Honeypots are fake services you set to catch attackers. You intentionally put a service up with the intention of luring attackers, tricking them into thinking the service is real and contains some kind of sensitive information. Often, the honeypot is disguised to look like an old, outdated, and vulnerable server. Logging or alerts can be attached to the honeypot to quickly identify a potential attacker. Having a honeypot on your internal network may alert you of an attacker before any systems are compromised.
When attackers compromise a machine, they often use the compromised machine to continue enumerating, attacking, and pivoting. If a honeypot on your network detects strange behavior coming from another machine on your network, such as port scans or login attempts, the machine behaving strangely might be compromised.
There are many different kinds of honeypots. It...