[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EV25EM2RPAG82P3AYCDZS4":3,"skill-same:01M6EV25EM2RPAG82P3AYCDZS4":116},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":77,"commitSha":78,"skillDirectory":79,"forksCount":14,"repositoryHtmlUrl":80,"repositoryHomepageUrl":81,"ownerHtmlUrl":82,"ownerBlogUrl":6,"ownerDescription":83,"updatedAt":84,"install":85,"resources":98},"01M6EV25EM2RPAG82P3AYCDZS4","implementing-canary-tokens-for-network-intrusion",null,"Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure to detect unauthorized access and lateral movement. Integrates with webhook alerting (Slack, Teams, email, generic HTTP) for real-time intrusion notifications. Provides automated token generation, placement strategies, and monitoring for enterprise network environments. Use when building deception-based network intrusion detection with Canarytokens.org and Thinkst Canary platforms.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-canary-tokens-for-network-intrusion\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"tokens","network","implementing canary tokens for network intrusion","canary","webhook","cybersecurity","strategies","across","time","cm","access","api","t1078","canarytokens","intrusion-detection","dns","security-operations","notifications","monitoring","alerting","2026-11-10 10:12:30",false,"---\nname: implementing-canary-tokens-for-network-intrusion\ndescription: 'Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure\n  to detect unauthorized access and lateral movement. Integrates with webhook alerting\n  (Slack, Teams, email, generic HTTP) for real-time intrusion notifications. Provides\n  automated token generation, placement strategies, and monitoring for enterprise\n  network environments. Use when building deception-based network intrusion detection\n  with Canarytokens.org and Thinkst Canary platforms.\n\n  '\ndomain: cybersecurity\nsubdomain: security-operations\ntags:\n- canary-tokens\n- intrusion-detection\n- deception\n- network-security\n- honeytokens\n- breach-detection\nversion: '1.0'\nauthor: mukul975\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- RS.MA-01\n- GV.OV-01\n- DE.AE-02\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1021\n- T1550\n---\n\n# Implementing Canary Tokens for Network Intrusion Detection\n\n## When to Use\n\n- When deploying deception-based tripwires across network infrastructure to detect intrusions\n- When building early warning systems that alert on unauthorized access to sensitive resources\n- When planting fake AWS credentials, DNS beacons, or HTTP tokens to catch attackers during lateral movement\n- When integrating canary token alerts with SOC workflows via Slack, Microsoft Teams, or SIEM webhooks\n- When complementing traditional IDS\u002FIPS with zero-false-positive deception technology\n\n## Prerequisites\n\n- Python 3.8+ with `requests` library installed\n- Network access to canarytokens.org API (or self-hosted Canarytokens instance)\n- Webhook endpoint for alert delivery (Slack, Teams, email, or generic HTTP)\n- For Thinkst Canary enterprise: valid console domain and API auth token\n- Administrative access to target systems where tokens will be planted\n- Appropriate authorization for all deployment activities\n\n## Core Concepts\n\n### What Are Canary Tokens?\n\nCanary tokens are digital tripwires -- resources that should never be accessed during normal\noperations. When an attacker interacts with a canary token, it immediately triggers an alert\nwith near-zero false positives. Unlike signature-based detection, canary tokens detect\nattackers by their behavior (accessing bait resources) rather than matching known patterns.