DataTrap (Thales dd-honeypot)¶
Status: Informative · evaluation proof
Upstream: https://github.com/ThalesGroup/dd-honeypot · commit 7a906e11a0b19e75a32fead2ddd9a8b2b341beec
Product name: DataTrap — data-driven AI honeypot (dataset + optional AWS Bedrock LLM)
What this decoy is¶
Multi-protocol decoy suite graded across SSH/HTTP/MySQL/Redis/Telnet/PostgreSQL in UHBS labs.
Protocol survey¶
| DataTrap protocol | UHBS plugin? | Graded? | Quick | Full |
|---|---|---|---|---|
| SSH | yes | yes | 59.88 / D | 55.61 / D |
| HTTP | yes | yes | 45.84 / F | 65.85 / D |
| MySQL | yes | yes | 40.35 / F | 50.65 / D |
| Redis | yes | yes | 42.37 / F | 60.85 / D |
| Telnet | yes | yes | 43.38 / F | 59.88 / D |
| PostgreSQL | yes (postgres) |
yes | 40.35 / F | 57.94 / D |
| Generic TCP | generic |
no | — | — |
Named product is evaluation proof only — not a UHBS endorsement.
For CTI analysts¶
- Cross-protocol correlation from one product family aids campaign tracking.
Primary signals: Per-protocol auth/session telemetry.
For blue teams / detection engineering¶
- Use per-protocol hubs; tune alerts per service risk.
Trust & limitations¶
- Evaluation proof under UHBS 4.2.2 — not a certification or endorsement.
- Prefer full/ over quick/ for decisions.
- Reading guide: READING-UHQS.md.