstrup_382.log
+     - CONPOT_TEMPLATE=kamstrup_382
+     - CONPOT_TMP=/tmp/conpot
+    tmpfs:
+     - /tmp/conpot:uid=2000,gid=2000
+    networks:
+     - conpot_local_kamstrup_382
+    ports:
+     - "1025:1025"
+     - "50100:50100"
+    image: "dtagdevsec/conpot:2204"
+    read_only: true
+    volumes:
+     - /data/conpot/log:/var/log/conpot
+
+# Ddospot service
+  ddospot:
+    container_name: ddospot
+    restart: always
+    networks:
+     - ddospot_local
+    ports:
+     - "19:19/udp"
+     - "53:53/udp"
+     - "123:123/udp"
+#     - "161:161/udp"
+     - "1900:1900/udp"
+    image: "dtagdevsec/ddospot:2204"
+    read_only: true
+    volumes:
+     - /data/ddospot/log:/opt/ddospot/ddospot/logs
+     - /data/ddospot/bl:/opt/ddospot/ddospot/bl
+     - /data/ddospot/db:/opt/ddospot/ddospot/db
+
+# Dicompot service
+# Get the Horos Client for testing: https://horosproject.org/
+# Get Dicom images (CC BY 3.0): https://www.cancerimagingarchive.net/collections/ 
+# Put images (which must be in Dicom DCM format or it will not work!) into /data/dicompot/images
+  dicompot:
+    container_name: dicompot
+    restart: always
+    networks:
+     - dicompot_local
+    ports:
+     - "11112:11112"
+    image: "dtagdevsec/dicompot:2204"
+    read_only: true
+    volumes:
+     - /data/dicompot/log:/var/log/dicompot
+#     - /data/dicompot/images:/opt/dicompot/images
+
+# Dionaea service
+  dionaea:
+    container_name: dionaea
+    stdin_open: true
+    tty: true
+    restart: always
+    networks:
+     - dionaea_local
+    ports:
+     - "20:20"
+     - "21:21"
+     - "42:42"
+     - "69:69/udp"
+     - "81:81"
+     - "135:135"
+     # - "443:443"
+     - "445:445"
+     - "1433:1433"
+     - "1723:1723"
+     - "1883:1883"
+     - "3306:3306"
+     # - "5060:5060"
+     # - "5060:5060/udp"
+     # - "5061:5061"
+     - "27017:27017"
+    image: "dtagdevsec/dionaea:2204"
+    read_only: true
+    volumes:
+     - /data/dionaea/roots/ftp:/opt/dionaea/var/dionaea/roots/ftp
+     - /data/dionaea/roots/tftp:/opt/dionaea/var/dionaea/roots/tftp
+     - /data/dionaea/roots/www:/opt/dionaea/var/dionaea/roots/www
+     - /data/dionaea/roots/upnp:/opt/dionaea/var/dionaea/roots/upnp
+     - /data/dionaea:/opt/dionaea/var/dionaea
+     - /data/dionaea/binaries:/opt/dionaea/var/dionaea/binaries
+     - /data/dionaea/log:/opt/dionaea/var/log
+     - /data/dionaea/rtp:/opt/dionaea/var/dionaea/rtp
+
+# ElasticPot service
+  elasticpot:
+    container_name: elasticpot
+    restart: always
+    networks:
+     - elasticpot_local
+    ports:
+     - "9200:9200"
+    image: "dtagdevsec/elasticpot:2204"
+    read_only: true
+    volumes:
+     - /data/elasticpot/log:/opt/elasticpot/log
+
+# Endlessh service
+  endlessh:
+    container_name: endlessh
+    restart: always
+    networks:
+     - endlessh_local
+    ports:
+     - "22:2222"
+    image: "dtagdevsec/endlessh:2204"
+    read_only: true
+    volumes:
+     - /data/endlessh/log:/var/log/endlessh
+
+# Glutton service
+  glutton:
+    container_name: glutton
+    restart: always
+    tmpfs:
+     - /var/lib/glutton:uid=2000,gid=2000
+     - /run:uid=2000,gid=2000
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+    image: "dtagdevsec/glutton:2204"
+    read_only: true
+    volumes:
+     - /data/glutton/log:/var/log/glutton
+#     - /root/tpotce/docker/glutton/dist/rules.yaml:/opt/glutton/rules/rules.yaml
+
+# Heralding service
+  heralding:
+    container_name: heralding
+    restart: always
+    tmpfs:
+     - /tmp/heralding:uid=2000,gid=2000
+    networks:
+     - heralding_local
+    ports:
+    # - "21:21"
+    # - "22:22"
+    # - "23:23"
+    # - "25:25"
+    # - "80:80"
+     - "110:110"
+     - "143:143"
+    # - "443:443"
+     - "465:465"
+     - "993:993"
+     - "995:995"
+    # - "3306:3306"
+    # - "3389:3389"
+     - "1080:1080"
+     - "5432:5432"
+     - "5900:5900"
+    image: "dtagdevsec/heralding:2204"
+    read_only: true
+    volumes:
+     - /data/heralding/log:/var/log/heralding
+
+# Ipphoney service
+  ipphoney:
+    container_name: ipphoney
+    restart: always
+    networks:
+     - ipphoney_local
+    ports:
+     - "631:631"
+    image: "dtagdevsec/ipphoney:2204"
+    read_only: true
+    volumes:
+     - /data/ipphoney/log:/opt/ipphoney/log
+
+# Mailoney service
+  mailoney:
+    container_name: mailoney
+    restart: always
+    environment:
+     - HPFEEDS_SERVER=
+     - HPFEEDS_IDENT=user
+     - HPFEEDS_SECRET=pass
+     - HPFEEDS_PORT=20000
+     - HPFEEDS_CHANNELPREFIX=prefix
+    networks:
+     - mailoney_local
+    ports:
+     - "25:25"
+    image: "dtagdevsec/mailoney:2204"
+    read_only: true
+    volumes:
+     - /data/mailoney/log:/opt/mailoney/logs
+
+# Medpot service
+  medpot:
+    container_name: medpot
+    restart: always
+    networks:
+     - medpot_local
+    ports:
+     - "2575:2575"
+    image: "dtagdevsec/medpot:2204"
+    read_only: true
+    volumes:
+     - /data/medpot/log/:/var/log/medpot
+
+# Redishoneypot service
+  redishoneypot:
+    container_name: redishoneypot
+    restart: always
+    networks:
+     - redishoneypot_local
+    ports:
+     - "6379:6379"
+    image: "dtagdevsec/redishoneypot:2204"
+    read_only: true
+    volumes:
+     - /data/redishoneypot/log:/var/log/redishoneypot
+
+# Hellpot service
+  hellpot:
+    container_name: hellpot
+    restart: always
+    networks:
+     - hellpot_local
+    ports:
+     - "80:8080"
+    image: "dtagdevsec/hellpot:2204"
+    read_only: true
+    volumes:
+     - /data/hellpot/log:/var/log/hellpot
+
+##################
+#### NSM
+##################
+
+# Fatt service
+  fatt:
+    container_name: fatt
+    restart: always
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+     - SYS_NICE
+     - NET_RAW
+    image: "dtagdevsec/fatt:2204"
+    volumes:
+     - /data/fatt/log:/opt/fatt/log
+
+# P0f service
+  p0f:
+    container_name: p0f
+    restart: always
+    network_mode: "host"
+    image: "dtagdevsec/p0f:2204"
+    read_only: true
+    volumes:
+     - /data/p0f/log:/var/log/p0f
+
+# Suricata service
+  suricata:
+    container_name: suricata
+    restart: always
+    environment:
+    # For ET Pro ruleset replace "OPEN" with your OINKCODE
+     - OINKCODE=OPEN
+    # Loading externel Rules from URL 
+    # - FROMURL="https://username:password@yoururl.com|https://username:password@otherurl.com"
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+     - SYS_NICE
+     - NET_RAW
+    image: "dtagdevsec/suricata:2204"
+    volumes:
+     - /data/suricata/log:/var/log/suricata
+
+
+##################
+#### Tools
+##################
+
+#### ELK
+## Elasticsearch service
+  elasticsearch:
+    container_name: elasticsearch
+    restart: always
+    environment:
+     - bootstrap.memory_lock=true
+     - ES_JAVA_OPTS=-Xms2048m -Xmx2048m
+     - ES_TMPDIR=/tmp
+    cap_add:
+     - IPC_LOCK
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+      nofile:
+        soft: 65536
+        hard: 65536
+    mem_limit: 4g
+    ports:
+     - "127.0.0.1:64298:9200"
+    image: "dtagdevsec/elasticsearch:2204"
+    volumes:
+     - /data:/data
+
+## Kibana service
+  kibana:
+    container_name: kibana
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    mem_limit: 1g
+    ports:
+     - "127.0.0.1:64296:5601"
+    image: "dtagdevsec/kibana:2204"
+
+## Logstash service
+  logstash:
+    container_name: logstash
+    restart: always
+    environment:
+     - LS_JAVA_OPTS=-Xms1024m -Xmx1024m
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    mem_limit: 2g
+    image: "dtagdevsec/logstash:2204"
+    volumes:
+     - /data:/data
+
+## Map Redis Service
+  map_redis:
+    container_name: map_redis
+    restart: always
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/redis:2204"
+    read_only: true
+
+## Map Web Service
+  map_web:
+    container_name: map_web
+    restart: always
+    environment:
+     - MAP_COMMAND=AttackMapServer.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    ports:
+     - "127.0.0.1:64299:64299"
+    image: "dtagdevsec/map:2204"
+
+## Map Data Service
+  map_data:
+    container_name: map_data
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    environment:
+     - MAP_COMMAND=DataServer_v2.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/map:2204"
+#### /ELK
+
+# Ewsposter service
+  ewsposter:
+    container_name: ewsposter
+    restart: always
+    networks:
+     - ewsposter_local
+    environment:
+     - EWS_HPFEEDS_ENABLE=false
+     - EWS_HPFEEDS_HOST=host
+     - EWS_HPFEEDS_PORT=port
+     - EWS_HPFEEDS_CHANNELS=channels
+     - EWS_HPFEEDS_IDENT=user
+     - EWS_HPFEEDS_SECRET=secret
+     - EWS_HPFEEDS_TLSCERT=false
+     - EWS_HPFEEDS_FORMAT=json
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    image: "dtagdevsec/ewsposter:2204"
+    volumes:
+     - /data:/data
+     - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip
+
+# Nginx service
+  nginx:
+    container_name: nginx
+    restart: always
+    tmpfs:
+     - /var/tmp/nginx/client_body
+     - /var/tmp/nginx/proxy
+     - /var/tmp/nginx/fastcgi
+     - /var/tmp/nginx/uwsgi
+     - /var/tmp/nginx/scgi
+     - /run
+     - /var/lib/nginx/tmp:uid=100,gid=82
+    network_mode: "host"
+      #    ports:
+      #     - "64297:64297"
+      #     - "127.0.0.1:64304:64304"
+    image: "dtagdevsec/nginx:2204"
+    read_only: true
+    volumes:
+     - /data/nginx/cert/:/etc/nginx/cert/:ro
+     - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro
+     - /data/nginx/log/:/var/log/nginx/
+
+# Spiderfoot service
+  spiderfoot:
+    container_name: spiderfoot
+    restart: always
+    networks:
+     - spiderfoot_local
+    ports:
+     - "127.0.0.1:64303:8080"
+    image: "dtagdevsec/spiderfoot:2204"
+    volumes:
+     - /data/spiderfoot:/home/spiderfoot/.spiderfoot
--- a/_deprecated/etc/compose/sensor.yml
+++ b/_deprecated/etc/compose/sensor.yml
@ -374,10 +374,17 @@ services:
  sentrypeer:
    container_name: sentrypeer
    restart: always
+# SentryPeer offers to exchange bad actor data via DHT / P2P mode by setting the ENV to true (1)
+# In some cases (i.e. internally deployed T-Pots) this might be confusing as SentryPeer will show
+# the bad actors in its logs. Therefore this option is opt-in based.