\n\n### Token Types for Network Intrusion Detection\n\n| Token Type | Trigger Mechanism | Best Placement | Detection Scenario |\n|------------|-------------------|----------------|-------------------|\n| DNS Token | DNS resolution of FQDN | Config files, scripts, internal docs | Attacker reads configs during recon |\n| HTTP Token | HTTP GET to unique URL | Internal wikis, bookmark files, HTML | Attacker browses internal resources |\n| AWS API Key | AWS API call with fake creds | `.aws\u002Fcredentials`, env files, repos | Attacker tests found credentials |\n| Cloned Site | Visit to cloned page | Internal portals, admin panels | Attacker accesses cloned services |\n| SVN Token | SVN checkout | Repository configs | Attacker clones repositories |\n| SQL Server | Database login attempt | Connection strings, config files | Attacker attempts DB access |\n\n### Alert Flow Architecture\n\n```\n[Attacker Action] --> [Token Triggered] --> [Canarytokens Server]\n                                                    |\n                                            [Webhook POST]\n                                                    |\n                          +-------------------------+-------------------------+\n                          |                         |                         |\n                    [Slack Alert]           [Email Alert]             [SIEM Ingestion]\n                          |                         |                         |\n                    [SOC Analyst]           [On-Call Page]           [Correlation Rule]\n```\n\n## Instructions\n\n### Step 1: Generate DNS Canary Tokens\n\nDNS tokens are the most versatile -- they trigger on any DNS resolution, even from\nair-gapped networks with only DNS egress. The token is an FQDN that, when resolved,\nalerts the token owner.\n\n```python\nimport requests\n\n# Create DNS canary token via Canarytokens.org\nresponse = requests.post(\"https:\u002F\u002Fcanarytokens.org\u002Fgenerate\", data={\n    \"type\": \"dns\",\n    \"email\": \"soc@company.com\",\n    \"memo\": \"Production database server - \u002Fetc\u002Fapp\u002Fdb.conf\",\n    \"webhook_url\": \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT...\u002FB...\u002Fxxx\"\n}, timeout=15)\n\ntoken_data = response.json()\ndns_hostname = token_data[\"hostname\"]\n# Example: abc123def456.canarytokens.com\n```\n\nPlant DNS tokens in locations attackers commonly inspect:\n- `\u002Fetc\u002Fhosts` entries pointing to the canary FQDN\n- Application configuration files (`database_host`, `backup_server`)\n- SSH config files (`~\u002F.ssh\u002Fconfig`) with canary hostnames\n- Internal DNS zone files as decoy A records\n- CI\u002FCD pipeline environment variables\n\n### Step 2: Deploy HTTP Canary Tokens\n\nHTTP tokens generate a unique URL that triggers on any HTTP request. They reveal the\nsource IP, User-Agent, and other HTTP headers of the requester.\n\n```python\n# Create HTTP token\nresponse = requests.post(\"https:\u002F\u002Fcanarytokens.org\u002Fgenerate\", data={\n    \"type\": \"http\",\n    \"email\": \"soc@company.com\",\n    \"memo\": \"Internal wiki - IT admin passwords page\",\n    \"webhook_url\": \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT...\u002FB...\u002Fxxx\"\n}, timeout=15)\n\nhttp_url = response.json()[\"url\"]\n# Embed in internal HTML pages, documents, or bookmark files\n```\n\nPlacement strategies for HTTP tokens:\n- Hidden `\u003Cimg>` tags in internal wiki pages with sensitive titles\n- URL shortener redirects in shared bookmark collections\n- Links in internal documentation labeled \"admin credentials\" or \"VPN configs\"\n- `.url` or `.webloc` shortcut files in network shares\n- Browser bookmark exports in user profile backups\n\n### Step 3: Create AWS API Key Tokens\n\nAWS key tokens are among the highest-fidelity canary tokens. They generate real-looking\nAWS access keys that trigger an alert whenever anyone attempts to use them against any\nAWS API endpoint.\n\n```python\n# Create AWS API key canary token\nresponse = requests.post(\"https:\u002F\u002Fcanarytokens.org\u002Fgenerate\", data={\n    \"type\": \"aws_keys\",\n    \"email\": \"soc@company.com\",\n    \"memo\": \"DevOps jump box - \u002Fhome\u002Fdeploy\u002F.aws\u002Fcredentials\",\n    \"webhook_url\": \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT...\u002FB...\u002Fxxx\"\n}, timeout=15)\n\naws_token = response.json()\naccess_key_id = aws_token[\"access_key_id\"]\nsecret_access_key = aws_token[\"secret_access_key\"]\n```\n\nDeploy the fake credentials:\n```ini\n# Place in ~\u002F.aws\u002Fcredentials on honeypot or jump servers\n[default]\naws_access_key_id = AKIAIOSFODNN7EXAMPLE\naws_secret_access_key = wJalrXUtnFEMI\u002FK7MDENG\u002FbPxRfiCYEXAMPLEKEY\nregion = us-east-1\n\n# Also plant in:\n# - .env files in code repositories\n# - Docker environment configurations\n# - Terraform state files (decoy)\n# - Jenkins\u002FCI credential stores\n```\n\n### Step 4: Configure Webhook Alert Integration\n\nSet up real-time alerting to your SOC through multiple channels:\n\n```python\n# Slack webhook integration\ndef send_slack_alert(webhook_url, alert_data):\n    \"\"\"Forward canary token alert to Slack channel.\"\"\"\n    payload = {\n        \"text\": f\":rotating_light: *Canary Token Triggered*\",\n        \"attachments\": [{\n            \"color\": \"#FF0000\",\n            \"fields\": [\n                {\"title\": \"Token Memo\", \"value\": alert_data.get(\"memo\", \"Unknown\"), \"short\": True},\n                {\"title\": \"Source IP\", \"value\": alert_data.get(\"src_ip\", \"Unknown\"), \"short\": True},\n                {\"title\": \"Token Type\", \"value\": alert_data.get(\"channel\", \"Unknown\"), \"short\": True},\n                {\"title\": \"Triggered At\", \"value\": alert_data.get(\"time\", \"Unknown\"), \"short\": True},\n            ],\n            \"footer\": \"Canarytokens Alert System\",\n        }]\n    }\n    requests.post(webhook_url, json=payload, timeout=10)\n```\n\n```python\n# Generic webhook receiver (Flask) for SIEM ingestion\nfrom flask import Flask, request, jsonify\nimport json, logging\n\napp = Flask(__name__)\nlogging.basicConfig(filename=\"\u002Fvar\u002Flog\u002Fcanary_alerts.json\", level=logging.INFO)\n\n@app.route(\"\u002Fcanary-webhook\", methods=[\"POST\"])\ndef receive_alert():\n    alert = request.json or request.form.to_dict()\n    logging.info(json.dumps({\n        \"event_type\": \"canarytoken_triggered\",\n        \"memo\": alert.get(\"memo\"),\n        \"src_ip\": alert.get(\"src_ip\"),\n        \"token_type\": alert.get(\"channel\"),\n        \"time\": alert.get(\"time\"),\n        \"manage_url\": alert.get(\"manage_url\"),\n        \"additional_data\": alert.get(\"additional_data\", {}),\n    }))\n    return jsonify({\"status\": \"received\"}), 200\n```\n\n### Step 5: Enterprise Deployment with Thinkst Canary API\n\nFor organizations using Thinkst Canary, leverage the API for mass deployment and\ncentralized management:\n\n```python\nimport canarytools\n\n# Connect to Thinkst Canary console\nconsole = canarytools.Console(\n    domain=\"yourcompany\",\n    api_key=\"your_api_auth_token\"\n)\n\n# Create tokens programmatically at scale\ntoken_types = {\n    \"dns\": \"DNS beacon in config files\",\n    \"aws-id\": \"AWS credentials on jump servers\",\n    \"http\": \"Web bug in internal documentation\",\n    \"doc-msword\": \"Word document in finance share\",\n    \"slack-api\": \"Fake Slack bot token in source code\",\n}\n\nfor kind, memo in token_types.items():\n    result = console.tokens.create(memo=memo, kind=kind)\n    print(f\"[+] Created {kind} token: {result}\")\n\n# Monitor for triggered alerts\nalerts = console.tokens.alerts()\nfor alert in alerts:\n    print(f\"[ALERT] {alert.memo} triggered from {alert.src_ip}\")\n```\n\n### Step 6: Token Placement Strategy by Network Zone\n\n**DMZ \u002F Public-Facing:**\n- HTTP tokens in admin panel login pages (hidden image tag)\n- DNS tokens in web server configuration files\n- AWS keys in `.env` files on staging servers\n\n**Internal Network \u002F Corporate:**\n- DNS tokens in Active Directory Group Policy scripts\n- AWS keys in developer workstation backup directories\n- HTTP tokens in internal SharePoint\u002FConfluence pages titled \"Emergency Credentials\"\n- Word document tokens in network shares (`\\\\fileserver\\IT\\passwords.docx`)\n\n**Production \u002F Data Center:**\n- DNS tokens in database configuration files\n- AWS keys in CI\u002FCD environment variables\n- SQL Server tokens in connection strings on application servers\n- SVN\u002FGit tokens in repository configuration files\n\n**Cloud Infrastructure:**\n- AWS key tokens in S3 bucket policies (decoy)\n- DNS tokens in CloudFormation\u002FTerraform templates\n- HTTP tokens in Lambda function environment variables\n- Cloned-site tokens mimicking cloud admin consoles\n\n## Examples\n\n### Full Deployment Script\n\n```python\n# Deploy a comprehensive canary token network\npython scripts\u002Fagent.py --action full_deploy \\\n    --email soc@company.com \\\n    --webhook https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT...\u002FB...\u002Fxxx \\\n    --output deployment_report.json\n```\n\n### Monitor Triggered Tokens\n\n```python\n# Check for triggered alerts\npython scripts\u002Fagent.py --action monitor \\\n    --console-domain yourcompany \\\n    --api-key YOUR_AUTH_TOKEN\n```\n\n### Generate Token Inventory\n\n```python\n# Create inventory of all deployed tokens\npython scripts\u002Fagent.py --action inventory \\\n    --output token_inventory.json\n```\n\n## Validation Checklist\n\n- [ ] DNS tokens resolve correctly and generate alerts within 60 seconds\n- [ ] HTTP tokens return a valid response and log source IP\n- [ ] AWS key tokens trigger alerts when used with `aws sts get-caller-identity`\n- [ ] Webhook alerts arrive in Slack\u002FTeams\u002FSIEM within acceptable latency\n- [ ] Token memo fields contain sufficient context for SOC triage\n- [ ] Deployment locations are documented in token inventory\n- [ ] Alert escalation procedures are defined and tested\n- [ ] Tokens do not interfere with legitimate operations\n- [ ] Self-hosted Canarytokens instance (if used) is hardened and monitored\n- [ ] Token rotation schedule is established (quarterly recommended)\n\n## References\n\n- Canarytokens Documentation: https:\u002F\u002Fdocs.canarytokens.org\u002Fguide\u002F\n- Thinkst Canary Platform: https:\u002F\u002Fcanary.tools\u002F\n- Thinkst Canary API: https:\u002F\u002Fdocs.canary.tools\u002Fcanarytokens\u002Factions.html\n- Canarytokens Open Source: https:\u002F\u002Fgithub.com\u002Fthinkst\u002Fcanarytokens\n- Zeltser Honeytoken Setup Guide: https:\u002F\u002Fzeltser.com\u002Fhoneytokens-canarytokens-setup\u002F\n- Grafana Canary Token Case Study: https:\u002F\u002Fgrafana.com\u002Fblog\u002F2025\u002F08\u002F25\u002Fcanary-tokens-learn-all-about-the-unsung-heroes-of-security-at-grafana-labs\u002F\n- AWS Infrastructure Canarytoken: https:\u002F\u002Fblog.thinkst.com\u002F2025\u002F09\u002Fintroducing-the-aws-infrastructure-canarytoken.html\n","# Implementing Canary Tokens for Network Intrusion Detection\n\n## When to Use\n\n- When deploying deception-based tripwires across network infrastructure to detect intrusions\n- When building early warning systems that alert on unauthorized access to sensitive resources\n- When planting fake AWS credentials, DNS beacons, or HTTP tokens to catch attackers during lateral movement\n- When integrating canary token alerts with SOC workflows via Slack, Microsoft Teams, or SIEM webhooks\n- When complementing traditional IDS\u002FIPS with zero-false-positive deception technology\n\n## Prerequisites\n\n- Python 3.8+ with `requests` library installed\n- Network access to canarytokens.org API (or self-hosted Canarytokens instance)\n- Webhook endpoint for alert delivery (Slack, Teams, email, or generic HTTP)\n- For Thinkst Canary enterprise: valid console domain and API auth token\n- Administrative access to target systems where tokens will be planted\n- Appropriate authorization for all deployment activities\n\n## Core Concepts\n\n### What Are Canary Tokens?