External Suricata Log and Honeypot

[kalpinus]

Hello,

I just success install t-pot (standard installation) in the cloud for research and its running well. I have some IDS using suricata in some location and also some honeypots such as cowrie and dioanea in some location. My question is how do I use my fresh t-pot installation to collect all data from those suricata and honeypots ?

Thank you

Regards,

[kalpinus]

Hello all,
since there is no answer for this question, maybe I will try to install new instances of t-pot and then forward all data to my first t-pot installation. So what is next type of t-pot installation I need to install which allow me to send data to the first t-pot instance (standard installation with complete package) ?

Any help would be appreciate. Thank you

[t3chn0m4g3]

This is described in the ReadMe.

[kalpinus]

Hello, thank you for your response. I read the ReadMe, however in the ReadMe explain about HIVE and HIVE_Sensor for distributed deployment. My first installation, I choice Standard which is Standalone with everything I need. So for second and next installation, should I choice HIVE_Sensor or just SENSOR (Just honeypot and NSM) ?

Thank you

[t3chn0m4g3]

You can switch between editions.

[kalpinus]

thank you for response. If I switch from standard to HIVE then what happen to existing honeypots which is already running in the same machine since HIVE will running ELK and tools and HIVE_Sensor will run Honeypots and NSM. Is it possible, I let my first installation as standard installation (and its already running well) and then install HIVE_Sensor in the other network segment and send logs to the standard installation ? Or if I have other honeypots (let say cowrie and dionea) alread running in other network segment, is it possible I send data to the t-pot standard installation ?

Thank you