+#    environment:
+#     - SENTRYPEER_PEER_TO_PEER=0
    networks:
     - sentrypeer_local
    ports:
+#     - "4222:4222/udp"
     - "5060:5060/udp"
+#     - "127.0.0.1:8082:8082"
    image: "dtagdevsec/sentrypeer:2204"
    read_only: true
    volumes:
--- a/_deprecated/etc/compose/standard.yml
+++ b/_deprecated/etc/compose/standard.yml
@ -0,0 +1,662 @@
+# T-Pot (Standard)
+# Do not erase ports sections, these are used by /opt/tpot/bin/rules.sh to setup iptables ACCEPT rules for NFQ (honeytrap / glutton)
+version: '2.3'
+
+networks:
+  adbhoney_local:
+  ciscoasa_local:
+  citrixhoneypot_local:
+  conpot_local_IEC104:
+  conpot_local_guardian_ast:
+  conpot_local_ipmi:
+  conpot_local_kamstrup_382:
+  cowrie_local:
+  ddospot_local:
+  dicompot_local:
+  dionaea_local:
+  elasticpot_local:
+  heralding_local:
+  ipphoney_local:
+  mailoney_local:
+  medpot_local:
+  redishoneypot_local:
+  tanner_local:
+  ewsposter_local:
+  sentrypeer_local:
+  spiderfoot_local:
+
+services:
+
+##################
+#### Honeypots
+##################
+
+# Adbhoney service
+  adbhoney:
+    container_name: adbhoney
+    restart: always
+    networks:
+     - adbhoney_local
+    ports:
+     - "5555:5555"
+    image: "dtagdevsec/adbhoney:2204"
+    read_only: true
+    volumes:
+     - /data/adbhoney/log:/opt/adbhoney/log
+     - /data/adbhoney/downloads:/opt/adbhoney/dl
+
+# Ciscoasa service
+  ciscoasa:
+    container_name: ciscoasa
+    restart: always
+    tmpfs:
+     - /tmp/ciscoasa:uid=2000,gid=2000
+    networks:
+     - ciscoasa_local
+    ports:
+     - "5000:5000/udp"
+     - "8443:8443"
+    image: "dtagdevsec/ciscoasa:2204"
+    read_only: true
+    volumes:
+     - /data/ciscoasa/log:/var/log/ciscoasa
+
+# CitrixHoneypot service
+  citrixhoneypot:
+    container_name: citrixhoneypot
+    restart: always
+    networks:
+     - citrixhoneypot_local
+    ports:
+     - "443:443"
+    image: "dtagdevsec/citrixhoneypot:2204"
+    read_only: true
+    volumes:
+     - /data/citrixhoneypot/logs:/opt/citrixhoneypot/logs
+
+# Conpot IEC104 service
+  conpot_IEC104:
+    container_name: conpot_iec104
+    restart: always
+    environment:
+     - CONPOT_CONFIG=/etc/conpot/conpot.cfg
+     - CONPOT_JSON_LOG=/var/log/conpot/conpot_IEC104.json
+     - CONPOT_LOG=/var/log/conpot/conpot_IEC104.log
+     - CONPOT_TEMPLATE=IEC104
+     - CONPOT_TMP=/tmp/conpot
+    tmpfs:
+     - /tmp/conpot:uid=2000,gid=2000
+    networks:
+     - conpot_local_IEC104
+    ports:
+     - "161:161/udp"
+     - "2404:2404"
+    image: "dtagdevsec/conpot:2204"
+    read_only: true
+    volumes:
+     - /data/conpot/log:/var/log/conpot
+
+# Conpot guardian_ast service
+  conpot_guardian_ast:
+    container_name: conpot_guardian_ast
+    restart: always
+    environment:
+     - CONPOT_CONFIG=/etc/conpot/conpot.cfg
+     - CONPOT_JSON_LOG=/var/log/conpot/conpot_guardian_ast.json
+     - CONPOT_LOG=/var/log/conpot/conpot_guardian_ast.log
+     - CONPOT_TEMPLATE=guardian_ast
+     - CONPOT_TMP=/tmp/conpot
+    tmpfs:
+     - /tmp/conpot:uid=2000,gid=2000
+    networks:
+     - conpot_local_guardian_ast
+    ports:
+     - "10001:10001"
+    image: "dtagdevsec/conpot:2204"
+    read_only: true
+    volumes:
+     - /data/conpot/log:/var/log/conpot
+
+# Conpot ipmi
+  conpot_ipmi:
+    container_name: conpot_ipmi
+    restart: always
+    environment:
+     - CONPOT_CONFIG=/etc/conpot/conpot.cfg
+     - CONPOT_JSON_LOG=/var/log/conpot/conpot_ipmi.json
+     - CONPOT_LOG=/var/log/conpot/conpot_ipmi.log
+     - CONPOT_TEMPLATE=ipmi
+     - CONPOT_TMP=/tmp/conpot
+    tmpfs:
+     - /tmp/conpot:uid=2000,gid=2000
+    networks:
+     - conpot_local_ipmi
+    ports:
+     - "623:623/udp"
+    image: "dtagdevsec/conpot:2204"
+    read_only: true
+    volumes:
+     - /data/conpot/log:/var/log/conpot
+
+# Conpot kamstrup_382
+  conpot_kamstrup_382:
+    container_name: conpot_kamstrup_382
+    restart: always
+    environment:
+     - CONPOT_CONFIG=/etc/conpot/conpot.cfg
+     - CONPOT_JSON_LOG=/var/log/conpot/conpot_kamstrup_382.json
+     - CONPOT_LOG=/var/log/conpot/conpot_kamstrup_382.log
+     - CONPOT_TEMPLATE=kamstrup_382
+     - CONPOT_TMP=/tmp/conpot
+    tmpfs:
+     - /tmp/conpot:uid=2000,gid=2000
+    networks:
+     - conpot_local_kamstrup_382
+    ports:
+     - "1025:1025"
+     - "50100:50100"
+    image: "dtagdevsec/conpot:2204"
+    read_only: true
+    volumes:
+     - /data/conpot/log:/var/log/conpot
+
+# Cowrie service
+  cowrie:
+    container_name: cowrie
+    restart: always
+    tmpfs:
+     - /tmp/cowrie:uid=2000,gid=2000
+     - /tmp/cowrie/data:uid=2000,gid=2000
+    networks:
+     - cowrie_local
+    ports:
+     - "22:22"
+     - "23:23"
+    image: "dtagdevsec/cowrie:2204"
+    read_only: true
+    volumes:
+     - /data/cowrie/downloads:/home/cowrie/cowrie/dl
+     - /data/cowrie/keys:/home/cowrie/cowrie/etc
+     - /data/cowrie/log:/home/cowrie/cowrie/log
+     - /data/cowrie/log/tty:/home/cowrie/cowrie/log/tty
+
+# Ddospot service
+  ddospot:
+    container_name: ddospot
+    restart: always
+    networks:
+     - ddospot_local
+    ports:
+     - "19:19/udp"
+     - "53:53/udp"
+     - "123:123/udp"
+#     - "161:161/udp"
+     - "1900:1900/udp"
+    image: "dtagdevsec/ddospot:2204"
+    read_only: true
+    volumes:
+     - /data/ddospot/log:/opt/ddospot/ddospot/logs
+     - /data/ddospot/bl:/opt/ddospot/ddospot/bl
+     - /data/ddospot/db:/opt/ddospot/ddospot/db
+
+# Dicompot service
+# Get the Horos Client for testing: https://horosproject.org/
+# Get Dicom images (CC BY 3.0): https://www.cancerimagingarchive.net/collections/
+# Put images (which must be in Dicom DCM format or it will not work!) into /data/dicompot/images
+  dicompot:
+    container_name: dicompot
+    restart: always
+    networks:
+     - dicompot_local
+    ports:
+     - "11112:11112"
+    image: "dtagdevsec/dicompot:2204"
+    read_only: true
+    volumes:
+     - /data/dicompot/log:/var/log/dicompot
+#     - /data/dicompot/images:/opt/dicompot/images
+
+# Dionaea service
+  dionaea:
+    container_name: dionaea
+    stdin_open: true
+    tty: true
+    restart: always
+    networks:
+     - dionaea_local
+    ports:
+     - "20:20"
+     - "21:21"
+     - "42:42"
+     - "69:69/udp"
+     - "81:81"
+     - "135:135"
+     # - "443:443"
+     - "445:445"
+     - "1433:1433"
+     - "1723:1723"
+     - "1883:1883"
+     - "3306:3306"
+     # - "5060:5060"
+     # - "5060:5060/udp"
+     # - "5061:5061"
+     - "27017:27017"
+    image: "dtagdevsec/dionaea:2204"
+    read_only: true
+    volumes:
+     - /data/dionaea/roots/ftp:/opt/dionaea/var/dionaea/roots/ftp
+     - /data/dionaea/roots/tftp:/opt/dionaea/var/dionaea/roots/tftp
+     - /data/dionaea/roots/www:/opt/dionaea/var/dionaea/roots/www
+     - /data/dionaea/roots/upnp:/opt/dionaea/var/dionaea/roots/upnp
+     - /data/dionaea:/opt/dionaea/var/dionaea
+     - /data/dionaea/binaries:/opt/dionaea/var/dionaea/binaries
+     - /data/dionaea/log:/opt/dionaea/var/log
+     - /data/dionaea/rtp:/opt/dionaea/var/dionaea/rtp
+
+# ElasticPot service
+  elasticpot:
+    container_name: elasticpot
+    restart: always
+    networks:
+     - elasticpot_local
+    ports:
+     - "9200:9200"
+    image: "dtagdevsec/elasticpot:2204"
+    read_only: true
+    volumes:
+     - /data/elasticpot/log:/opt/elasticpot/log
+
+# Heralding service
+  heralding:
+    container_name: heralding
+    restart: always
+    tmpfs:
+     - /tmp/heralding:uid=2000,gid=2000
+    networks:
+     - heralding_local
+    ports:
+    # - "21:21"
+    # - "22:22"
+    # - "23:23"
+    # - "25:25"
+    # - "80:80"
+     - "110:110"
+     - "143:143"
+    # - "443:443"
+     - "465:465"
+     - "993:993"
+     - "995:995"
+    # - "3306:3306"
+    # - "3389:3389"
+     - "1080:1080"
+     - "5432:5432"
+     - "5900:5900"
+    image: "dtagdevsec/heralding:2204"
+    read_only: true
+    volumes:
+     - /data/heralding/log:/var/log/heralding
+
+# Honeytrap service
+  honeytrap:
+    container_name: honeytrap
+    restart: always
+    tmpfs:
+     - /tmp/honeytrap:uid=2000,gid=2000
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+    image: "dtagdevsec/honeytrap:2204"
+    read_only: true
+    volumes:
+     - /data/honeytrap/attacks:/opt/honeytrap/var/attacks
+     - /data/honeytrap/downloads:/opt/honeytrap/var/downloads
+     - /data/honeytrap/log:/opt/honeytrap/var/log
+
+# Ipphoney service
+  ipphoney:
+    container_name: ipphoney
+    restart: always
+    networks:
+     - ipphoney_local
+    ports:
+     - "631:631"
+    image: "dtagdevsec/ipphoney:2204"
+    read_only: true
+    volumes:
