Using honeypots for Cyber Threat Intelligence

The main goal of this thesis is to extract data from different honeypot systems, classify them and ingest them to MISP - a threat information sharing platform. In order to achieve this goal, the environment for the honeypot systems needs to be installed and configured to retrieve the data. The thesis is divided into theoretical and practical part. The theoretical part describes the basic principles of cyber security and selected methods of cyber attacks. Another chapter is devoted to Cyber Threat Management and its frameworks and types. Then Cyber Threat Intelligence is described - its types, life cycle, resources and methods of use in an organization. The last part is dedicated to honeypots, which is a key topic for the practical part. The biggest contribution of this thesis is the installation and configuration of two honeypots, data acquisition and their addition to the MISP platform. The deployed honeypots offer a lot of possibilities in which direction to focus them further or what specific information to collect. It is also possible to create new detection rules in security systems that will work with the information in the MISP platform. This thesis can serve as a first step to further develop activities in the security team related to threat hunting. Due to the achieved results, all the objectives of the thesis have been successfully met.