Thinkst Canary
By presenting itself as an apparently benign and legitimate service(s), the Canary draws the attention of unwanted activity. When someone trips one of the Canary's triggers, an alert is sent to notify the responsible parties so that action can be taken before valubale systems in your network are compromised.
- Category
- Deception & Breach Simulation
- Pack
- ThinkstCanary
Configuration parameters
- server — Canary Server URL (e.g., https://***.canary.tools) (required)
- auth_token — API Authentication Token
- authentication_token —
- insecure — Trust any certificate (not secure)
- proxy — Use system proxy settings
- isFetch — Fetch incidents
- fetchDelta — First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
- incidentType — Incident type
- incidentFetchInterval — Incidents Fetch Interval
Commands (6)
- canarytools-check-whitelist — Checks whether a given IP address and port are on allow list.
- canarytools-edit-alert-status — Edits the status for an alert in Canary Tools.
- canarytools-get-token — Fetches a Canary Token file from the Canary Tools server.
- canarytools-list-canaries — Lists all registered Canaries.
- canarytools-list-tokens — Lists all Canary tokens.
- canarytools-whitelist-ip — Adds an IP address to the allow list in Canary.