+     - /data/ipphoney/log:/opt/ipphoney/log
+
+# Mailoney service
+  mailoney:
+    container_name: mailoney
+    restart: always
+    environment:
+     - HPFEEDS_SERVER=
+     - HPFEEDS_IDENT=user
+     - HPFEEDS_SECRET=pass
+     - HPFEEDS_PORT=20000
+     - HPFEEDS_CHANNELPREFIX=prefix
+    networks:
+     - mailoney_local
+    ports:
+     - "25:25"
+    image: "dtagdevsec/mailoney:2204"
+    read_only: true
+    volumes:
+     - /data/mailoney/log:/opt/mailoney/logs
+
+# Medpot service
+  medpot:
+    container_name: medpot
+    restart: always
+    networks:
+     - medpot_local
+    ports:
+     - "2575:2575"
+    image: "dtagdevsec/medpot:2204"
+    read_only: true
+    volumes:
+     - /data/medpot/log/:/var/log/medpot
+
+# Redishoneypot service
+  redishoneypot:
+    container_name: redishoneypot
+    restart: always
+    networks:
+     - redishoneypot_local
+    ports:
+     - "6379:6379"
+    image: "dtagdevsec/redishoneypot:2204"
+    read_only: true
+    volumes:
+     - /data/redishoneypot/log:/var/log/redishoneypot
+
+# SentryPeer service
+  sentrypeer:
+    container_name: sentrypeer
+    restart: always
+# SentryPeer offers to exchange bad actor data via DHT / P2P mode by setting the ENV to true (1)
+# In some cases (i.e. internally deployed T-Pots) this might be confusing as SentryPeer will show
+# the bad actors in its logs. Therefore this option is opt-in based.
+#    environment:
+#     - SENTRYPEER_PEER_TO_PEER=0
+    networks:
+     - sentrypeer_local
+    ports:
+#     - "4222:4222/udp"
+     - "5060:5060/udp"
+#     - "127.0.0.1:8082:8082"
+    image: "dtagdevsec/sentrypeer:2204"
+    read_only: true
+    volumes:
+     - /data/sentrypeer/log:/var/log/sentrypeer
+
+#### Snare / Tanner
+## Tanner Redis Service
+  tanner_redis:
+    container_name: tanner_redis
+    restart: always
+    tty: true
+    networks:
+     - tanner_local
+    image: "dtagdevsec/redis:2204"
+    read_only: true
+
+## PHP Sandbox service
+  tanner_phpox:
+    container_name: tanner_phpox
+    restart: always
+    tty: true
+    networks:
+     - tanner_local
+    image: "dtagdevsec/phpox:2204"
+    read_only: true
+
+## Tanner API Service
+  tanner_api:
+    container_name: tanner_api
+    restart: always
+    tmpfs:
+     - /tmp/tanner:uid=2000,gid=2000
+    tty: true
+    networks:
+     - tanner_local
+    image: "dtagdevsec/tanner:2204"
+    read_only: true
+    volumes:
+     - /data/tanner/log:/var/log/tanner
+    command: tannerapi
+    depends_on:
+     - tanner_redis
+
+## Tanner Service
+  tanner:
+    container_name: tanner
+    restart: always
+    tmpfs:
+     - /tmp/tanner:uid=2000,gid=2000
+    tty: true
+    networks:
+     - tanner_local
+    image: "dtagdevsec/tanner:2204"
+    command: tanner
+    read_only: true
+    volumes:
+     - /data/tanner/log:/var/log/tanner
+     - /data/tanner/files:/opt/tanner/files
+    depends_on:
+     - tanner_api
+#     - tanner_web
+     - tanner_phpox
+
+## Snare Service
+  snare:
+    container_name: snare
+    restart: always
+    tty: true
+    networks:
+     - tanner_local
+    ports:
+     - "80:80"
+    image: "dtagdevsec/snare:2204"
+    depends_on:
+     - tanner
+
+
+##################
+#### NSM
+##################
+
+# Fatt service
+  fatt:
+    container_name: fatt
+    restart: always
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+     - SYS_NICE
+     - NET_RAW
+    image: "dtagdevsec/fatt:2204"
+    volumes:
+     - /data/fatt/log:/opt/fatt/log
+
+# P0f service
+  p0f:
+    container_name: p0f
+    restart: always
+    network_mode: "host"
+    image: "dtagdevsec/p0f:2204"
+    read_only: true
+    volumes:
+     - /data/p0f/log:/var/log/p0f
+
+# Suricata service
+  suricata:
+    container_name: suricata
+    restart: always
+    environment:
+    # For ET Pro ruleset replace "OPEN" with your OINKCODE
+     - OINKCODE=OPEN
+    # Loading externel Rules from URL 
+    # - FROMURL="https://username:password@yoururl.com|https://username:password@otherurl.com"
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+     - SYS_NICE
+     - NET_RAW
+    image: "dtagdevsec/suricata:2204"
+    volumes:
+     - /data/suricata/log:/var/log/suricata
+
+
+##################
+#### Tools
+##################
+
+#### ELK
+## Elasticsearch service
+  elasticsearch:
+    container_name: elasticsearch
+    restart: always
+    environment:
+     - bootstrap.memory_lock=true
+     - ES_JAVA_OPTS=-Xms2048m -Xmx2048m
+     - ES_TMPDIR=/tmp
+    cap_add:
+     - IPC_LOCK
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+      nofile:
+        soft: 65536
+        hard: 65536
+    mem_limit: 4g
+    ports:
+     - "127.0.0.1:64298:9200"
+    image: "dtagdevsec/elasticsearch:2204"
+    volumes:
+     - /data:/data
+
+## Kibana service
+  kibana:
+    container_name: kibana
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    mem_limit: 1g
+    ports:
+     - "127.0.0.1:64296:5601"
+    image: "dtagdevsec/kibana:2204"
+
+## Logstash service
+  logstash:
+    container_name: logstash
+    restart: always
+    environment:
+     - LS_JAVA_OPTS=-Xms1024m -Xmx1024m
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    mem_limit: 2g
+    image: "dtagdevsec/logstash:2204"
+    volumes:
+     - /data:/data
+
+## Map Redis Service
+  map_redis:
+    container_name: map_redis
+    restart: always
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/redis:2204"
+    read_only: true
+
+## Map Web Service
+  map_web:
+    container_name: map_web
+    restart: always
+    environment:
+     - MAP_COMMAND=AttackMapServer.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    ports:
+     - "127.0.0.1:64299:64299"
+    image: "dtagdevsec/map:2204"
+
+## Map Data Service
+  map_data:
+    container_name: map_data
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    environment:
+     - MAP_COMMAND=DataServer_v2.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/map:2204"
+#### /ELK
+
+# Ewsposter service
+  ewsposter:
+    container_name: ewsposter
+    restart: always
+    networks:
+     - ewsposter_local
+    environment:
+     - EWS_HPFEEDS_ENABLE=false
+     - EWS_HPFEEDS_HOST=host
+     - EWS_HPFEEDS_PORT=port
+     - EWS_HPFEEDS_CHANNELS=channels
+     - EWS_HPFEEDS_IDENT=user
+     - EWS_HPFEEDS_SECRET=secret
+     - EWS_HPFEEDS_TLSCERT=false
+     - EWS_HPFEEDS_FORMAT=json
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    image: "dtagdevsec/ewsposter:2204"
+    volumes:
+     - /data:/data
+     - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip
+
+# Nginx service
+  nginx:
+    container_name: nginx
+    restart: always
+    tmpfs:
+     - /var/tmp/nginx/client_body
+     - /var/tmp/nginx/proxy
+     - /var/tmp/nginx/fastcgi
+     - /var/tmp/nginx/uwsgi
+     - /var/tmp/nginx/scgi
+     - /run
+     - /var/lib/nginx/tmp:uid=100,gid=82
+    network_mode: "host"
+      #    ports:
+      #     - "64297:64297"
+      #     - "127.0.0.1:64304:64304"
+    image: "dtagdevsec/nginx:2204"
+    read_only: true
+    volumes:
+     - /data/nginx/cert/:/etc/nginx/cert/:ro
+     - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro
+     - /data/nginx/log/:/var/log/nginx/
+
+# Spiderfoot service
+  spiderfoot:
+    container_name: spiderfoot
+    restart: always
+    networks:
+     - spiderfoot_local
+    ports:
+     - "127.0.0.1:64303:8080"
+    image: "dtagdevsec/spiderfoot:2204"
+    volumes:
+     - /data/spiderfoot:/home/spiderfoot/.spiderfoot
--- a/_deprecated/etc/compose/tarpit.yml
+++ b/_deprecated/etc/compose/tarpit.yml
@ -0,0 +1,287 @@
+# T-Pot (Tarpit)
+# Do not erase ports sections, these are used by /opt/tpot/bin/rules.sh to setup iptables ACCEPT rules for NFQ (honeytrap / glutton)
+version: '2.3'
+
+networks:
+  endlessh_local:
+  hellpot_local:
+  heralding_local:
+  ewsposter_local:
+  spiderfoot_local:
+
+services:
+
+##################
+#### Honeypots
+##################
+
+# Endlessh service
+  endlessh:
+    container_name: endlessh
+    restart: always
+    networks:
+     - endlessh_local
+    ports:
+     - "22:2222"
+    image: "dtagdevsec/endlessh:2204"
+    read_only: true
+    volumes:
+     - /data/endlessh/log:/var/log/endlessh
+
+# Heralding service
+  heralding:
+    container_name: heralding
+    restart: always
+    tmpfs:
+     - /tmp/heralding:uid=2000,gid=2000
+    networks:
+     - heralding_local
+    ports:
+    # - "21:21"
+    # - "22:22"
+    # - "23:23"
+    # - "25:25"
+    # - "80:80"
+     - "110:110"
+     - "143:143"
+    # - "443:443"
+     - "465:465"
+     - "993:993"
+     - "995:995"
+    # - "3306:3306"
+    # - "3389:3389"
+     - "1080:1080"
