Have Questions About NeroSwarm?
Get practical guidance on deployment, security workflows, and operations. Below are answers to some frequently asked questions about NeroSwarm Honeypot.
What is NeroSwarm Honeypot?
NeroSwarm Honeypot is an advanced security solution centered around deception technology and designed to detect attackers before they can cause significant damage. It allows you to create and manage honeypots that are designed to look and act like their namesake and host realistic services.
How does NeroSwarm Honeypot use deception?
NeroSwarm Honeypot leverages the power of deception by strategically placing fake servers throughout your network. These deceptive entities are meticulously crafted to emulate real services, enticing attackers to interact with them. Once an attacker engages with a NeroSwarm honeypot, the deceptive services prompt further exploration, ultimately exposing the threat. Your honeypot then promptly notifies you, enabling you to detect and respond to potential attacks proactively, preventing significant damage.
What are the benefits of using NeroSwarm Honeypot?
Using NeroSwarm Honeypot has several benefits, including easy and fast setup, no ongoing maintenance, minimal false positives, and the ability to detect attackers before they can cause significant damage. NeroSwarm Honeypot also provides transparent and straightforward pricing, as well as a dashboard for managing Honeypots and handling incidents.
How much does NeroSwarm Honeypot cost?
NeroSwarm Honeypot costs $1000 USD per year for each decoy. Enjoy flexible customization options with no additional costs or contracts. For example, 10 decoys will cost $10000 USD per year.
What types of honeypots does NeroSwarm offer?
Currently, NeroSwarm offers both containerized decoys and hardware devices that can be easily plugged into your network.
Is NeroSwarm Honeypot easy to set up?
Yes, whether you choose the hardware-based device that only requires plugging in or the containerized image that can be deployed with a single command.
Can NeroSwarm Honeypot be deployed externally or is it for internal use only?
NeroSwarm Honeypot is versatile in its deployment capabilities, allowing for both external and internal deployment. The choice of deployment depends on your specific security needs and firewall configuration. External deployment is particularly useful for security researchers looking to collect data on the latest malware trends, while internal deployment is effective for businesses aiming to detect and mitigate system intrusions efficiently.
What OS and Specs are recommended for deploying NeroSwarm containerized images on a Cloud VM Server?
For optimal performance, we recommend deploying NeroSwarm containerized images on cloud VM servers running modern Linux distributions such as CentOS 8 or above, Debian 12 or above, Fedora 33 or above, Red Hat Enterprise Linux 8 or above, or Ubuntu 20.04 or above. Our images are compatible with both amd64 and arm64 architectures, ensuring they can run on a wide range of hardware. Although designed to be highly resource-efficient, these containerized honeypots require a minimum of 1GB of RAM and 5GB of HDD storage to function properly, offering a balance of performance and flexibility for your deployment needs.
How does NeroSwarm use AI for deception?
NeroSwarm harnesses AI technology to meticulously emulate various operating systems, crafting a lifelike environment that deceives attackers into believing they are engaging with authentic systems. Our AI-powered emulation captures and records every action performed by attackers, delivering invaluable insights for thorough threat analysis and response. Through the synergy of AI and emulation, NeroSwarm provides advanced detection capabilities and a comprehensive understanding of attacker behavior.
How does NeroSwarm Honeypot alert me to an incident?
At present, NeroSwarm Honeypot notifies you via email, Discord, Slack, Microsoft Teams, and TheHive although additional services may be added in the future.
What SIEM platforms does NeroSwarm integrate with?
NeroSwarm Honeypot integrates with popular SIEM platforms such as Elasticsearch, Microsoft Sentinel, Observe, Inc., Panther, Sekoia.io, Splunk, Sumo Logic and Syslog. This allows you to forward honeypot logs directly to your preferred platform for analysis and correlation with other security events.
What services can NeroSwarm Honeypot emulate?
NeroSwarm Honeypot currently emulates 30 protocol and service surfaces: DNS, Elasticsearch, FTP, Git, HTTP, HTTPS, IMAP, Kubernetes API, LDAP, Memcached, MongoDB, MQTT, MSSQL, MySQL, NTP, POP3, PostgreSQL, RDP, Redis, S3, SIP, SMB, SNMP, SSH, Telnet, TFTP, VNC, CWMP (TR-069), Docker API, and SMPP. This protocol coverage is designed to attract realistic attacker interaction and generate high-signal detection telemetry.
See the full protocol overview on the Honeypots page .
