Skip to content
ARCHONLABSblackpot.io
Documentation menu

Documentation

Documentation for blackpot.io is organized around the three audiences that touch the platform:

  • Integrators — the person who deploys a sensor onto an environment, wires Cloudflare Tunnel and webhooks, and hands off to the operator team.
  • Operators — the SOC analyst who reads dossiers, tunes threat thresholds, and reviews canary trips.
  • Integrators of data — the engineer who feeds blackpot.io into a SIEM, SOAR, or MISP via webhooks, STIX export, or the database.

At a glance

A blackpot.io deployment is one Go daemon per host, one Postgres (managed or self-hosted), and one Cloudflare Tunnel (or router port-forward) per exposed bait surface. That's it. There is no cluster to run, no message bus, no agent on every endpoint.

The daemon exposes bait ports (HTTP, SSH, Redis, MongoDB, MSSQL, Elasticsearch, Kubernetes API, Docker API). Each incoming connection produces an AttackerSession. Sessions accumulate for a retention window (default 10 minutes of inactivity) and are then finalized: geoip resolved, anonymizer scored, canaries registered, dossier assembled, and the session persisted to Postgres.

The 15-minute smoke test

If you want to poke at a running sensor before reading anything else, do this:

  1. Deploy a sensor to a host you control (docker-compose or the raw Go binary).
  2. Point a Cloudflare Tunnel or router forward at the HTTP bait port.
  3. From another network, curl a set of scanner-attractive paths:/.env, /wp-login.php,/actuator/env, /phpmyadmin/.
  4. Wait ten minutes (the default session-retention window) and look for the row in the console — or query attacker_sessions directly.

Where to go next

Depending on what you're trying to do: