Obvious, but I'll mention it anyway...
Information gathered by a honeypot (or another system monitoring a honeypot or comms to/from a honeypot) can be used to initiate/control/inform security operations on another machine/virtual machine/network.
For instance, an attempt to access a honeypot could lead to the immediate blacklisting of the attackers IP address across all sites of an organization (involving multiple gateways/firewalls).Also, humans can be informed to mitigate false positives (the proof is always surpassed by the fool).
Another example is the use of a virtual honeypot to trigger the automatic forensic examination of the machine which contacts the honeypot. If this machine is within a controlled network, the traffic to/from the suspect machine can also be analysed.
I agree
No opinion
I disagree
Add your comment
Modern IDS systems already implement this. The honeypot aspect is not useful from a corporate perspective, but an active IDS is. Honeypots are great at security research tasks. Research and real defense are two very different things.
Corporations are not interested in performing research, but rather just want to defend the network. Taking a specific vendor as an example, Sourcefire (from the maintainer of Snort) have the RNA brand they sell for this task. Train the RNA server, and you can have automated responses to various threats. Frequently, that is all they want - to be aware of a potential attack, mitigate it, and have the log around in case future action is necessary.