How does NeroSwarm keep honeypot deployments safe in production?
NeroSwarm is designed with a security-first architecture: decoy services are isolated from business workloads, interactions are tightly contained, and alerts are generated from monitored deception activity rather than exposing production systems. This allows organizations to gain high-signal attacker visibility while keeping operational risk low. As with any security control, final protection posture also depends on standard host and container hardening practices in your environment.
How quickly can I go live?
Most teams can deploy their first decoy quickly and begin receiving signal shortly after setup. The platform is built to reduce setup friction so you can move from planning to detection in a short time.
What happens after NeroSwarm detects suspicious activity?
When activity is detected, NeroSwarm captures the event context and sends alerts to your configured channels. Your team can review attacker behavior, triage the incident, and use the evidence to accelerate response.
How is NeroSwarm different from IDS or IPS?
Traditional IDS and IPS focus on traffic inspection and policy enforcement. NeroSwarm adds a deception layer that attracts unauthorized interaction on purpose, helping you detect real attacker behavior earlier with high-intent signal.
How does NeroSwarm help reduce false positives?
Deception alerts are high-signal by design because decoys and planted assets should not be touched during normal operations. That means your team spends less time chasing noisy alerts and more time on meaningful incidents.
What onboarding and support are included?
NeroSwarm includes onboarding guidance to help you choose placement, configure alert destinations, and launch with confidence. Support is available to help your team adapt deployment as your environment evolves.
Can we start small and scale later?
Yes. Many teams start with a focused deployment in one environment or segment, then expand coverage over time. This keeps adoption practical while proving value early.
Who is NeroSwarm best suited for?
NeroSwarm is a strong fit for organizations that want earlier detection, cleaner alerts, and clearer attacker context without adding heavy operational overhead.
How many Honeytoken types does NeroSwarm provide?
NeroSwarm currently provides at least 47 Honeytoken types across practical lure categories, including API keys, credentials, files, URLs, cloud artifacts, and service-specific indicators. This coverage helps teams place low-friction tripwires across endpoints, repositories, cloud workflows, and exposed surfaces.
See the complete Honeytoken catalog on the Honeytokens page .
What is the difference between a Honeytoken and a Honeypot in NeroSwarm?
A Honeypot is an interactive decoy service that emulates protocol behavior and captures session-level attacker interaction. A Honeytoken is a planted indicator (such as a fake key, URL, document, or credential) that triggers an alert when used or accessed. In practice, Honeypots provide richer behavioral telemetry, while Honeytokens provide lightweight, broad coverage and fast signal across many locations.
Do I need a dedicated SOC team to use NeroSwarm?
No. NeroSwarm is designed for both mature SOC teams and lean security teams. You can start with simple deployment and alert routing, then expand into deeper workflows as your team grows.
What deployment methods does NeroSwarm support?
NeroSwarm supports multiple deployment paths so teams can align with their infrastructure model, from fast standalone rollout to orchestrated environments. This gives flexibility for labs, production segments, and enterprise operating constraints.
How quickly can we deploy and validate the first detection signal?
Most teams can deploy quickly and validate first signal shortly after activation. The typical rollout approach is deploy first, then tune exclusions, alert routing, and integrations to match your operational workflow.
Are attacker commands executed on our production host?
No. NeroSwarm is built to provide controlled deception interaction and telemetry capture. It is designed to surface attacker behavior while minimizing risk to production systems.
How does NeroSwarm reduce noisy or low-value alerts?
NeroSwarm focuses on high-intent deception interactions and supports source suppression controls, including IPv4, IPv6, and CIDR exclusion ranges, so teams can reduce expected scanner noise and keep analyst focus on meaningful events.
Can NeroSwarm alerts be sent to our collaboration and incident channels?
Yes. Alert delivery can be routed to configured notification channels so teams can operationalize detection quickly and connect deception signal to existing response workflows.
Can we integrate NeroSwarm telemetry into our SIEM and security stack?
Yes. NeroSwarm is designed to forward structured telemetry and support common SIEM/SOC integration patterns, helping teams correlate deception events with broader security context.
Can we start small and expand coverage later?
Yes. Many organizations begin with a focused deployment, validate value, then expand by segment, environment, or use case. This staged approach keeps adoption practical while improving coverage over time.
What security hardening should we apply before production rollout?
Use standard enterprise hardening practices: least privilege, network segmentation, controlled egress, host and container security baselines, and secure secret handling. NeroSwarm complements these controls by adding high-signal deception detection.