ORCAPOT

ORCAPOT is a deception (honeypot) platform by Febrics. Organisations deploy decoys (website clones, embedded decoys, marketplace app decoys, custom pages and mail pots), and ORCAPOT records every request that reaches them, scores attacker IPs with machine learning and groups IPs that behave alike into campaigns.

This connector gives Claude read-only access to your own organisation's ORCAPOT data, so you can ask in plain language instead of building dashboard queries:

• What hit our decoys last night, and which source IPs are the most dangerous?
• Did this IP touch any of our decoys, and what exactly did it send?
• Which usernames were tried on our decoy login pages?
• Are there new or unknown attack patterns (possible 0-days)?
• Give me a block list of high-confidence malicious IPs for our firewall or SIEM.
• Is someone cloning our website for phishing?

25 read-only tools cover decoy configuration, dashboards, grouped counts, attacker tables, raw requests, IP profiles, ML threat scores, campaigns, emerging threats, AI action recommendations, credential attempts, uploaded files, mail pots, phishing clone findings, daily reports, organisation settings and the IOC / TAXII feed.

Built for security teams:

• Each connection is bound to exactly one ORCAPOT organisation; you only ever see your own data.
• All tools are read-only; the connector changes nothing in ORCAPOT.
• Text written by attackers is returned separately as attacker-supplied data, sanitised, with links defanged.
• Captured passwords and your team's e-mail addresses stay masked unless an administrator explicitly allows sensitive data.
• You choose how long access lasts when you connect and can revoke it at any time in ORCAPOT.

Requires an ORCAPOT account with the Read Only or Manager role in an organisation with an active licence.