Heralding review
A free, open-source network honeypot with broad protocol coverage and focused reporting.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Heralding is an open-source, self-hosted honeypot for collecting authentication credentials and logging activity across network services. It is aimed at security teams, researchers and defenders who need network decoys spanning multiple protocols rather than a single service. The product runs on Linux as a Python application and supports Docker builds and runtime deployment, giving teams two deployment paths for a controlled environment.
Its main strength is protocol breadth. Heralding provides network listeners for FTP, Telnet, SSH, HTTP, HTTPS, POP3, IMAP, SMTP, VNC, PostgreSQL and SOCKS5, with additional configurable capabilities for MySQL and RDP. Service ports, banners and timeouts can be adjusted to match the monitoring scenario. This makes it a fit for credential-catching across varied network surfaces, particularly where a narrow, single-protocol honeypot would not cover the desired exposure.
Logging is equally central to the product. Authentication attempts can be written to CSV, while complete sessions are available in JSON Lines format. Optional reporting through syslog and HPFeeds supports connection to those existing collection paths, but the integration surface remains focused rather than broad. Heralding is a strong choice for teams comfortable operating a Linux-based, self-hosted tool and prioritizing protocol coverage, configurable decoys and direct log output. Organizations seeking a managed cloud service, a wider integration ecosystem or a more current documentation experience should consider an alternative.
Questions about Heralding
What does Heralding run on? Linux. It runs self-hosted.
What does Heralding integrate with? 2 integrations: syslog and HPFeeds.
Who is Heralding built for? Solo users, small businesses and mid-market companies (our editorial estimate).
Heralding pros and cons
- Where it wins
- Listeners cover FTP, SSH, HTTP, mail, database and remote-access protocols
- Logs authentication attempts to CSV and complete sessions to JSON Lines
- Configurable ports, banners, timeouts, Docker builds and runtime support
- Where it doesn't
- Self-hosted deployment requires a Linux environment
- Reporting integrations are limited to syslog and HPFeeds
- Documentation and examples are largely historical
Heralding fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update