Work out honeypot interaction rate instantly with clear inputs, formula shown and shareable results.
A honeypot has no legitimate users, so in principle every interaction is suspicious — which is what makes it the highest signal-to-noise detection available. In practice internal vulnerability scanners, asset discovery and monitoring probes generate benign hits, and excluding them is what preserves the purity that justifies deploying honeypots at all.
Honeypot signal
malicious = total interactions - known benign; purity = malicious / total; per honeypot = total / honeypot count
Because there is no baseline of normal activity to filter. One interaction with an internal honeypot is stronger evidence than thousands of anomaly-based alerts.
Allow-list your scanner source addresses at the honeypot rather than filtering downstream, so the alert pipeline stays clean and the purity metric stays meaningful.