Echidra: I built a honeypot that tells you what kind of attacker you're looking at, not just what happened

Most honeypots log what happened. Echidra tells you what kind of attacker you're looking at.

It simulates SSH, HTTP, FTP, and Telnet services with a believable Linux persona, then runs every session through a deterministic classifier — actor type, risk score, MITRE ATT&CK technique, intent — before it hits your dashboard. Nothing attackers type ever touches the real host.

Here's the part that actually mattered, and why I made the calls I did.

The part that actually solved my original problem

Every session gets run through a classifier when it ends. It's rule-based right now, not ML — a set of YAML rules that map session features to an actor type, a risk score, a MITRE ATT&CK technique, and a guess at intent. So instead of opening a log file, I open a dashboard and see which sessions were credential-stuffing bots, which were somebody manually poking around, and which looked like they were trying to establish persistence.