AmberCell is a high-interaction honeypot: it runs full, real services

01 / WHAT IS A HONEYPOT — IN TWO DIALECTS

IN PLAIN TERMS

AmberCell is a decoy computer that looks like a real office network: mail servers, file shares, databases, even a remote-desktop login.

The difference from a movie prop: everything on it actually works. Attackers who break in get real software to interact with — and every move is recorded, like insects preserved in amber.

Nothing of yours is ever exposed, and the evidence leaves through a one-way letterbox.

FOR SECURITY PROFESSIONALS

- High-interaction by architecture: real OSS daemons in per-protocol cells — no fake shells, no scripted responses

- Single-host Docker Compose (Ubuntu 22.04 / Debian 12), host nftables ingress/egress

- Collector-owned netns capture: pcap + raw flows + JSONL events, append-only

- ATT&CK/Engage enrichment; bounded AI manager off the packet path with a deterministic critic

- Kill bars G1–G14 gate production exposure

- One-way dead drop — SIEM and analysts pull, they never touch the pot