Home

GreedyBear

GreedyBear is a threat intelligence platform that extracts attack data recorded by one or multiple instances of T-Pot and generates actionable feeds that can be used to prevent and detect attacks. You can read the official announcement here.

Honeynet Instance

The Honeynet Project runs an instance of GreedyBear at greedybear.honeynet.org, which provides public feeds for free. For example, a feed of the most recent Cowrie attacks.

Note: Please do not perform too many requests to extract feeds or you will be banned. If you want to be updated regularly, please download the feeds only once every 10 minutes (this is the time between each internal update).

If you want to check out all the available feeds and other API endpoints, please refer to our usage guide.

Installation

You can also run your own instance of GreedyBear. Note that you might also want to run an instance of T-Pot as you need a data source. For details on how to get GreedyBear up and running, please refer to our installation guide.