Beelzebub
A secure low code deception runtime framework, leveraging AI for System Virtualization.
Last verified:
What is Beelzebub?
Beelzebub is an open-source deception runtime framework that deploys adaptive, LLM-powered decoy services across multiple protocols including SSH, HTTP, TCP, TELNET, and MCP (Model Context Protocol). It goes beyond traditional passive honeypots by actively engaging attackers in realistic interactions using AI, collecting high-fidelity threat intelligence, and detecting prompt injection attacks against AI agents. The framework uses a simple YAML-based configuration interface, allowing users to create honeypots in minutes without writing custom code.
Key features include an adaptive deception engine with LLM integration (supporting OpenAI GPT-4o and local Ollama models like Llama3), low-code service definition through YAML configuration with regex command matching, multi-protocol coverage from infrastructure targets to AI agent attack surfaces, an extensible plugin system for custom deception responses, and a full observability stack with Prometheus metrics and RabbitMQ event streaming. The framework supports production-ready deployment via Docker, Kubernetes (Helm charts), and includes graceful shutdown with per-service memory limits.
Beelzebub is designed for cybersecurity researchers, security operations teams, enterprise security professionals, developers working on AI agent security, and organizations needing to detect and analyze cyber attacks. It is particularly suitable for small to medium-sized teams looking for cost-effective security solutions, mid-market and enterprise organizations operationalizing security operations, and anyone needing SSH, Telnet, TCP, prompt injection detection, and LLM security capabilities. The framework is especially valuable for protecting AI ecosystems by validating machine intent and detecting semantic attacks like prompt injection and jailbreaking.
The framework collects attacker TTPs (Tactics, Techniques, and Procedures), provides real-time guardrail bypass detection for AI agents, enables autonomous red teaming that stress-tests models 24/7, and includes an infinite maze generator to trap automated scanners. It supports both static command responses and fully interactive LLM-powered sessions with per-session conversation history, making it effective for both low-interaction and high-interaction honeypot scenarios.
Beelzebub pricing
Pricing model: Freemium
Beelzebub is completely open-source and free to use under the GNU GPL v3 license. The framework is available for free on GitHub with all features included. The AWS Marketplace integration (Beelzebub AI Honeypot) is also available free of charge with no end date on free subscriptions. There is a self-hosted option at $0/mo with all features included and unlimited users. The only costs users incur are optional: AWS infrastructure costs if deploying on AWS, LLM API costs when using OpenAI GPT-4o (pay-per-text-generation at approximately €0.01 per attacker session), and server/storage costs for self-hosted deployments. No paid tiers or subscriptions are required to use the core framework.
Beelzebub pros
- Open-source and completely free to use
- LLM-powered adaptive deception with real-time responses
- Supports 5 protocols: SSH, HTTP, TCP, TELNET, and MCP
- YAML-based low-code configuration - no custom code needed
- Works with OpenAI GPT-4o and local Ollama models
- Extensible plugin system with public SDK
- Prometheus metrics for observability
- RabbitMQ integration for SIEM connectivity
- Docker and Kubernetes (Helm) deployment support
- High-interaction honeypot capability with interactive sessions
- Detects prompt injection attacks against AI agents
- Pre-configured honeypot examples included
- Per-service memory limits for production use
- Graceful shutdown support
- Active development with 2k GitHub stars
- Regular releases (v3.7.2 as of May 2026)
- 196 forks indicating strong community adoption
- GNU GPL v3 license
- Collects high-fidelity threat intelligence (TTPs)
- Real-time malware analysis via CTI Hub integration
Beelzebub cons
- Requires LLM API key for AI-powered features (OpenAI costs apply)
- Self-hosted - no fully managed cloud option available
- LLM responses may have latency compared to static handlers
- Requires Go compiler or Docker for deployment
- Configuration is YAML-based which may require learning curve
- Memory limits default to 100 MiB may need adjustment
- LLM provider dependency for advanced features
- No built-in GUI dashboard for management
- Static handlers require manual regex configuration
- TCP binary protocol simulation can be complex
- TELNET LLM integration may need tuning
- Redis/LDAP binary protocol emulation requires expertise
- MCP deception requires AI agent integration setup
- Ollama requires local model hosting infrastructure
- No official commercial support mentioned
- Debug mode must be explicitly enabled in config
- RabbitMQ integration requires separate setup
- Prometheus endpoint must be configured separately
- No out-of-the-box cloud logging integration
- Password regex patterns must be manually configured
Frequently asked questions about Beelzebub
What is Beelzebub?
