How kamolchanok-saengtong/hydrapot works
HydraPoT is a configurable, multi-agent SSH honeypot. An attacker connects over SSH; the session handler maintains shared context, scores command impact, and routes commands among Cowrie-style emulation and local or cloud LLM agents. Responses preserve session continuity, while command and event records support threat analysis and a SIEM dashboard. The source excerpts establish the entry-point wiring, session-aware routing behavior, and storage/dashboard access; the README documents the broader agent-routing design. Some subsystem links are therefore shown only where supported by those sources or documentation.
Main entry points: session.py Session handler · router.py Agent selection · storage.py Event database · ssh_server.py SSH listener
Components 23
SSH Capture
- Runtime startup
main.py - SSH listener
ssh_server.py - Session handler
shell/session.py
Session Routing
- Session state
shell/state.py - Impact scoring
prompt/fi_manager.py - Agent selection
router.py - Session-aware routing
shell/routing.py
Command Responses
- Cowrie agent
agent_manager/cowrie_agent.py - Static emulation
agent_manager/static_handler.py - On-device agent
agent_manager/ondevice_agent.py - Cloud agent
agent_manager/cloud_agent.py - Prompt assembly
prompt/prompt_manager.py - LLM safeguards
guardrail/validator.py
Threat Analysis
- Event database
storage.py - Threat intelligence
threat_intel/aggregator.py - Alert sweeper
threat_intel/sweeper.py
User Interfaces
- Web API host
api_server.py - API services
api/services/findings.py - SIEM dashboard
SIEM/layout.py - Database browser
SIEM/pages/database.py
Other components
- SSH attacker
- Operator
- Cloud model service
Connections 25
- Runtime startup → SSH listener: starts listener
- Runtime startup → Cowrie agent: connects agent
- SSH attacker → SSH listener: opens SSH
- SSH listener → Session handler: dispatches commands
- Session handler → Session state: updates state
- Session handler → Impact scoring: scores command
- Session handler → Agent selection: selects agent
- Session handler → Session-aware routing: checks model need
- Agent selection → Cowrie agent: routes command
- Agent selection → On-device agent: routes command
- Agent selection → Cloud agent: routes command
- Cowrie agent → Static emulation: uses emulation
- Session handler → Prompt assembly: builds prompts
- Prompt assembly → On-device agent: supplies prompts
- On-device agent → LLM safeguards: validates output
- Cloud agent → Cloud model service: requests inference
- Session handler → Event database: records events
- Alert sweeper → Event database: reads records
- Alert sweeper → Threat intelligence: processes threats
- Web API host → API services: dispatches requests
- API services → Event database: reads findings
- Web API host → SIEM dashboard: hosts dashboard
- SIEM dashboard → Database browser: renders browser
- Database browser → Event database: queries read-only
- Operator → SIEM dashboard: views analytics