How dashboardtobie/kubedeceive works
KubeDeceive is a Kubernetes deception system. Its main loop detects Falco events, decides whether to respond, deploys a Cowrie honeypod, redirects production traffic, and restores the service after the honeypod TTL; Falcosidekick and Wazuh provide event routing and SOC visibility. The controller source is only partially excerpted, so internal actions are separated only where shown or explicitly documented. Other integrations and SOC capabilities follow the README’s architecture description.
Main entry points: controller.py Event handler · docker-compose.yml Wazuh SOC · values.yaml.tpl Falcosidekick · ssh-prod.yaml Production service
Components 17
Detection and routing
- Falco detection
falco/values.yaml.tpl - Falcosidekick
falco/values.yaml.tpl
Controller response
- Event handler
chart/files/controller.py - Contextual decision
chart/files/controller.py - Deduplication state
chart/files/controller.py - Honeypod deployment
chart/files/controller.py - Traffic redirection
chart/files/controller.py - TTL restoration
chart/files/controller.py
Cluster resources
- Production service
demo/ssh-prod.yaml - Cowrie honeypod
chart/values.yaml - EndpointSlice
chart/files/controller.py - Kubernetes API
Security operations
- Wazuh SOC
soc/docker-compose.yml - Event decoder
soc/decoders/local_decoder.xml - SOC rules
soc/rules/local_rules.xml - Syslog receiver
soc/enable-syslog.sh
Other components
- Attacker
Connections 19
- Attacker → Production service: accesses
README.md - Production service → Falco detection: observed by
README.md - Falco detection → Falcosidekick: sends event
README.md - Falcosidekick → Event handler: webhook
README.md - Falcosidekick → Syslog receiver: routes syslog
README.md - Syslog receiver → Wazuh SOC: forwards events
README.md - Event handler → Contextual decision: evaluates event
chart/files/controller.py - Contextual decision → Deduplication state: checks recent
chart/files/controller.py - Event handler → Honeypod deployment: creates pod
chart/files/controller.py - Honeypod deployment → Cowrie honeypod: deploys
README.md - Event handler → Traffic redirection: redirects traffic
README.md - Traffic redirection → EndpointSlice: creates slice
chart/files/controller.py - Event handler → Kubernetes API: manages resources
chart/files/controller.py - Event handler → TTL restoration: schedules TTL
chart/files/controller.py - TTL restoration → Kubernetes API: restores service
chart/files/controller.py - TTL restoration → EndpointSlice: deletes slice
chart/files/controller.py - Cowrie honeypod → Wazuh SOC: feeds captured activity
README.md - Wazuh SOC → Event decoder: uses decoder
README.md - Wazuh SOC → SOC rules: applies rules
README.md