KFSensor vs SNARE

KFSensor is a self-hosted Windows honeypot system from KeyFocus Ltd. It detects intrusion attempts by simulating vulnerable services and trojans, allowing controlled observation of attack behavior. Professional monitors every TCP and UDP port and detects ICMP or ping messages. Emulated services include HTTP, HTTPS, SMTP, SMB/CIFS, SOCKS, SQL Server, MySQL, FTP, POP3, Telnet, Terminal Server, and VNC. Users can write simulations in Perl, C, and other languages, with Honeyd script compatibility. Events can reach SIEM systems such as ArcSight and Qradar in real time, or be sent to UNIX Syslog, Windows Event Log, external applications, and an ODBC SQL database. Reports and graphs support filters for time, attack type, and visitor location, with configurable alerts including email. Enterprise adds central multi-sensor management, remote reconfiguration, centralized signature updates, and encrypted sensor communications. Professional costs $599, paid once, with a free trial available.

SNARE has no write-up on Specifiction yet; its figures are above.