IntelOwl’s analyzers do the heavy lifting of threat intelligence i.e. scanning observables against dozens of services and producing structured results. But analysis in isolation is only half the picture. The connectors are what close the loop: they take those results and push them out to external platforms like MISP, OpenCTI, and YETI for further correlation, or to communication tools like Slack for real-time alerting.

Our GSoC student Krishna Awasthi spent three months working under the supervision of Tim Leonhard on GreedyBear and a new companion project, tpot-payload-server, building a complete pipeline to capture, quarantine, and share the malware payload files that T-Pot honeypots collect from live attackers.

Read on for an overview of the project, the technical decisions behind it, and what shipped.

Student: Krishna Awasthi (opbot-xd)

Mentors: Tim Leonhard

Organization: The Honeynet Project

Project: GreedyBear · tpot-payload-server

I spent this summer as a GSoC contributor on GreedyBear under the mentorship of Tim Leonhard, refactoring its hardcoded dashboard into a configuration-driven widget system with a drag-and-drop admin editor and backend persistence.

Mentor: Tim Leonhard
Organization: The Honeynet Project
Project: GreedyBear: Dashboard Modularization

GSoC Proposal

The goal of my project was to modularize the GreedyBear dashboard.

Before this project, every widget - its type, data source, position, and column span was hardcoded directly in Dashboard.jsx. Adding a new chart meant editing the layout file by hand, and there was no way for an admin to customize the dashboard without touching source code and redeploying.

Our GSoC student Dorna Raj Gyawali spent three months working under the supervision of Tim Leonhard on the GreedyBear project, focusing on introducing an Event Collector API to make it easier for external honeypots and sensors to submit IOC events to GreedyBear.

Read on for an overview of their achievements and how they successfully contributed towards GreedyBear and some considerations for the future.

Student: Dorna Raj Gyawali (drona-gyawali)

Mentors: Tim Leonhard

Contributor: Francesco Berardi
Mentors: Matteo Lodi

An analyst opens IntelOwl, types “is job #40 malicious?”, and gets back:

Job #40 is classified as malicious with a reliability score of 7 out of 10. The verdict was supported by 2 analyzers and contradicted by 1 analyzer, while the remaining 3 analyzers did not provide an opinion (silent).

No API key. No token bill. No byte of that observable ever left the machine.

That is what I built for Google Summer of Code 2026 with The Honeynet Project: a conversational interface embedded in IntelOwl, running entirely on a locally-hosted LLM. This post explains how it works, what I measured, and what did not work.

Contributor: Kunal Gurtatta Mentors: Lorena Goldoni, Federico Foschini

Overview

As a Python developer and security enthusiast, I always wanted to contribute to open-source security projects. When I learned about GSoC from one of my seniors, I started searching for security organizations and came across Honeynet. They had just announced their ideas for this year’s GSoC, and one of them was BuffaLogs, which matched my tech stack perfectly. I began contributing in late Feb'25, submitting PRs to implement alerters and making small refactors to get familiar with the codebase. Since my early contributions focused on alerters, I decided to continue working on integrating more of them and improving the alerting logic in my proposal.

Contributor: Onunwa Goodness Mentors: Lorena Goldoni, Federico Foschini

My Google Summer of Code 2025 - The Honeynet Project (BuffaLogs)

September 1, 2025 officially marks the end of the Google Summer of Code (GSoC) 2025 coding period. Over the past four months, I’ve had the privilege of contributing as a developer to The BuffaLogs Project under The Honeynet Project. It’s been four months of doing what I love most—building and shipping code.

We are happy to announce that we have been selected as an organization to participate in Google Summer of Code 2024! This will be the 15th time that Honeynet is participating in the Google Summer of Code program to accelerate the creation of information- and cyber security related tools that are free and open source software. We are now entering the community bonding phase during which students are encouraged to reach out and interact with organizations and start getting involved with potential projects. We strongly recommend to join our Discord.

Our dedicated Google Summer of Code (GSoC) participant, Abheek, has spent an impressive three-month duration program actively contributing to not one, but two distinct projects: IntelOwl and Buffalogs. Notably, Abheek undertook the responsibility of crafting the brand-new official website for IntelOwl throughout this period.

In light of this significant achievement, we believe it is only fitting to showcase his remarkable results and contributions within the official IntelOwl site, in which he discuses his journey as a designer/frontend developer, the tasks involved and the detailed contributions to both projects, including the revamping of IntelOwl’s website, implementing JWT authentication for Buffalogs, creating maps and graphs for BuffaLogs’ dashboard, and crafting a frontend guide for IntelOwl using react-joyride.

Our GSoC student Kumiszhan Dybyspayeva was working for three months under the supervision of Lukas Rist on Ochi, specifically on introducing new features such as event filtering using a DSL, persisting filters and sharing an event.

Read on for an overview of their achievements and how they successfully contributed towards Ochi and some considerations for the future.