A Honeypot on a Spare VLAN: Cowrie + CISA's New Decoys Playbook
One spare switch port, one Docker container, and you find out exactly who is scanning your network — and when they touch something that shouldn't exist. Built around Cowrie 3.x and CISA's Sep 16 cyber-decoys guidance.