Beelzebub
Concepts

Events And Observability

Collect interaction evidence through logs, Prometheus, RabbitMQ, and optional Cloud reporting.

Every interaction becomes a tracer event with protocol, source address, command/request data, response, status, identity fields, and protocol-specific metadata. Binary TCP input that is not valid UTF-8 is preserved in CommandRaw as reversible \xNN escapes. A wire plugin may enrich the event’s Metadata map; the built-in VNC plugin uses it for a correlated challenge, response, and authorized-analysis representation.

Prometheus exposes beelzebub_events_total plus protocol counters such as beelzebub_ssh_events_total, beelzebub_http_events_total, beelzebub_tcp_events_total, beelzebub_telnet_events_total, and beelzebub_mcp_events_total at the configured endpoint (default :2112/metrics).

RabbitMQ publishes structured JSON to the event queue when enabled. Cloud reporting is optional; read Cloud integration before sending captured data outside the host.

Edit on GitHub

Configuration Model

Understand core settings, service files, precedence, matching, and validation.

LLM Deception And MCP Tripwires

Use adaptive responses and decoy tools to study attacker behavior and agent guardrail bypasses.