● Live honeypot telemetry

See what attackers do after they break in.

DefOpSec runs Umbra — an in-host sensor that quietly records post-compromise activity on your honeypots (processes, outbound connections, DNS, typed commands, logins) and streams it to one command center for replay and analysis.

Sign in How it works →

Global honeypot fleet

2Honeypots
0Active
1Countries
Enrolled Active (last 15 min) Country-level aggregate — no exact locations shown.
  • US United States darwin 1linux 1 2

What Umbra captures

Processes & commands

Every exec with full argv, plus keystroke-fidelity typed commands — including builtins and failed commands exec capture misses.

Network & DNS

Outbound TCP connects (remote IP/port + the process behind them) and the domains an attacker resolves.

Logins & sessions

Attacker source IP + user on each login, with every action correlated into a single replayable session timeline.

Linux, macOS & Windows

One schema across eBPF (Linux), Apple Endpoint Security (macOS) and ETW (Windows) — enroll any host with one command.