Beelzebub is a secure low-code deception runtime framework that leverages AI for system virtualization. It is an open-source honeypot framework that deploys adaptive, LLM-powered decoy services across SSH, HTTP, TCP, TELNET, and MCP protocols. Unlike passive honeypots, it actively engages attackers in realistic interactions using AI to generate contextually accurate responses in real time, collecting high-fidelity threat intelligence and detecting prompt injection attacks against AI agents.
How do I install Beelzebub?
Beelzebub can be installed in three ways: 1) Using Docker Compose: clone the repository, run 'docker compose build' then 'docker compose up -d'. 2) Using Go: clone the repo, run 'go mod download', 'go build -o beelzebub .', then './beelzebub run'. 3) Using Helm for Kubernetes: run 'helm install beelzebub ./beelzebub-chart'. Precompiled containers are available at Docker Hub (m4r10/beelzebub).
What protocols does Beelzebub support?
Beelzebub supports five protocols: SSH (Secure Shell), HTTP (web services), TCP (binary and text-based protocols like Redis, PostgreSQL, LDAP), TELNET (legacy devices like routers and switches), and MCP (Model Context Protocol for AI agent security). This covers both traditional infrastructure attack surfaces and modern AI agent attack surfaces.
How does the LLM honeypot work?
The LLM honeypot plugin uses AI (OpenAI GPT-4o or local Ollama models) to generate realistic, contextually accurate responses to attacker commands in real time. For SSH, the AI acts as a Linux terminal with per-session conversation history. For HTTP, it generates dynamic responses for unmatched requests. The plugin integrates via YAML configuration specifying the llmProvider (openai or ollama), llmModel, and API credentials.
Is Beelzebub free?
Yes, Beelzebub is completely free and open-source under the GNU GPL v3 license. It is available for free on GitHub, and the AWS Marketplace integration is also free with no end date. The only potential costs are optional: AWS infrastructure costs if deploying on AWS, and LLM API costs when using OpenAI (approximately €0.01 per attacker session for text generation).
How do I configure a honeypot?
Beelzebub uses a two-tier YAML configuration system. The core configuration (beelzebub.yaml) handles global settings like logging, tracing, and Prometheus. Service configurations are separate YAML files in the services/ directory, one per decoy service. Each service defines protocol, address, description, commands with regex matching and handlers (static or plugin-based), server version/name, password regex, and timeout settings.
What is the MCP deception service?
MCP (Model Context Protocol) deception services expose decoy tools designed to detect prompt injection attacks against LLM-powered agents. The decoy tool is registered in the agent's tool list but should never be invoked normally. Any invocation signals a successful prompt injection attack, providing real-time guardrail bypass detection, authentic attack prompt collection, and measurable attack surface metrics (HAR, TPR, MTP).
How do I monitor Beelzebub events?
Beelzebub provides full observability through Prometheus metrics exposed at the configured endpoint (default: :2112/metrics) including beelzebub_events_total, beelzebub_events_ssh_total, beelzebub_events_http_total, beelzebub_events_tcp_total, beelzebub_events_telnet_total, and beelzebub_events_mcp_total. Events can also be streamed to RabbitMQ for SIEM integration by enabling the rabbit-mq tracing option in the core configuration.
Can I create custom plugins?
Yes, Beelzebub has an extensible plugin system with a stable public SDK at pkg/plugin. You can implement the CommandPlugin interface (for SSH, TCP, TELNET, HTTP text responses) or HTTPPlugin interface (for full HTTP responses with status code, headers, and body). Create a plugin struct, implement Metadata() and Execute()/HandleHTTP(), register via plugin.Register() in init(), and import blank in main.go. No core changes required.
What are the system requirements?
Beelzebub can run with minimal resources - default memory limit is 100 MiB per service (configurable via --mem-limit-mib flag). It requires either a Go compiler (for building from source) or Docker for containerized deployment. For LLM-powered honeypots, you need either an OpenAI API key or a local Ollama instance running with models like codellama:7b. Kubernetes deployment requires a cluster with Helm installed.