Problem / What it aims to solve
Organizations running multiple distributed T-Pot sensors currently do not have a streamlined way to centralize payload collection. Payloads are siloed within their respective sensors, making fleet-wide threat intelligence aggregation difficult.
Suggested approach
Introduce support for centralizing all payloads from multiple remote T-Pot sensors under a single GreedyBear instance. This might involve configuring the extraction job to loop over a fleet of tpot-payload-server endpoints and tagging the ingested payloads with their originating sensor ID.
Additional context
Note: Implementing this feature may require changes across multiple codebases (e.g., both GreedyBear and tpot-payload-server).
Problem / What it aims to solve
Organizations running multiple distributed T-Pot sensors currently do not have a streamlined way to centralize payload collection. Payloads are siloed within their respective sensors, making fleet-wide threat intelligence aggregation difficult.
Suggested approach
Introduce support for centralizing all payloads from multiple remote T-Pot sensors under a single GreedyBear instance. This might involve configuring the extraction job to loop over a fleet of
tpot-payload-serverendpoints and tagging the ingested payloads with their originating sensor ID.Additional context
Note: Implementing this feature may require changes across multiple codebases (e.g., both
GreedyBearandtpot-payload-server).