For my personal use, i use T-POT like honeypot (https://github.com/telekom-security/tpotce).

i will share how to integrate t-pot into S1EM.

T-POT

Create a folder for a docker-compose of S1EM agent....

cd /opt/
git clone http://github.com/V1D1AN/S1EM-agent S1EM

to be continued .....