Posting data to Attack Map

[AdamKhanIT]

Hi Everyone,

Really appreciate this project. I was wondering if there is a way to post data manually to the Attack Map. For example posting random sources and destination IP's.

[Ganesh-403]

@AdamKhanIT
Yes, it's possible, but not through a documented API.

From what I can tell, the T-Pot Attack Map is designed to visualize real-time events coming from Elasticsearch, which are processed by the map_data service and published to Redis for the map_web frontend to consume. I couldn't find any official documentation describing an HTTP endpoint or supported API for manually injecting arbitrary attack events into the Attack Map. :contentReference[oaicite:0]{index=0}

So if your goal is to display custom source/destination IPs, there are two practical approaches:

Option 1 (Recommended): Index synthetic events into Elasticsearch

This is the approach that best matches the intended architecture.

Custom Event
      ↓
Elasticsearch
      ↓
map_data
      ↓
Redis
      ↓
Attack Map

If your synthetic events match the fields expected by the map_data service, they should be processed just like honeypot events.

---

Option 2: Publish directly to Redis

The Attack Map uses Redis as its real-time backend, so in theory you could publish directly to Redis.

However, I couldn't find documentation describing the Redis schema or message format, so this would require inspecting the map_data implementation or the t-pot-attack-map source code to determine exactly what payloads it publishes. That makes it more of a custom modification than a supported extension. :contentReference[oaicite:1]{index=1}

If your goal is demonstrations or testing

For generating demo traffic, I'd recommend creating synthetic Elasticsearch documents instead of modifying Redis directly. That way:

• the Attack Map continues to use its normal ingestion pipeline,
• your events are searchable in Elasticsearch/Kibana,
• and you avoid depending on internal Redis message formats that may change between releases.

One question that would help suggest the best approach:

• Are you trying to:
  1. demonstrate the Attack Map with fake attacks,
  2. integrate events from another security product, or
  3. replay historical attack data into the map?

The recommended solution differs slightly depending on your objective.

If this solves your problem, feel free to mark it as the accepted answer so others can find it easily.