+     - "5432:5432"
+     - "5900:5900"
+    image: "dtagdevsec/heralding:2204"
+    read_only: true
+    volumes:
+     - /data/heralding/log:/var/log/heralding
+
+# Honeytrap service
+  honeytrap:
+    container_name: honeytrap
+    restart: always
+    tmpfs:
+     - /tmp/honeytrap:uid=2000,gid=2000
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+    image: "dtagdevsec/honeytrap:2204"
+    read_only: true
+    volumes:
+     - /data/honeytrap/attacks:/opt/honeytrap/var/attacks
+     - /data/honeytrap/downloads:/opt/honeytrap/var/downloads
+     - /data/honeytrap/log:/opt/honeytrap/var/log
+
+# Hellpot service
+  hellpot:
+    container_name: hellpot
+    restart: always
+    networks:
+     - hellpot_local
+    ports:
+     - "80:8080"
+    image: "dtagdevsec/hellpot:2204"
+    read_only: true
+    volumes:
+     - /data/hellpot/log:/var/log/hellpot
+
+##################
+#### NSM
+##################
+
+# Fatt service
+  fatt:
+    container_name: fatt
+    restart: always
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+     - SYS_NICE
+     - NET_RAW
+    image: "dtagdevsec/fatt:2204"
+    volumes:
+     - /data/fatt/log:/opt/fatt/log
+
+# P0f service
+  p0f:
+    container_name: p0f
+    restart: always
+    network_mode: "host"
+    image: "dtagdevsec/p0f:2204"
+    read_only: true
+    volumes:
+     - /data/p0f/log:/var/log/p0f
+
+# Suricata service
+  suricata:
+    container_name: suricata
+    restart: always
+    environment:
+    # For ET Pro ruleset replace "OPEN" with your OINKCODE
+     - OINKCODE=OPEN
+    # Loading externel Rules from URL 
+    # - FROMURL="https://username:password@yoururl.com|https://username:password@otherurl.com"
+    network_mode: "host"
+    cap_add:
+     - NET_ADMIN
+     - SYS_NICE
+     - NET_RAW
+    image: "dtagdevsec/suricata:2204"
+    volumes:
+     - /data/suricata/log:/var/log/suricata
+
+
+##################
+#### Tools
+##################
+
+#### ELK
+## Elasticsearch service
+  elasticsearch:
+    container_name: elasticsearch
+    restart: always
+    environment:
+     - bootstrap.memory_lock=true
+     - ES_JAVA_OPTS=-Xms2048m -Xmx2048m
+     - ES_TMPDIR=/tmp
+    cap_add:
+     - IPC_LOCK
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+      nofile:
+        soft: 65536
+        hard: 65536
+    mem_limit: 4g
+    ports:
+     - "127.0.0.1:64298:9200"
+    image: "dtagdevsec/elasticsearch:2204"
+    volumes:
+     - /data:/data
+
+## Kibana service
+  kibana:
+    container_name: kibana
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    mem_limit: 1g
+    ports:
+     - "127.0.0.1:64296:5601"
+    image: "dtagdevsec/kibana:2204"
+
+## Logstash service
+  logstash:
+    container_name: logstash
+    restart: always
+    environment:
+     - LS_JAVA_OPTS=-Xms1024m -Xmx1024m
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    mem_limit: 2g
+    image: "dtagdevsec/logstash:2204"
+    volumes:
+     - /data:/data
+
+## Map Redis Service
+  map_redis:
+    container_name: map_redis
+    restart: always
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/redis:2204"
+    read_only: true
+
+## Map Web Service
+  map_web:
+    container_name: map_web
+    restart: always
+    environment:
+     - MAP_COMMAND=AttackMapServer.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    ports:
+     - "127.0.0.1:64299:64299"
+    image: "dtagdevsec/map:2204"
+
+## Map Data Service
+  map_data:
+    container_name: map_data
+    restart: always
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    environment:
+     - MAP_COMMAND=DataServer_v2.py
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    stop_signal: SIGKILL
+    tty: true
+    image: "dtagdevsec/map:2204"
+#### /ELK
+
+# Ewsposter service
+  ewsposter:
+    container_name: ewsposter
+    restart: always
+    networks:
+     - ewsposter_local
+    environment:
+     - EWS_HPFEEDS_ENABLE=false
+     - EWS_HPFEEDS_HOST=host
+     - EWS_HPFEEDS_PORT=port
+     - EWS_HPFEEDS_CHANNELS=channels
+     - EWS_HPFEEDS_IDENT=user
+     - EWS_HPFEEDS_SECRET=secret
+     - EWS_HPFEEDS_TLSCERT=false
+     - EWS_HPFEEDS_FORMAT=json
+    env_file:
+     - /opt/tpot/etc/compose/elk_environment
+    image: "dtagdevsec/ewsposter:2204"
+    volumes:
+     - /data:/data
+     - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip
+
+# Nginx service
+  nginx:
+    container_name: nginx
+    restart: always
+    tmpfs:
+     - /var/tmp/nginx/client_body
+     - /var/tmp/nginx/proxy
+     - /var/tmp/nginx/fastcgi
+     - /var/tmp/nginx/uwsgi
+     - /var/tmp/nginx/scgi
+     - /run
+     - /var/lib/nginx/tmp:uid=100,gid=82
+    network_mode: "host"
+      #    ports:
+      #     - "64297:64297"
+      #     - "127.0.0.1:64304:64304"
+    image: "dtagdevsec/nginx:2204"
+    read_only: true
+    volumes:
+     - /data/nginx/cert/:/etc/nginx/cert/:ro
+     - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro
+     - /data/nginx/log/:/var/log/nginx/
+
+# Spiderfoot service
+  spiderfoot:
+    container_name: spiderfoot
+    restart: always
+    networks:
+     - spiderfoot_local
+    ports:
+     - "127.0.0.1:64303:8080"
+    image: "dtagdevsec/spiderfoot:2204"
+    volumes:
+     - /data/spiderfoot:/home/spiderfoot/.spiderfoot
--- a/_deprecated/etc/logrotate/logrotate.conf
+++ b/_deprecated/etc/logrotate/logrotate.conf
--- a/_deprecated/etc/objects/elkbase.tgz
+++ b/_deprecated/etc/objects/elkbase.tgz
--- a/_deprecated/etc/objects/kibana_export.ndjson.zip
+++ b/_deprecated/etc/objects/kibana_export.ndjson.zip
--- a/_deprecated/host/etc/rc.local
+++ b/_deprecated/host/etc/rc.local
--- a/_deprecated/host/etc/systemd/tpot.service
+++ b/_deprecated/host/etc/systemd/tpot.service
--- a/_deprecated/host/usr/share/dict/a.txt
+++ b/_deprecated/host/usr/share/dict/a.txt
--- a/_deprecated/host/usr/share/dict/n.txt
+++ b/_deprecated/host/usr/share/dict/n.txt
--- a/_deprecated/host/usr/share/dict/names
+++ b/_deprecated/host/usr/share/dict/names
--- a/_deprecated/install.sh
+++ b/_deprecated/install.sh
@ -0,0 +1,3 @@
+#!/bin/bash
+cd iso/installer
+./install.sh "$@"
--- a/_deprecated/installer/debian/install.sh
+++ b/_deprecated/installer/debian/install.sh
@ -0,0 +1,77 @@
+#!/bin/bash
+
+# Needs to run as non-root
+myWHOAMI=$(whoami)
+if [ "$myWHOAMI" == "root" ]
+  then
+    echo "Need to run as user ..."
+    exit
+fi
+
+# Check if running on Debian
+if ! grep -q 'ID=debian' /etc/os-release; then
+  echo "This script is designed to run on Debian. Aborting."
+  exit 1
+fi
+
+if [ -f /var/log/debian-install-lock ]; then
+  echo "Error: The installer has already been run on this system. If you wish to run it again, please run the uninstall.sh first."
+  exit 1
+fi
+
+# Create installer lock file
+sudo touch /var/log/debian-install-lock
+
+# Update SSH config
+echo "Updating SSH config..."
+sudo bash -c 'echo "Port 64295" >> /etc/ssh/sshd_config'
+
+# Install recommended packages
+echo "Installing recommended packages..."
+sudo apt-get -y update
+sudo apt-get -y install bash-completion git grc neovim net-tools
+
+# Remove old Docker
+echo "Removing old docker packages..."
+sudo apt-get -y remove docker docker-engine docker.io containerd runc
+
+# Add Docker to repositories, install latest docker
+echo "Adding Docker to repositories and installing..."
+sudo apt-get -y update
+sudo apt-get -y install ca-certificates curl gnupg
+sudo install -m 0755 -d /etc/apt/keyrings
+curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+sudo chmod a+r /etc/apt/keyrings/docker.gpg
+echo \
+  "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \
+  "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \
+  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+sudo apt-get -y update
+sudo apt-get -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+sudo systemctl enable docker
+sudo systemctl stop docker
+sudo systemctl start docker
+
+# Add T-Pot user and group to avoid any permission denied on the data folder while keeping permissions 770
+echo "Creating T-Pot group and user ..."
+addgroup --gid 2000 tpot
+adduser --system --no-create-home --uid 2000 --disabled-password --disabled-login --gid 2000 tpot
+# Add user to Docker, T-Pot group
+echo "Adding $(whoami) to Docker group..."
+sudo usermod -aG docker $(whoami)
+echo "Adding $(whoami) to T-Pot group..."
+sudo usermod -aG tpot $(whoami)
+
+# Add aliases
+echo "Adding aliases..."
+echo "alias dps='grc docker ps -a'" >> ~/.bashrc
+echo "alias dpsw='watch -c \"grc --colour=on docker ps -a\"'" >> ~/.bashrc
+
+# Show running services
+sudo grc netstat -tulpen
+echo "Please review for possible honeypot port conflicts."
