
Deploy web honeypots to capture emerging attack data, analyze ModSecurity audit logs via ELK, and share threat intelligence with MISP for community-driven web application defense.
The goal of the OWASP Honeypot Project is to identify emerging attacks against web applications and report them to the community, in order to facilitate protection against such targeted attacks.
Based around the earlier OWASP/WASC Distributed Web Honeypots Project (https://github.com/SpiderLabs/owasp-distributed-web-honeypots)
The primary aims of the project are
This repository is organized into various directories. Below table shows the purpose of each one.
| Directory | Purpose |
|---|---|
honeytraps | Focuses on building honeytraps and reporting threat intelligence |
mds_elk | Shows a PoC for sending the ModSecurity Audit Logs to ELK using Filebeat |
misp-doc | Assists in setting the MISP Server and creating threat events using PyMISP |
mlogc_elk | Shows a PoC for sending the ModSecurity Audit Logs to ELK using ModSecurity Audit Log Collector (mlogc) |
docs | Contains architecture documentation, such as the v1.1 Schema Migration Guide and JSON schemas |
Please go to respective directories for complete documentation.
Last reviewed: June 2026
This repository currently reflects a set of active proof-of-concept paths and longer-term ideas. The roadmap below distinguishes completed work from ongoing focus areas and future opportunities.
honeytraps/, mds_elk/, mlogc_elk/, and misp-doc/