How does the alerting system work?

The skill integrates with webhooks to send real-time notifications to Slack, Microsoft Teams, or your SIEM the moment a token is triggered by an intruder.

What types of canary tokens can this skill deploy?

This skill supports the deployment of DNS, HTTP, AWS API keys, SQL server tokens, and SVN tokens to act as digital tripwires across your infrastructure.

Where are the best places to plant these tokens?

Recommended locations include application configuration files, environment variables, internal wikis, database connection strings, and network shares.

Do I need a paid Thinkst Canary subscription?

No, this skill is compatible with both the free Canarytokens.org open-source service and the enterprise Thinkst Canary platform.

Are there many false positives with canary tokens?

Canary tokens are known for having near-zero false positives because they are placed in locations that legitimate users should never access during normal operations.

Canary Token Network Intrusion Detection

Name: Canary Token Network Intrusion Detection
Author: micsapp

bymicsapp

0•

Seguridad y Pruebas

Deploys DNS, HTTP, and AWS API key canary tokens to detect unauthorized network access and lateral movement with zero-false-positive alerts.

This skill enables security teams to implement deception-based security by planting digital tripwires throughout their network infrastructure. It automates the generation and placement of various token types—including DNS beacons, HTTP URLs, and fake AWS credentials—that alert administrators via webhooks the moment an intruder interacts with them. Designed for integration with Canarytokens.org and Thinkst Canary platforms, it provides a high-fidelity early warning system that complements traditional monitoring by detecting attacker behavior during the reconnaissance and lateral movement phases of a breach.

Características Principales

010 GitHub stars

02Real-time alerting via Slack, Microsoft Teams, and custom webhooks

03Enterprise-scale management via Thinkst Canary API integration

04Automated generation of DNS, HTTP, and AWS API key tokens

05High-fidelity detection based on behavioral deception technology

06Strategic placement guidance for DMZ, production, and cloud zones

Casos de Uso

01Monitoring for lateral movement across air-gapped or segmented network zones

02Catching attackers during internal reconnaissance in enterprise networks

03Identifying unauthorized access to sensitive configuration files or credentials

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills implementing-canary-tokens-for-network-intrusion

For use in Claude.ai and ChatGPT

Características Principales

010 GitHub stars

02Real-time alerting via Slack, Microsoft Teams, and custom webhooks

03Enterprise-scale management via Thinkst Canary API integration

04Automated generation of DNS, HTTP, and AWS API key tokens

05High-fidelity detection based on behavioral deception technology

06Strategic placement guidance for DMZ, production, and cloud zones

Casos de Uso

01Monitoring for lateral movement across air-gapped or segmented network zones

02Catching attackers during internal reconnaissance in enterprise networks

03Identifying unauthorized access to sensitive configuration files or credentials

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills implementing-canary-tokens-for-network-intrusion

For use in Claude.ai and ChatGPT