+echo "While SSH is taken care of, other services such as"
+echo "SMTP, HTTP, etc. might prevent T-Pot from starting."
+
+echo "Done. Please reboot and re-connect via SSH on tcp/64295."
+
--- a/_deprecated/installer/debian/sudo-install.sh
+++ b/_deprecated/installer/debian/sudo-install.sh
@ -0,0 +1,10 @@
+#!/bin/bash
+
+if ! command -v sudo &> /dev/null
+then
+    echo "sudo is not installed. Installing now..."
+    su -c "apt-get -y update && apt-get -y install sudo"
+    su -c "/usr/sbin/usermod -aG sudo $(whoami)"
+else
+    echo "sudo is already installed."
+fi
--- a/_deprecated/installer/debian/uninstall.sh
+++ b/_deprecated/installer/debian/uninstall.sh
@ -0,0 +1,59 @@
+#!/bin/bash
+
+# Needs to run as non-root
+myWHOAMI=$(whoami)
+if [ "$myWHOAMI" == "root" ]
+  then
+    echo "Need to run as user ..."
+    exit
+fi
+
+# Check if running on Debian
+if ! grep -q 'ID=debian' /etc/os-release; then
+  echo "This script is designed to run on Debian. Aborting."
+  exit 1
+fi
+
+# Check if installer lock file exists
+if [ ! -f /var/log/debian-install-lock ]; then
+  echo "Error: The installer has not been run on this system. Aborting."
+  exit 1
+fi
+
+# Remove SSH config changes
+echo "Removing SSH config changes..."
+sudo sed -i '/Port 64295/d' /etc/ssh/sshd_config
+
+# Uninstall Docker
+echo "Stopping and removing all containers ..."
+docker stop $(docker ps -aq)
+docker rm $(docker ps -aq)
+echo "Uninstalling Docker..."
+sudo systemctl stop docker
+sudo systemctl disable docker
+sudo apt-get -y remove docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+sudo apt-get -y autoremove
+sudo rm -rf /etc/apt/sources.list.d/docker.list
+sudo rm -rf /etc/apt/keyrings/docker.gpg
+
+# Remove user from Docker, T-Pot group
+echo "Removing $(whoami) from T-Pot group..."
+sudo deluser $(whoami) tpot
+echo "Removing $(whoami) from Docker group..."
+sudo deluser $(whoami) docker
+# Remove T-Pot user and group
+echo "Removing T-Pot user..."
+sudo deluser tpot
+echo "Removing T-Pot group..."
+sudo delgroup tpot
+
+# Remove aliases
+echo "Removing aliases..."
+sed -i '/alias dps=/d' ~/.bashrc
+sed -i '/alias dpsw=/d' ~/.bashrc
+
+# Remove installer lock file
+sudo rm -f /var/log/debian-install-lock
+
+echo "Done. Please reboot and re-connect via SSH on tcp/22"
+
--- a/_deprecated/installer/fedora/install.sh
+++ b/_deprecated/installer/fedora/install.sh
@ -0,0 +1,85 @@
+#!/bin/bash
+
+# Needs to run as non-root
+myWHOAMI=$(whoami)
+if [ "$myWHOAMI" == "root" ]
+  then
+    echo "Need to run as user ..."
+    exit
+fi
+
+# Check if running on Fedora
+if ! grep -q 'ID=fedora' /etc/os-release; then
+  echo "This script is designed to run on Fedora. Aborting."
+  exit 1
+fi
+
+if [ -f /var/log/fedora-install-lock ]; then
+  echo "Error: The installer has already been run on this system. If you wish to run it again, please run the uninstall.sh first."
+  exit 1
+fi
+
+# Create installer lock file
+sudo touch /var/log/fedora-install-lock
+
+# Update SSH config
+echo "Updating SSH config..."
+sudo bash -c 'echo "Port 64295" >> /etc/ssh/sshd_config'
+
+# Update DNS config
+echo "Updating DNS config..."
+sudo bash -c "sed -i 's/^.*DNSStubListener=.*/DNSStubListener=no/' /etc/systemd/resolved.conf"
+sudo systemctl restart systemd-resolved.service
+
+# Update SELinux config
+echo "Updating SELinux config..."
+sudo sed -i s/SELINUX=enforcing/SELINUX=permissive/g /etc/selinux/config
+
+# Update Firewall rules
+echo "Updating Firewall rules..."
+sudo firewall-cmd --permanent --add-port=64295/tcp
+sudo firewall-cmd --permanent --zone=public --set-target=ACCEPT
+#sudo firewall-cmd --reload
+sudo firewall-cmd --list-all
+
+# Load kernel modules
+echo "Loading kernel modules..."
+sudo modprobe -v iptable_filter
+echo "iptable_filter" | sudo tee /etc/modules-load.d/iptables.conf
+
+# Add Docker to repositories, install latest docker
+echo "Adding Docker to repositories and installing..."
+sudo dnf -y update
+sudo dnf -y install dnf-plugins-core
+sudo dnf -y config-manager --add-repo https://download.docker.com/linux/fedora/docker-ce.repo
+sudo dnf -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+sudo systemctl enable docker
+sudo systemctl start docker
+
+# Install recommended packages
+echo "Installing recommended packages..."
+sudo dnf -y install bash-completion git grc net-tools
+
+# Add T-Pot user and group to avoid any permission denied on the data folder while keeping permissions 770
+echo "Creating T-Pot group and user..."
+sudo groupadd -g 2000 tpot
+sudo useradd -r -u 2000 -g 2000 -M -s /sbin/nologin tpot
+# Add user to Docker, T-Pot group
+echo "Adding $(whoami) to Docker group..."
+sudo usermod -aG docker $(whoami)
+echo "Adding $(whoami) to T-Pot group..."
+sudo usermod -aG tpot $(whoami)
+
+# Add aliases
+echo "Adding aliases..."
+echo "alias dps='grc docker ps -a'" >> ~/.bashrc
+echo "alias dpsw='watch -c \"grc --colour=on docker ps -a\"'" >> ~/.bashrc
+
+# Show running services
+sudo grc netstat -tulpen
+echo "Please review for possible honeypot port conflicts."
+echo "While SSH is taken care of, other services such as"
+echo "SMTP, HTTP, etc. might prevent T-Pot from starting."
+
+echo "Done. Please reboot and re-connect via SSH on tcp/64295."
+
--- a/_deprecated/installer/fedora/uninstall.sh
+++ b/_deprecated/installer/fedora/uninstall.sh
@ -0,0 +1,78 @@
+#!/bin/bash
+
+# Needs to run as non-root
+myWHOAMI=$(whoami)
+if [ "$myWHOAMI" == "root" ]
+  then
+    echo "Need to run as user ..."
+    exit
+fi
+
+# Check if running on Fedora
+if ! grep -q 'ID=fedora' /etc/os-release; then
+  echo "This script is designed to run on Fedora. Aborting."
+  exit 1
+fi
+
+if [ ! -f /var/log/fedora-install-lock ]; then
+  echo "Error: The installer has not been run on this system. Aborting uninstallation."
+  exit 1
+fi
+
+# Remove SSH config changes
+echo "Removing SSH config changes..."
+sudo sed -i '/Port 64295/d' /etc/ssh/sshd_config
+
+# Remove DNS config changes
+echo "Updating DNS config..."
+sudo bash -c "sed -i 's/^.*DNSStubListener=.*/#DNSStubListener=yes/' /etc/systemd/resolved.conf"
+sudo systemctl restart systemd-resolved.service
+
+# Restore SELinux config
+echo "Restoring SELinux config..."
+sudo sed -i s/SELINUX=permissive/SELINUX=enforcing/g /etc/selinux/config
+
+# Remove Firewall rules
+echo "Removing Firewall rules..."
+sudo firewall-cmd --permanent --remove-port=64295/tcp
+sudo firewall-cmd --permanent --zone=public --set-target=default
+#sudo firewall-cmd --reload
+sudo firewall-cmd --list-all
+
+# Unload kernel modules
+echo "Unloading kernel modules..."
+sudo modprobe -rv iptable_filter
+sudo rm /etc/modules-load.d/iptables.conf
+
+# Uninstall Docker
+echo "Stopping and removing all containers ..."
+docker stop $(docker ps -aq)
+docker rm $(docker ps -aq)
+echo "Uninstalling Docker..."
+sudo systemctl stop docker
+sudo systemctl disable docker
+sudo dnf -y remove docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+sudo dnf config-manager --disable docker-ce-stable
+sudo rm /etc/yum.repos.d/docker-ce.repo
+
+# Remove user from Docker, T-Pot group
+echo "Removing $(whoami) from T-Pot group..."
+sudo gpasswd -d $(whoami) tpot
+echo "Removing $(whoami) from Docker group..."
+sudo gpasswd -d $(whoami) docker
+# Remove T-Pot user and group
+echo "Removing T-Pot user..."
+sudo userdel tpot
+echo "Removing T-Pot group..."
+sudo groupdel tpot
+
+# Remove aliases
+echo "Removing aliases..."
+sed -i '/alias dps=/d' ~/.bashrc
+sed -i '/alias dpsw=/d' ~/.bashrc
+
+# Remove installer lock file
+sudo rm /var/log/fedora-install-lock
+
+echo "Done. Please reboot and re-connect via SSH on tcp/22"
+
--- a/_deprecated/installer/suse/install.sh
+++ b/_deprecated/installer/suse/install.sh
@ -0,0 +1,70 @@
+#!/bin/bash
+
+# Needs to run as non-root
+myWHOAMI=$(whoami)
+if [ "$myWHOAMI" == "root" ]
+  then
+    echo "Need to run as user ..."
+    exit
+fi
+
+# Check if running on OpenSuse Tumbleweed
+if ! grep -q 'ID="opensuse-tumbleweed"' /etc/os-release; then
+  echo "This script is designed to run on OpenSuse Tumbleweed. Aborting."
+  exit 1
+fi
+
+if [ -f /var/log/suse-install-lock ]; then
+  echo "Error: The installer has already been run on this system. If you wish to run it again, please run the uninstall.sh first."
+  exit 1
+fi
+
+# Create installer lock file
+sudo touch /var/log/suse-install-lock
+
+# Update SSH config
+echo "Updating SSH config..."
+sudo bash -c 'echo "Port 64295" >> /etc/ssh/sshd_config.d/port.conf'
+
+# Update Firewall rules
+echo "Updating Firewall rules..."
+sudo firewall-cmd --permanent --add-port=64295/tcp
+sudo firewall-cmd --permanent --zone=public --set-target=ACCEPT
+#sudo firewall-cmd --reload
+sudo firewall-cmd --list-all
+
+# Install docker and recommended packages
+echo "Installing recommended packages..."
