We've been hacked for the 2nd time without knowing how/who did it. Luckily we were able to shutdown everything!
We're trying to deploy Honeypot to be in control of what is going on from our local and global connections. but I've few concerns.
Any security expertise please!
A Honeypot will not control connections, so if that is what you want then you are not looking at the right technology.
Honeypots emulate real systems, so unless you actively prevent it, it will be able to attack other systems, exactly as if it was a real system.
This site has other questions in setting up honeypots, so just have a read of them.
To answer your question on security of honeypots a little further:
I'm currently writing my theses on honeypots - security-risks of honeypot systems are a big issue. A honeypot should never be run in reach of a production system. Set up in its own VM, cut all outgoing traffic via a firewall. Most open source low interaction honeypot systems, like Artillery, are considered secure. But as is with every software, there is no such thing as a guarantee for being bug free.
High interaction honeypots tend to be more vulnerable than low interaction systems, which is e.g. why Cowrie states in its FAQ on the Question "Is Cowrie secure?" a 'maybe'. Unless you know exactly what you are doing, I would really recommend not to run something like cowrie on a production system. Artillery can be used, though, I think. It is not the best practice, of course.
www.nestle.de is a good example for a low-interaction honeypot. Portscan it, you will see a service jungle like never before.
If you have any questions, feel free to ask. I'm happy to have more practical problems as input on for my thesis!
We've been hacked...", my first question is: How do you know you have been hacked? Sometimes what it seems like a "hacked" system may be just infected by some malware, etc. Can you describe what you mean by "hacked" please?