Workshop at UNAM CU

Back to Campus

On March 6, 2026, our team, Honeynet UNAMex, organized the first Honeynet UNAMex Meetup of 2026 at UNAM’s main campus.

Our team was very pleasantly surprised and glad to see that many people from UNAM’s IT community attended the invitation and showed their interest in the project.

Our meetup was held at the facilities of the Institute for Materials Research (Spanish: Instituto de Investigaciones en Materiales, IIM), a leading research entity within the National Autonomous University of Mexico (UNAM), focused on the synthesis, characterization, and application of advanced materials. The event was organized at this location because its IT team had previously collaborated in activities related to the former UNAM Chapter.

The Meetup

The purpose of this first workshop was to provide background about the project, including its history and past initiatives, as well as to share the team’s new vision, ideas, structure, and the prototypes of upcoming projects currently under development.

We shared the history of the Honeynet UNAM Chapter and its evolution into Honeynet UNAMex as an open and independent research team that maintains close collaboration with academic entities while providing a more flexible platform for open collaboration. More importantly, we presented the vision of actively developing and sharing open tools not only to leverage honeypot technologies for complementary detection, but also to strengthen cybersecurity strategies and defensive capabilities.

OpenSMART

During this meetup, a demo of the first prototype of the new platform, OpenSMART, was presented.

This demo aimed to provide an overview of the new structure, as well as the detection and monitoring capabilities that the framework will include. This is especially important for Honeynet UNAMex, since it serves as an excellent initial channel to gather feedback from the first target user communities. This feedback will help the team not only understand the community’s perspective and challenges, but also validate the vision and adapt development efforts so that the framework provides the most useful capabilities.

Our team understands that OpenSMART is a tool with an ambitious design that will provide many cybersecurity capabilities. We are also aware that there are already other open source platforms that offer different cybersecurity tools. However, our goal is to build on the experience and lessons learned from the previous project and tool, SMART, taking into account how the sensor network was deployed, its limitations, and the current needs of the community, in order to turn it into a useful and open tool that can be adopted in a more flexible way.

Unlike the previous project, where the tool focused mostly on network monitoring and IDS-based detection, the new platform will include additional capabilities such as:

• Network traffic monitoring
• Traffic control (firewall)
• Traffic inspection and analysis: IDS (NG-IDS)
• Data analysis platform
• Open EDR (host-level security)
• VPN / tunneling
• Virtualization (VM/LXC/Docker)
• Application inventory and vulnerability management
• Honeypot technologies

Of course, the platform will make use of a set of well-known open source tools such as Suricata, Zeek, Arkime, ntop, Proxmox, Docker, T-Pot, and many more.

Deployment Modes

Our team introduced the five initial collaboration modes:

• Full Sensor: A full-stack monitoring sensor with a set of modules to inspect, control, and process security tool logs. This sensor can serve as an open cybersecurity solution across multiple layers, including network, host, and SIEM.
• Lite Sensor: A lighter version of the sensor that implements only a subset of the tooling available in the full version, depending on hardware capacity.
• Honeypot Sensor - Cluster Node: A sensor that implements honeypot modules and can join the new UNAMex honeypot network.
• Honeypot Sensor - Micro: A sensor based on a micro device such as a Raspberry Pi or mini PC with very limited hardware. Its purpose is to serve only as a traffic redirector to the UNAMex cluster for remote processing.
• Honeypot Sensor - NetDevice: This mode does not require a dedicated hardware sensor. Instead, it only requires traffic redirection directly from a network device (such as a router) to a UNAMex cluster endpoint for remote processing.

Collaboration

A very important point during the last part of the presentation was encouraging the community to participate either as beta testers, developers, or by helping expand the project’s network and visibility.

As an important follow-up in the coming months, our team at Honeynet UNAMex will organize more events, including workshops, training sessions, and conferences.

We will be sharing our upcoming plans and activities on our website. Stay in touch.

Acknowledgements

Honeynet UNAMex thanks Mtro. Oscar Alejandro Luna Cruz, an IT focal point from the Institute for Materials Research, for providing logistical support and offering the facilities for our first meetup.

We look forward to organizing future meetups in other locations, whether with former or new collaborators within the UNAM community.

Slides

Gallery