+sudo zypper -n update
+sudo zypper -n remove cups net-tools postfix yast2-auth-client yast2-auth-server
+sudo zypper -n install bash-completion docker docker-compose git grc busybox-net-tools
+
+# Enable and start docker
+echo "Enabling and starting docker..."
+systemctl enable docker
+systemctl start docker
+
+# Add T-Pot user and group to avoid any permission denied on the data folder while keeping permissions 770
+echo "Creating T-Pot group and user ..."
+sudo groupadd -g 2000 tpot
+sudo useradd -r -u 2000 -g 2000 -s /sbin/nologin tpot
+
+# Add user to Docker, T-Pot group
+echo "Adding $(whoami) to Docker group..."
+sudo usermod -a -G docker $(whoami)
+echo "Adding $(whoami) to T-Pot group..."
+sudo usermod -a -G tpot $(whoami)
+
+# Add aliases
+echo "Adding aliases..."
+echo "alias dps='grc docker ps -a'" >> ~/.bashrc
+echo "alias dpsw='watch -c \"grc --colour=on docker ps -a\"'" >> ~/.bashrc
+
+# Show running services
+sudo grc netstat -tulpen
+echo "Please review for possible honeypot port conflicts."
+echo "While SSH is taken care of, other services such as"
+echo "SMTP, HTTP, etc. might prevent T-Pot from starting."
+
+echo "Done. Please reboot and re-connect via SSH on tcp/64295."
+
--- a/_deprecated/installer/suse/uninstall.sh
+++ b/_deprecated/installer/suse/uninstall.sh
@ -0,0 +1,63 @@
+#!/bin/bash
+
+# Needs to run as non-root
+myWHOAMI=$(whoami)
+if [ "$myWHOAMI" == "root" ]
+  then
+    echo "Need to run as user ..."
+    exit
+fi
+
+# Check if running on OpenSuse Tumbleweed
+if ! grep -q 'ID="opensuse-tumbleweed"' /etc/os-release; then
+  echo "This script is designed to run on OpenSuse Tumbleweed. Aborting."
+  exit 1
+fi
+
+if [ ! -f /var/log/suse-install-lock ]; then
+  echo "Error: The installer has not been run on this system. Aborting uninstallation."
+  exit 1
+fi
+
+# Remove SSH config changes
+echo "Removing SSH config changes..."
+sudo sed -i '/Port 64295/d' /etc/ssh/sshd_config.d/port.conf
+
+# Remove Firewall rules
+echo "Removing Firewall rules..."
+sudo firewall-cmd --permanent --remove-port=64295/tcp
+sudo firewall-cmd --permanent --zone=public --set-target=default
+#sudo firewall-cmd --reload
+sudo firewall-cmd --list-all
+
+# Uninstall Docker
+echo "Stopping and removing all containers ..."
+docker stop $(docker ps -aq)
+docker rm $(docker ps -aq)
+echo "Uninstalling Docker..."
+sudo systemctl stop docker
+sudo systemctl disable docker
+sudo zypper -n remove docker docker-compose
+sudo zypper -n install cups postfix
+
+# Remove user from Docker, T-Pot group
+echo "Removing $(whoami) from T-Pot group..."
+sudo gpasswd -d $(whoami) tpot
+echo "Removing $(whoami) from Docker group..."
+sudo gpasswd -d $(whoami) docker
+# Remove T-Pot user and group
+echo "Removing T-Pot user..."
+sudo userdel tpot
+echo "Removing T-Pot group..."
+sudo groupdel tpot
+
+# Remove aliases
+echo "Removing aliases..."
+sed -i '/alias dps=/d' ~/.bashrc
+sed -i '/alias dpsw=/d' ~/.bashrc
+
+# Remove installer lock file
+sudo rm /var/log/suse-install-lock
+
+echo "Done. Please reboot and re-connect via SSH on tcp/22"
+
--- a/_deprecated/installer/ubuntu/install.sh
+++ b/_deprecated/installer/ubuntu/install.sh
@ -0,0 +1,85 @@
+#!/bin/bash
+
+# Needs to run as non-root
+myWHOAMI=$(whoami)
+if [ "$myWHOAMI" == "root" ]
+  then
+    echo "Need to run as user ..."
+    exit
+fi
+
+# Check if running on Ubuntu
+if ! grep -q 'ID=ubuntu' /etc/os-release; then
+  echo "This script is designed to run on Ubuntu. Aborting."
+  exit 1
+fi
+
+if [ -f /var/log/ubuntu-install-lock ]; then
+  echo "Error: The installer has already been run on this system. If you wish to run it again, please run the uninstall.sh first."
+  exit 1
+fi
+
+# Create installer lock file
+sudo touch /var/log/ubuntu-install-lock
+
+# Update SSH config
+echo "Updating SSH config..."
+sudo bash -c 'echo "Port 64295" >> /etc/ssh/sshd_config'
+sudo systemctl disable ssh.socket
+sudo rm /etc/systemd/system/ssh.service.d/00-socket.conf
+sudo systemctl enable ssh.service
+
+# Update DNS config
+echo "Updating DNS config..."
+sudo bash -c "sed -i 's/^.*DNSStubListener=.*/DNSStubListener=no/' /etc/systemd/resolved.conf"
+sudo systemctl restart systemd-resolved.service
+
+# Install recommended packages
+echo "Installing recommended packages..."
+sudo apt-get -y update
+sudo apt-get -y install bash-completion git grc net-tools vim
+
+# Remove old Docker
+echo "Removing old docker packages..."
+sudo apt-get -y remove docker docker-engine docker.io containerd runc
+
+# Add Docker to repositories, install latest docker
+echo "Adding Docker to repositories and installing..."
+sudo apt-get -y update
+sudo apt-get -y install ca-certificates curl gnupg
+sudo install -m 0755 -d /etc/apt/keyrings
+curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+sudo chmod a+r /etc/apt/keyrings/docker.gpg
+echo \
+  "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
+  "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \
+  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+sudo apt-get -y update
+sudo apt-get -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+sudo systemctl enable docker
+sudo systemctl stop docker
+sudo systemctl start docker
+
+# Add T-Pot user and group to avoid any permission denied on the data folder while keeping permissions 770
+echo "Creating T-Pot group and user ..."
+addgroup --gid 2000 tpot
+adduser --system --no-create-home --uid 2000 --disabled-password --disabled-login --gid 2000 tpot
+# Add user to Docker, T-Pot group
+echo "Adding $(whoami) to Docker group..."
+sudo usermod -aG docker $(whoami)
+echo "Adding $(whoami) to T-Pot group..."
+sudo usermod -aG tpot $(whoami)
+
+# Add aliases
+echo "Adding aliases..."
+echo "alias dps='grc docker ps -a'" >> ~/.bashrc
+echo "alias dpsw='watch -c \"grc --colour=on docker ps -a\"'" >> ~/.bashrc
+
+# Show running services
+sudo grc netstat -tulpen
+echo "Please review for possible honeypot port conflicts."
+echo "While SSH is taken care of, other services such as"
+echo "SMTP, HTTP, etc. might prevent T-Pot from starting."
+
+echo "Done. Please reboot and re-connect via SSH on tcp/64295."
+
--- a/_deprecated/installer/ubuntu/uninstall.sh
+++ b/_deprecated/installer/ubuntu/uninstall.sh
@ -0,0 +1,66 @@
+#!/bin/bash
+
+# Needs to run as non-root
+myWHOAMI=$(whoami)
+if [ "$myWHOAMI" == "root" ]
+  then
+    echo "Need to run as user ..."
+    exit
+fi
+
+# Check if running on Ubuntu
+if ! grep -q 'ID=ubuntu' /etc/os-release; then
+  echo "This script is designed to run on Ubuntu. Aborting."
+  exit 1
+fi
+
+# Check if installer lock file exists
+if [ ! -f /var/log/ubuntu-install-lock ]; then
+  echo "Error: The installer has not been run on this system. Aborting."
+  exit 1
+fi
+
+# Remove SSH config changes
+echo "Removing SSH config changes..."
+sudo sed -i '/Port 64295/d' /etc/ssh/sshd_config
+sudo systemctl disable ssh.service
+sudo systemctl enable ssh.socket
+
+# Remove DNS config changes
+echo "Updating DNS config..."
+sudo bash -c "sed -i 's/^.*DNSStubListener=.*/#DNSStubListener=yes/' /etc/systemd/resolved.conf"
+sudo systemctl restart systemd-resolved.service
+
+# Uninstall Docker
+echo "Stopping and removing all containers ..."
+docker stop $(docker ps -aq)
+docker rm $(docker ps -aq)
+echo "Uninstalling Docker..."
+sudo systemctl stop docker
+sudo systemctl disable docker
+sudo apt-get -y remove docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+sudo apt-get -y autoremove
+sudo rm -rf /etc/apt/sources.list.d/docker.list
+sudo rm -rf /etc/apt/keyrings/docker.gpg
+
+# Remove user from Docker, T-Pot group
+echo "Removing $(whoami) from T-Pot group..."
+sudo deluser $(whoami) tpot
+echo "Removing $(whoami) from Docker group..."
+sudo deluser $(whoami) docker
+# Remove T-Pot user and group
+echo "Removing T-Pot user..."
+sudo deluser tpot
+echo "Removing T-Pot group..."
+sudo delgroup tpot
+
+# Remove aliases
+echo "Removing aliases..."
+sed -i '/alias dps=/d' ~/.bashrc
+sed -i '/alias dpsw=/d' ~/.bashrc
+
+# Remove installer lock file
+sudo rm -f /var/log/ubuntu-install-lock
+
+echo "Done. Please reboot and re-connect via SSH on tcp/22"
+
--- a/_deprecated/iso/installer/install.sh
+++ b/_deprecated/iso/installer/install.sh
@ -26,6 +26,11 @@ if [ -f "../../packages.txt" ];
  then myINSTALLPACKAGESFILE="../../packages.txt"
 elif [ -f "/opt/tpot/packages.txt" ];
  then myINSTALLPACKAGESFILE="/opt/tpot/packages.txt"
+elif [ -f "/root/tpot/packages.txt" ];
+  then myINSTALLPACKAGESFILE="/root/tpot/packages.txt"
+else
+  echo "packages.txt NOT FOUND."
