08
DECEPTION LAYER
6
Honeypots
10
Canary Tokens
6
Triggered
2,116
Interactions
HONEYPOTS
ssh-honeypot-dmz-01
ACTIVEType
SSH
Interactions
1247
Location
DMZ Network
Last activity: 30m ago
http-decoy-api-01
TRIGGEREDType
HTTP
Interactions
89
Location
Production VPC
Last activity: 1h ago
smb-share-finance-decoy
ACTIVEType
SMB
Interactions
34
Location
Corporate Network
Last activity: 3h ago
rdp-server-admin-decoy
ACTIVEType
RDP
Interactions
567
Location
Management VLAN
Last activity: 3h ago
mysql-db-customers-decoy
TRIGGEREDType
DATABASE
Interactions
23
Location
Data Tier
Last activity: 6h ago
rest-api-internal-decoy
ACTIVEType
API
Interactions
156
Location
Internal API Gateway
Last activity: 4h ago
CANARY TOKENS
| Status | Type | Name | Location | Triggered At | Triggered By |
|---|---|---|---|---|---|
| TRIGGERED | FILE | passwords.xlsx | /share/finance/confidential/ | 2h ago | workstation-finance-04 |
| TRIGGERED | CREDENTIAL | svc-backup-01 | Active Directory | 1h ago | unknown-external |
| ARMED | AWS KEY | AKIA...DECOY01 | .env file on ec2-dev-workstation-07 | -- | -- |
| TRIGGERED | DNS | internal-api.corp.local | DNS Zone | 3h ago | dns-resolver-01 |
| ARMED | URL | admin-panel-backup.html | /var/www/html/ | -- | -- |
| TRIGGERED | FILE | customer_export_2026.csv | /data/exports/ | 6h ago | svc-account-etl-reader |
| ARMED | CREDENTIAL | admin-break-glass | Password Manager | -- | -- |
| ARMED | AWS KEY | AKIA...DECOY02 | GitHub commit history | -- | -- |
| ARMED | FILE | ssh_keys_backup.tar.gz | /home/admin/.ssh/ | -- | -- |
| ARMED | DNS | staging-db.internal | DNS Zone | -- | -- |