Step 1 – Describe your Honeypot

For example:

I'm building a honeypot in an isolated lab.

Services:
- SSH
- HTTP

Operating system:
Linux

Available logs:
- SSH authentication logs
- Web server logs
- Firewall logs
- Process activity

Step 2 – Ask AI what to Monitor

Use:

Create a monitoring plan for this honeypot.

Identify:
- important events to collect
- suspicious authentication behavior
- interesting commands or processes
- network activity worth recording
- useful alert conditions

Keep the recommendations focused on defensive monitoring.

AI can produce a list of events worth watching.

For example:

SSH:
- repeated authentication failures
- successful login after failures
- unusual usernames

Web:
- repeated requests for sensitive paths
- unusual HTTP methods
- suspicious request patterns

System:
- new processes
- new files
- unexpected outbound connections

Step 3 – Create Alert Conditions

Now ask:

Turn the monitoring plan into practical alert conditions.

For each alert provide:
- event
- condition
- severity
- useful evidence to collect

This gives you something closer to an actual SOC workflow.

Step 4 – Build a Simple Investigation Flow

Finally:

Create an investigation workflow for a honeypot alert.

Start with:
Alert → Triage → Evidence → Investigation → Timeline → Report

Include questions an analyst should ask at each stage.

You now have a repeatable process for analyzing activity against your honeypot.

The Workflow

Honeypot
   ↓
Collect Events
   ↓
AI Monitoring Plan
   ↓
Alert Conditions
   ↓
Investigation
   ↓
Report

The value of a honeypot isn’t just seeing that someone connected to it. It’s being able to capture, understand, and learn from the activity. AI can help you design that monitoring workflow before you start collecting data.