+  exit 1
 fi
 myINSTALLPACKAGES=$(cat $myINSTALLPACKAGESFILE)
 myINFO="\
@ -129,7 +134,7 @@ kernel.panic_on_oops = 1
 vm.max_map_count = 262144
 "
 myFAIL2BANCONF="[DEFAULT]
-ignore-ip = 127.0.0.1/8
+ignoreip = 127.0.0.1/8
 bantime = 3600
 findtime = 600
 maxretry = 5
@ -696,7 +701,7 @@ echo "UseRoaming no" | tee -a /etc/ssh/ssh_config
 # Installing elasticdump, yq
 fuBANNER "Installing pkgs"
 npm install elasticdump -g
-pip3 install glances yq
+pip3 install glances[docker] yq
 hash -r

 # Cloning T-Pot from GitHub
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
t3chn0m4g3	efd5465837	work on permissions, folders and tpotinit	2024-02-14 19:04:05 +01:00
Marco Ochse	ef2f5b3f93	Rework .env / env.example Add more functions to customizer.py (improve port and service checks, improve user output) Adjust docker-compose files	2024-02-13 19:02:40 +01:00
Marco Ochse	e7aecf560d	Add T-Pot Service Builder	2024-02-12 19:18:57 +01:00
Marco Ochse	bd4df39538	fix missing replace for x86_64 > amd64 thanks to @shark4ce for taking the time to test, debug and offer a solution #1472.	2024-02-06 13:45:12 +01:00
t3chn0m4g3	2fe2d59129	remove auto reload	2024-01-05 22:07:19 +01:00
t3chn0m4g3	7ba5567e70	add logstash http_input support for nginx remove cockpit support entirely cleanup / housekeeping	2024-01-05 21:31:13 +01:00
t3chn0m4g3	0f7dc73f1a	provide better example	2024-01-05 20:28:39 +01:00
t3chn0m4g3	1da37b5f85	re-implement distributed feature, without ssh add sensor compose file add distributed option to tpot config housekeeping / cleanup	2024-01-05 20:19:50 +01:00
Marco Ochse	c634d294c7	Update .env	2024-01-05 12:00:36 +01:00
t3chn0m4g3	908ca2a45b	update builder	2023-12-11 11:04:51 +01:00
t3chn0m4g3	faec613b9a	add persistence to ENVs add ENVs checker to keep tpotinit from starting if ENVs are not present or incorrectly set	2023-12-08 18:00:09 +01:00
t3chn0m4g3	406a7314ee	fix logrotate config, fix version	2023-12-07 18:44:24 +01:00
Marco Ochse	cf91caaf8c	fix alias	2023-11-01 16:19:24 +01:00
Marco Ochse	13326985a9	Add support for Raspbian (64 Bit)	2023-11-01 15:51:56 +01:00
Marco Ochse	15d65dbc25	Add Raspbian as supported OS (64 Bit)	2023-11-01 15:50:16 +01:00
Marco Ochse	05bdfd3855	Update ansible installer	2023-11-01 14:13:16 +01:00
Marco Ochse	5ebeffe31c	Finetune raspberry_showcase.yml	2023-10-31 17:33:40 +01:00
Marco Ochse	5ca4136ebe	add citation	2023-08-28 10:38:40 +02:00
Marco Ochse	90fa3b30e9	Update	2023-07-22 11:55:10 +02:00
Marco Ochse	32ba41497a	Update	2023-07-20 19:16:10 +02:00
Marco Ochse	d2eaaab4df	Update builder to push to GHCR and DockerHub	2023-07-20 18:59:01 +02:00
Marco Ochse	a8f5555324	- Prepare a docker compose file for a Raspberry Showcase - Add config settings for the T-Pot Attack Map 2.1.0	2023-07-20 18:41:56 +02:00
Marco Ochse	cbbd2aa6c8	Update	2023-07-11 19:26:13 +02:00
Marco Ochse	6f978e3b5d	Add Raspberry Pi support.	2023-07-11 19:19:51 +02:00
Marco Ochse	94445800de	Add Raspberry Pi support.	2023-07-06 17:44:57 +02:00
Marco Ochse	338ebcef80	Add check if Playbook ran successfully.	2023-07-05 23:34:15 +02:00
Marco Ochse	ccdbb950d1	fix typo	2023-07-05 23:16:15 +02:00
Marco Ochse	12af5c9d46	Handle password securely, needs htpasswd to create user:password: - Update tpotinit and entrypoint.sh to reflect this - Update install.sh to reflect this - Update .env / env.example to reflect this Reorder recommended packages in T-Pot Playbook Add packages to T-Pot Playbook to ensure manual deployment via Ansible will offer the same environment as manual local installation via install.sh and local Ansible deployment.	2023-07-05 23:03:41 +02:00
Marco Ochse	b3f1b71054	Tweaking: - Ansible Playbooks refinement - Add Ansible Bootstrapping - Add some notes	2023-07-05 17:55:59 +02:00
Marco Ochse	69be264eae	Notes for Dev Preview	2023-07-04 00:41:12 +02:00
Marco Ochse	fd74707f07	Notes for Dev Preview	2023-07-04 00:38:35 +02:00
Marco Ochse	1ebdfc2eac	Add install support for Alma Linux.	2023-07-03 23:43:31 +02:00
Marco Ochse	45d7b60d4c	Add install support for Rocky Linux.	2023-07-03 22:47:13 +02:00
Marco Ochse	4dfb9a9caf	tweak installer fix issue with selinux on Fedora	2023-07-03 16:45:40 +02:00
Marco Ochse	ae9a2dd2ee	Tweaking - reorder install.sh	2023-07-02 15:25:58 +02:00
Marco Ochse	e26a8a2b39	Tweaking	2023-07-02 15:05:55 +02:00
Marco Ochse	f7fc81a8ad	Update Installer / Playbooks - add tags - reorder - fix errors	2023-07-02 14:52:06 +02:00
Marco Ochse	cbcfa6d1f0	tweaking	2023-07-01 03:26:26 +02:00
Marco Ochse	9f9aed8176	tweaking	2023-07-01 01:23:57 +02:00
Marco Ochse	df0581b491	tweaking	2023-07-01 00:31:50 +02:00
Marco Ochse	5a7c4b54e6	tweaking	2023-06-30 23:49:47 +02:00
Marco Ochse	3eead2740e	tweaking	2023-06-30 23:42:19 +02:00
Marco Ochse	3f472f594a	tweaking	2023-06-30 23:23:15 +02:00
Marco Ochse	38b1e99673	tweaking	2023-06-30 22:51:25 +02:00
Marco Ochse	4df54390dc	tweak install script and configs	2023-06-30 22:03:53 +02:00
Marco Ochse	58ca11f85e	tweaking	2023-06-30 14:58:10 +02:00
Marco Ochse	2d1a06551c	tweak installer, playbooks	2023-06-30 13:15:30 +02:00
Marco Ochse	e4b73c5be7	update distro names	2023-06-30 11:22:50 +02:00
Marco Ochse	5465a5e364	update distro names	2023-06-30 11:19:49 +02:00
Marco Ochse	eceb08317e	use ghcr for testing	2023-06-30 11:03:16 +02:00
t3chn0m4g3	51154d7857	download images during install, tweaking	2023-06-29 18:43:08 +02:00
t3chn0m4g3	4c74690c41	tweaking	2023-06-29 13:29:42 +02:00
t3chn0m4g3	9815453623	add support for local cache	2023-06-29 13:06:43 +02:00
t3chn0m4g3	81aad58c2f	adjust build script for docker engine builder setup is no longer needed amd64 and arm64 support	2023-06-29 12:22:19 +02:00
t3chn0m4g3	65a443d778	add installer Instead of individual installers for each distribution there is only one necessary now that we are using Ansible.	2023-06-27 19:59:19 +02:00
t3chn0m4g3	20559345b0	add installer Instead of individual installers for each distribution there is only one necessary now that we are using Ansible.	2023-06-27 19:55:46 +02:00
t3chn0m4g3	ef812c6b82	Merge branch 'master' into dev	2023-06-27 11:58:39 +00:00
t3chn0m4g3	81fab84040	add bookworm check to updates while not supported the update script will no longer break if bookworm is found	2023-06-27 09:53:28 +00:00
t3chn0m4g3	a0c5a8c0e7	fix port definitions - docker-compose no longer accepts ports definitions when network_mode: host is set - previous versions simply ignored the ports definitions, the updated docker-compose breaks with an error however	2023-06-27 09:23:52 +00:00
t3chn0m4g3	72502ebbe6	tweaking	2023-06-26 18:10:39 +02:00
t3chn0m4g3	25eea5b9ab	cleanup installer	2023-06-26 17:41:30 +02:00
t3chn0m4g3	df4ca7ccd0	tweak ansible uninstall	2023-06-26 17:36:40 +02:00
t3chn0m4g3	3c92e6ec06	add ansible uninstall	2023-06-26 04:59:52 +02:00
t3chn0m4g3	9be17e982b	ansible tweaking, finalize suse	2023-06-25 16:56:18 +02:00
t3chn0m4g3	1094b33665	start adding openSUSE Tumbleweed	2023-06-25 13:17:33 +02:00
t3chn0m4g3	e2e20e3684	add fedora to installer, tweaking	2023-06-24 14:05:13 +02:00
t3chn0m4g3	95c6a8e28a	add support for Ubuntu, begin work on Fedora	2023-06-22 18:30:18 +00:00
t3chn0m4g3	d7bcfda109	add git clone	2023-06-22 18:36:37 +02:00
t3chn0m4g3	048cbb8b6c	sync hw clock to system	2023-06-22 17:17:42 +02:00
t3chn0m4g3	29a445da4e	start work on ansible installer	2023-06-21 23:21:11 +02:00
Marco Ochse	4671dc8729	Begin of restructuring ... - tweaking before re-work tpotinit	2023-06-19 15:19:15 +02:00
Marco Ochse	050c898149	Begin of restructuring ... - tweaking before re-work tpotinit	2023-06-14 02:17:09 +02:00
Marco Ochse	ecb1dcd338	Merge pull request #1351 from telekom-security/master fixes #1346	2023-06-14 00:02:35 +02:00
Marco Ochse	2c4eaf0794	Begin of restructuring ... - deprecate old release - set virtual version - we need tpot user / group, adding to installer - tweaking - do not use the dev branch, it will break stuff	2023-06-13 23:59:09 +02:00
Marco Ochse	c807c7cd17	Begin of restructuring ... - deprecate old release - set virtual version - we need tpot user / group, adding to installer - tweaking - do not use the dev branch, it will break stuff	2023-06-13 23:58:46 +02:00