\n\nCanary tokens are digital tripwires -- resources that should never be accessed during normal\noperations. When an attacker interacts with a canary token, it immediately triggers an alert\nwith near-zero false positives. Unlike signature-based detection, canary tokens detect\nattackers by their behavior (accessing bait resources) rather than matching known patterns.\n\n### Token Types for Network Intrusion Detection\n\n| Token Type | Trigger Mechanism | Best Placement | Detection Scenario |\n|------------|-------------------|----------------|-------------------|\n| DNS Token | DNS resolution of FQDN | Config files, scripts, internal docs | Attacker reads configs during recon |\n| HTTP Token | HTTP GET to unique URL | Internal wikis, bookmark files, HTML | Attacker browses internal resources |\n| AWS API Key | AWS API call with fake creds | `.aws\u002Fcredentials`, env files, repos | Attacker tests found credentials |\n| Cloned Site | Visit to cloned page | Internal portals, admin panels | Attacker accesses cloned services |\n| SVN Token | SVN checkout | Repository configs | Attacker clones repositories |\n| SQL Server | Database login attempt | Connection strings, config files | Attacker attempts DB access |\n\n### Alert Flow Architecture\n\n```\n[Attacker Action] --> [Token Triggered] --> [Canarytokens Server]\n                                                    |\n                                            [Webhook POST]\n                                                    |\n                          +-------------------------+-------------------------+\n                          |                         |                         |\n                    [Slack Alert]           [Email Alert]             [SIEM Ingestion]\n                          |                         |                         |\n                    [SOC Analyst]           [On-Call Page]           [Correlation Rule]\n```\n\n## Instructions\n\n### Step 1: Generate DNS Canary Tokens\n\nDNS tokens are the most versatile -- they trigger on any DNS resolution, even from\nair-gapped networks with only DNS egress. The token is an FQDN that, when resolved,\nalerts the token owner.\n\n```python\nimport requests\n\n# Create DNS canary token via Canarytokens.org\nresponse = requests.post(\"https:\u002F\u002Fcanarytokens.org\u002Fgenerate\", data={\n    \"type\": \"dns\",\n    \"email\": \"soc@company.com\",\n    \"memo\": \"Production database server - \u002Fetc\u002Fapp\u002Fdb.conf\",\n    \"webhook_url\": \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT...\u002FB...\u002Fxxx\"\n}, timeout=15)\n\ntoken_data = response.json()\ndns_hostname = token_data[\"hostname\"]\n# Example: abc123def456.canarytokens.com\n```\n\nPlant DNS tokens in locations attackers commonly inspect:\n- `\u002Fetc\u002Fhosts` entries pointing to the canary FQDN\n- Application configuration files (`database_host`, `backup_server`)\n- SSH config files (`~\u002F.ssh\u002Fconfig`) with canary hostnames\n- Internal DNS zone files as decoy A records\n- CI\u002FCD pipeline environment variables\n\n### Step 2: Deploy HTTP Canary Tokens\n\nHTTP tokens generate a unique URL that triggers on any HTTP request. They reveal the\nsource IP, User-Agent, and other HTTP headers of the requester.\n\n```python\n# Create HTTP token\nresponse = requests.post(\"https:\u002F\u002Fcanarytokens.org\u002Fgenerate\", data={\n    \"type\": \"http\",\n    \"email\": \"soc@company.com\",\n    \"memo\": \"Internal wiki - IT admin passwords page\",\n    \"webhook_url\": \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT...\u002FB...\u002Fxxx\"\n}, timeout=15)\n\nhttp_url = response.json()[\"url\"]\n# Embed in internal HTML pages, documents, or bookmark files\n```\n\nPlacement strategies for HTTP tokens:\n- Hidden `\u003Cimg>` tags in internal wiki pages with sensitive titles\n- URL shortener redirects in shared bookmark collections\n- Links in internal documentation labeled \"admin credentials\" or \"VPN configs\"\n- `.url` or `.webloc` shortcut files in network shares\n- Browser bookmark exports in user profile backups\n\n### Step 3: Create AWS API Key Tokens\n\nAWS key tokens are among the highest-fidelity canary tokens. They generate real-looking\nAWS access keys that trigger an alert whenever anyone attempts to use them against any\nAWS API endpoint.