Heralding

At a glance

• Editor score
  7.6 / 10
• Pricing
  Free plan
• Best for
  Credential-catching across many protocols
• Free plan
  Yes
• Paid from
  Free
• Deployment model
  Self-hosted
• Facts checked
  22 Sep 2026

• Where it wins

  • Listeners cover FTP, SSH, HTTP, mail, database and remote-access protocols
  • Logs authentication attempts to CSV and complete sessions to JSON Lines
  • Configurable ports, banners, timeouts, Docker builds and runtime support

• Where it doesn't

  • Self-hosted deployment requires a Linux environment
  • Reporting integrations are limited to syslog and HPFeeds
  • Documentation and examples are largely historical

Our verdict on Heralding

Heralding is an open-source, self-hosted honeypot for collecting authentication credentials and logging activity across network services. It is aimed at security teams, researchers and defenders who need network decoys spanning multiple protocols rather than a single service. The product runs on Linux as a Python application and supports Docker builds and runtime deployment, giving teams two deployment paths for a controlled environment.

Its main strength is protocol breadth. Heralding provides network listeners for FTP, Telnet, SSH, HTTP, HTTPS, POP3, IMAP, SMTP, VNC, PostgreSQL and SOCKS5, with additional configurable capabilities for MySQL and RDP. Service ports, banners and timeouts can be adjusted to match the monitoring scenario. This makes it a fit for credential-catching across varied network surfaces, particularly where a narrow, single-protocol honeypot would not cover the desired exposure.

Logging is equally central to the product. Authentication attempts can be written to CSV, while complete sessions are available in JSON Lines format. Optional reporting through syslog and HPFeeds supports connection to those existing collection paths, but the integration surface remains focused rather than broad. Heralding is a strong choice for teams comfortable operating a Linux-based, self-hosted tool and prioritizing protocol coverage, configurable decoys and direct log output. Organizations seeking a managed cloud service, a wider integration ecosystem or a more current documentation experience should consider an alternative.

Questions about Heralding

What does Heralding run on? Linux. It runs self-hosted.

What does Heralding integrate with? 2 integrations: syslog and HPFeeds.

Who is Heralding built for? Solo users, small businesses and mid-market companies (our editorial estimate).

Your product? Our editors can test Heralding in depth and publish a review, labelled as paid · from $149/mo →

Heralding pricing

Heralding fact sheet

Heralding integrations

Heralding lists 2 integrations on its own site.

• syslog
• HPFeeds

Alternatives to Heralding

• BeelzebubA flexible self-hosted honeypot runtime with adaptive interactions and deep security integrations.9.4
• CowrieA mature, deep SSH and Telnet honeypot for self-hosted threat monitoring.9.2
• TPT-PotA broad self-hosted honeypot platform for teams that want many decoys and built-in analysis.9.0

See all Heralding alternatives →

Featured on iTechGuides

Heralding is listed in our Honeypot Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/heralding/"><img src="https://www.itechguides.com/best/badge/heralding.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 14 Nov 2026 · How we research and update