t3chn0m4g3	c1808161e4	fixes #1346	2023-06-07 05:54:17 +00:00
Marco Ochse	bd12e1a4c0	Merge pull request #1338 from kauedg/dps-patch-1 call $0 instead of hardcoded script name	2023-06-01 13:28:04 +02:00
Kaue Doretto Grecchi	edda041093	call $0 instead of hardcoded script name Allows the script to work when called from another directory or if the script name changes.	2023-05-31 14:47:15 -03:00
Marco Ochse	e3b1fd298a	Prepare fix for #1336 .	2023-05-31 17:21:15 +02:00
t3chn0m4g3	1a2d34c013	bump elk to 8.6.2, rebuild images	2023-05-30 14:35:45 +00:00
Marco Ochse	00d6d1b4c7	Add T-Pot Technical Preview	2023-05-30 12:22:10 +02:00
Marco Ochse	87ef005c17	tweaking for tpotlight	2023-05-27 14:49:20 +02:00
Marco Ochse	9941818a6e	Create SECURITY.md	2023-05-12 18:37:04 +02:00
t3chn0m4g3	f438be7e27	Allow for automatic geoip db downloads	2023-05-07 18:10:23 +02:00
t3chn0m4g3	efd5f4c54c	fixes #1320	2023-05-03 22:01:36 +00:00
t3chn0m4g3	35188ef28e	add option to retrieve ENVs from file	2023-05-02 13:11:05 +02:00
t3chn0m4g3	e7963dbdaa	update ddospot folders	2023-04-30 22:51:03 +02:00
t3chn0m4g3	918a408357	Merge branch 'master' of https://github.com/telekom-security/tpotce	2023-04-27 18:44:30 +02:00
t3chn0m4g3	5fd0d158e6	Add Nginx Cockpit Awareness	2023-04-27 18:42:38 +02:00
t3chn0m4g3	5265e3945a	bump ewsposter to 1.25.0	2023-04-26 08:47:28 +00:00
t3chn0m4g3	a08a475f57	tweaking	2023-04-25 17:47:44 +00:00
marco	ff7c368c7f	update landing page make relative links (T-Pot home) dynamic to display them only if services are available adjust dimensions for link container correct github link place attack-map link in the home container	2023-04-25 15:03:26 +02:00
Marco Ochse	88ab453061	Merge pull request #1283 from tadashi-oya/fix-empty-myINSTALLPACKAGES fix empty myINSTALLPACKAGES	2023-03-23 16:21:18 +01:00
tadashi-oya	4bae09e408	fix empty myINSTALLPACKAGES	2023-03-20 05:55:21 +00:00
t3chn0m4g3	668a4d91a7	bump ewsposter to 1.24.0	2023-02-24 14:34:49 +00:00
Marco Ochse	1a20de2f7f	Merge pull request #1266 from kawaiipantsu/kawaiipantsu-request-uri-size Fixing uri max size	2023-02-23 16:54:53 +01:00
Dave	350179fc89	Added detailed comment Added a detailed comment on what the change is needed for and why it's there	2023-02-23 16:51:42 +01:00
Dave	f3a6461eaa	Fixing uri max size Changing URI max size from 1024 to 1280 bytes	2023-02-21 01:13:52 +01:00
t3chn0m4g3	fc17d850b5	bump t-pot-attack-map to v2.0.1	2023-02-14 17:41:02 +00:00
Marco Ochse	44c38d809b	Merge pull request #1259 from kawaiipantsu/patch-1 Update updateip.sh	2023-02-10 14:52:40 +01:00
Dave	5eb9368064	Update updateip.sh Make sure to target root partition, Debian will often come with /boot/efi or similar. This little hack will utilize regular expression to match line starting with / but having a blank after. So only root partition should match.	2023-02-09 13:31:08 +01:00
t3chn0m4g3	72a3b51bd4	bump t-pot-attack-map to 1.2.0	2023-02-04 00:29:26 +00:00
t3chn0m4g3	f786769527	bump t-pot-attack-map to 1.1.2	2023-02-03 20:37:27 +00:00
t3chn0m4g3	23934bc693	bump t-pot-attack-map to 1.1.1, add nginx cache header	2023-02-03 18:16:32 +00:00
t3chn0m4g3	7e60b46732	fixes #1254 , fixes #1253 - #1254: new ELK images will be provided shortly - #1253: documentation and updater will now reflect that an update from 20.06.x is no longer possible	2023-01-26 10:49:24 +00:00
t3chn0m4g3	c178d878ab	bump ELK to 8.5.3	2023-01-23 16:33:09 +00:00
t3chn0m4g3	390390fd43	bump to alpine 3.17, tweaking, fixes for py 3.10	2023-01-23 15:42:59 +00:00
t3chn0m4g3	8119aca317	tweaking	2023-01-23 12:04:40 +00:00
t3chn0m4g3	2fd0f62484	bump to alpine 3.17	2023-01-20 17:48:46 +00:00
t3chn0m4g3	90eab744b1	bump cyberchef to 9.55.0, fix glitches	2023-01-20 17:42:17 +00:00
t3chn0m4g3	8547699061	bump cowrie to 2.5.0	2023-01-19 17:15:08 +00:00
t3chn0m4g3	2b5127fbdb	update readme	2023-01-19 13:18:28 +00:00
t3chn0m4g3	4382413672	bump t-pot-attack-map to 1.1.0, buildx to 0.10.0	2023-01-19 11:42:25 +00:00
t3chn0m4g3	516bec1deb	fixes #1241	2023-01-10 17:56:18 +00:00
t3chn0m4g3	ede61b81d9	update map to fix CVE	2023-01-06 19:53:05 +00:00
t3chn0m4g3	59cca98e7f	update geoip map to latest release update nginx to include brotli and gzip compression improve load performance	2023-01-06 18:58:03 +00:00
t3chn0m4g3	2641d1e743	bump elastic stack to 8.4.3	2022-11-02 16:37:01 +00:00
t3chn0m4g3	3b2e8a4c70	tweaking	2022-11-02 07:54:42 +00:00
t3chn0m4g3	16fe4b1d28	bump sentrypeer to 2.0	2022-11-01 15:26:24 +00:00
t3chn0m4g3	b34644f1a8	add link for py3	2022-11-01 11:59:52 +00:00
t3chn0m4g3	7fa447943d	bump medpot to latest fork master	2022-11-01 10:52:47 +00:00
t3chn0m4g3	c9b4bd27e6	bump buildx to 0.8.2	2022-11-01 10:46:24 +00:00
t3chn0m4g3	38edadb3da	bump log4pot to latest master	2022-11-01 09:39:11 +00:00
t3chn0m4g3	5da8431e3a	bump cyberchef, esvue to latest master	2022-10-31 17:01:04 +01:00
t3chn0m4g3	ccb94b1529	revert buildx to 0.8.1	2022-10-31 15:41:59 +00:00
t3chn0m4g3	e2cbd981ca	bump hellpot to latest master	2022-10-14 14:55:28 +00:00
t3chn0m4g3	48f3c842b5	bump fatt to latest master	2022-10-13 14:06:09 +00:00
t3chn0m4g3	f9179e3e21	bump cowrie to 2.4.0	2022-10-13 08:44:55 +00:00
Marco Ochse	5c30a57280	Merge pull request #1173 from zambroid/patch-1 Corrected small typos	2022-10-12 13:54:49 +02:00
t3chn0m4g3	8410f84fe9	bump adbhoney to latest master	2022-10-12 11:52:17 +00:00
Fabio Zambrino	d9aa6bd525	Update README.md	2022-10-12 13:45:01 +02:00
Marco Ochse	ee547994dc	Merge pull request #1187 from ctulio/url-fix Update some url repos	2022-10-12 13:22:03 +02:00
t3chn0m4g3	0316bc7a2c	bump buildx to 0.9.1	2022-10-12 09:50:10 +02:00
César Túlio Albuquerque de Almeida	c9f6320446	Update some url repos	2022-10-11 22:39:55 -04:00
t3chn0m4g3	b8e3df97dc	bump ewsposter to latest master, update packages	2022-10-11 15:13:47 +00:00
Fabio Zambrino	bac0d3c30c	Update README.md	2022-09-02 17:30:04 +02:00
Fabio Zambrino	db1e65b968	Made small adjustments to the readme file The readme file was containing small typos, I tried to identify them and my proposed new version of the file is here	2022-08-25 09:23:29 +02:00
t3chn0m4g3	1122d3728e	Bump ELK Stack to 8.3.3	2022-08-17 16:34:53 +00:00
Marco Ochse	b696ec7b39	Merge pull request #1135 from cha147/patch-1	2022-07-14 00:06:23 +02:00
cha147	a22a7d98c4	dix typos in readme	2022-07-13 14:35:50 -07:00
t3chn0m4g3	a3bda5de8f	bump Elastic stack to 8.2.3	2022-06-15 14:29:23 +00:00
t3chn0m4g3	5f0c337f09	bump elk, log4pot, honeytrap, dionaea to ubuntu 22.04	2022-06-14 10:47:11 +00:00
t3chn0m4g3	fc93db2bc4	fix cleanup medpot	2022-06-14 08:04:35 +00:00
t3chn0m4g3	421b3d3020	bump medpot to latest master	2022-06-14 07:51:14 +00:00
t3chn0m4g3	1eaec0036e	prep for new medpot, honeypots and some tweaking	2022-06-13 11:59:40 +00:00
Marco Ochse	afb16dcc96	Fix typo, fixes #1111	2022-06-09 17:38:39 +02:00
t3chn0m4g3	15f7a17935	Comment ENV opt-in for SentryPeer	2022-06-08 11:09:29 +00:00
t3chn0m4g3	dcf15ca489	Opt-In for SentryPeer DHT mode, fixes #1110	2022-06-08 09:10:29 +00:00
t3chn0m4g3	a28dfec046	bump qHoneypots to latest master, adjust config for commands input	2022-06-07 11:19:34 +00:00
t3chn0m4g3	8993f59001	Bump Glutton to Alpine 3.16, decrease image size	2022-06-03 14:21:55 +00:00
t3chn0m4g3	09c682cd7b	Bump to Alpine 3.16 for most of the images. Glutton, Heralding, Mailoney and Snare/Tanner need work.	2022-06-02 15:47:17 +00:00
t3chn0m4g3	409e4bde3e	Bump Cyberchef to 9.38.0, Elasticvue to 0.40.1 Bump Nginx, Spiderfoot to Alpine 3.16	2022-06-02 13:36:54 +00:00
t3chn0m4g3	aaef85c49d	Bump SentryPeer to 1.4.1	2022-06-02 08:31:18 +00:00
t3chn0m4g3	73b54f5504	Bump Elastic Stack to 8.2.2	2022-06-01 10:26:49 +00:00
t3chn0m4g3	55da6a4841	Bump Elastic Stack to 8.2.0, update objects	2022-05-25 14:53:29 +00:00
t3chn0m4g3	153c11babd	fix glances not showing docker containers	2022-05-24 14:58:45 +00:00
t3chn0m4g3	f13d08287f	prep for elk 8.1.2	2022-04-15 13:11:25 +00:00
t3chn0m4g3	fc123d10f9	bump spiderfoot to 4.0	2022-04-14 17:15:43 +00:00
t3chn0m4g3	ded2124932	bump cyberchef, esvue to latest release	2022-04-14 16:52:48 +00:00
Marco Ochse	909ca358f0	Fix headings, links	2022-04-14 10:36:07 +02:00