GreedyBear is a threat intelligence platform that consumes honeypot logs from T-Pot clusters (Cowrie, Heralding, Tanner, etc.), extracts Indicators of Compromise (IOCs), enriches them with external threat feeds (ThreatFox, AbuseIPDB, FireHol, Spamhaus, MalwareBazaar), and applies machine learning scoring (Random Forest) to predict recurrence probability and expected interactions. The system exposes public and authenticated APIs in multiple formats (JSON, NDJSON, CSV, TXT, STIX 2.1) for threat researchers and supports event ingestion from external sensors. The backend is built with Django/DRF, PostgreSQL, and Elasticsearch, orchestrated via Django-Q cronjobs for scheduled extraction, enrichment, and cleanup. A React SPA frontend provides a customizable dashboard with attack maps, trending attackers, and feed browsing. The architecture uses repository, strategy, and factory patterns, with a clean separation between extraction pipelines, scoring, and API layers. While primarily an application, it has strong data engineering components—ETL pipelines, ML scoring, clustering (MinHash LSH for command sequences), and data enrichment—making it a hybrid that leans application.