\n\n```python\n# Create AWS API key canary token\nresponse = requests.post(\"https:\u002F\u002Fcanarytokens.org\u002Fgenerate\", data={\n    \"type\": \"aws_keys\",\n    \"email\": \"soc@company.com\",\n    \"memo\": \"DevOps jump box - \u002Fhome\u002Fdeploy\u002F.aws\u002Fcredentials\",\n    \"webhook_url\": \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT...\u002FB...\u002Fxxx\"\n}, timeout=15)\n\naws_token = response.json()\naccess_key_id = aws_token[\"access_key_id\"]\nsecret_access_key = aws_token[\"secret_access_key\"]\n```\n\nDeploy the fake credentials:\n```ini\n# Place in ~\u002F.aws\u002Fcredentials on honeypot or jump servers\n[default]\naws_access_key_id = AKIAIOSFODNN7EXAMPLE\naws_secret_access_key = wJalrXUtnFEMI\u002FK7MDENG\u002FbPxRfiCYEXAMPLEKEY\nregion = us-east-1\n\n# Also plant in:\n# - .env files in code repositories\n# - Docker environment configurations\n# - Terraform state files (decoy)\n# - Jenkins\u002FCI credential stores\n```\n\n### Step 4: Configure Webhook Alert Integration\n\nSet up real-time alerting to your SOC through multiple channels:\n\n```python\n# Slack webhook integration\ndef send_slack_alert(webhook_url, alert_data):\n    \"\"\"Forward canary token alert to Slack channel.\"\"\"\n    payload = {\n        \"text\": f\":rotating_light: *Canary Token Triggered*\",\n        \"attachments\": [{\n            \"color\": \"#FF0000\",\n            \"fields\": [\n                {\"title\": \"Token Memo\", \"value\": alert_data.get(\"memo\", \"Unknown\"), \"short\": True},\n                {\"title\": \"Source IP\", \"value\": alert_data.get(\"src_ip\", \"Unknown\"), \"short\": True},\n                {\"title\": \"Token Type\", \"value\": alert_data.get(\"channel\", \"Unknown\"), \"short\": True},\n                {\"title\": \"Triggered At\", \"value\": alert_data.get(\"time\", \"Unknown\"), \"short\": True},\n            ],\n            \"footer\": \"Canarytokens Alert System\",\n        }]\n    }\n    requests.post(webhook_url, json=payload, timeout=10)\n```\n\n```python\n# Generic webhook receiver (Flask) for SIEM ingestion\nfrom flask import Flask, request, jsonify\nimport json, logging\n\napp = Flask(__name__)\nlogging.basicConfig(filename=\"\u002Fvar\u002Flog\u002Fcanary_alerts.json\", level=logging.INFO)\n\n@app.route(\"\u002Fcanary-webhook\", methods=[\"POST\"])\ndef receive_alert():\n    alert = request.json or request.form.to_dict()\n    logging.info(json.dumps({\n        \"event_type\": \"canarytoken_triggered\",\n        \"memo\": alert.get(\"memo\"),\n        \"src_ip\": alert.get(\"src_ip\"),\n        \"token_type\": alert.get(\"channel\"),\n        \"time\": alert.get(\"time\"),\n        \"manage_url\": alert.get(\"manage_url\"),\n        \"additional_data\": alert.get(\"additional_data\", {}),\n    }))\n    return jsonify({\"status\": \"received\"}), 200\n```\n\n### Step 5: Enterprise Deployment with Thinkst Canary API\n\nFor organizations using Thinkst Canary, leverage the API for mass deployment and\ncentralized management:\n\n```python\nimport canarytools\n\n# Connect to Thinkst Canary console\nconsole = canarytools.Console(\n    domain=\"yourcompany\",\n    api_key=\"your_api_auth_token\"\n)\n\n# Create tokens programmatically at scale\ntoken_types = {\n    \"dns\": \"DNS beacon in config files\",\n    \"aws-id\": \"AWS credentials on jump servers\",\n    \"http\": \"Web bug in internal documentation\",\n    \"doc-msword\": \"Word document in finance share\",\n    \"slack-api\": \"Fake Slack bot token in source code\",\n}\n\nfor kind, memo in token_types.items():\n    result = console.tokens.create(memo=memo, kind=kind)\n    print(f\"[+] Created {kind} token: {result}\")\n\n# Monitor for triggered alerts\nalerts = console.tokens.alerts()\nfor alert in alerts:\n    print(f\"[ALERT] {alert.memo} triggered from {alert.src_ip}\")\n```\n\n### Step 6: Token Placement Strategy by Network Zone\n\n**DMZ \u002F Public-Facing:**\n- HTTP tokens in admin panel login pages (hidden image tag)\n- DNS tokens in web server configuration files\n- AWS keys in `.env` files on staging servers\n\n**Internal Network \u002F Corporate:**\n- DNS tokens in Active Directory Group Policy scripts\n- AWS keys in developer workstation backup directories\n- HTTP tokens in internal SharePoint\u002FConfluence pages titled \"Emergency Credentials\"\n- Word document tokens in network shares (`\\\\fileserver\\IT\\passwords.docx`)\n\n**Production \u002F Data Center:**\n- DNS tokens in database configuration files\n- AWS keys in CI\u002FCD environment variables\n- SQL Server tokens in connection strings on application servers\n- SVN\u002FGit tokens in repository configuration files\n\n**Cloud Infrastructure:**\n- AWS key tokens in S3 bucket policies (decoy)\n- DNS tokens in CloudFormation\u002FTerraform templates\n- HTTP tokens in Lambda function environment variables\n- Cloned-site tokens mimicking cloud admin consoles\n\n## Examples\n\n### Full Deployment Script\n\n```python\n# Deploy a comprehensive canary token network\npython scripts\u002Fagent.py --action full_deploy \\\n    --email soc@company.com \\\n    --webhook https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT...\u002FB...\u002Fxxx \\\n    --output deployment_report.json\n```\n\n### Monitor Triggered Tokens\n\n```python\n# Check for triggered alerts\npython scripts\u002Fagent.py --action monitor \\\n    --console-domain yourcompany \\\n    --api-key YOUR_AUTH_TOKEN\n```\n\n### Generate Token Inventory\n\n```python\n# Create inventory of all deployed tokens\npython scripts\u002Fagent.py --action inventory \\\n    --output token_inventory.json\n```\n\n## Validation Checklist\n\n- [ ] DNS tokens resolve correctly and generate alerts within 60 seconds\n- [ ] HTTP tokens return a valid response and log source IP\n- [ ] AWS key tokens trigger alerts when used with `aws sts get-caller-identity`\n- [ ] Webhook alerts arrive in Slack\u002FTeams\u002FSIEM within acceptable latency\n- [ ] Token memo fields contain sufficient context for SOC triage\n- [ ] Deployment locations are documented in token inventory\n- [ ] Alert escalation procedures are defined and tested\n- [ ] Tokens do not interfere with legitimate operations\n- [ ] Self-hosted Canarytokens instance (if used) is hardened and monitored\n- [ ] Token rotation schedule is established (quarterly recommended)\n\n## References\n\n- Canarytokens Documentation: https:\u002F\u002Fdocs.canarytokens.org\u002Fguide\u002F\n- Thinkst Canary Platform: https:\u002F\u002Fcanary.tools\u002F\n- Thinkst Canary API: https:\u002F\u002Fdocs.canary.tools\u002Fcanarytokens\u002Factions.html\n- Canarytokens Open Source: https:\u002F\u002Fgithub.com\u002Fthinkst\u002Fcanarytokens\n- Zeltser Honeytoken Setup Guide: https:\u002F\u002Fzeltser.com\u002Fhoneytokens-canarytokens-setup\u002F\n- Grafana Canary Token Case Study: https:\u002F\u002Fgrafana.com\u002Fblog\u002F2025\u002F08\u002F25\u002Fcanary-tokens-learn-all-about-the-unsung-heroes-of-security-at-grafana-labs\u002F\n- AWS Infrastructure Canarytoken: https:\u002F\u002Fblog.thinkst.com\u002F2025\u002F09\u002Fintroducing-the-aws-infrastructure-canarytoken.html\n",{"name":5,"tags":57,"author":63,"domain":37,"license":15,"version":64,"nist_csf":65,"subdomain":48,"description":70,"mitre_attack":71},[58,46,59,60,61,62],"canary-tokens","deception","network-security","honeytokens","breach-detection","mukul975","1.0",[66,67,68,69],"DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02","Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure to detect unauthorized access and lateral movement. Integrates with webhook alerting (Slack, Teams, email, generic HTTP) for real-time intrusion notifications. Provides automated token generation, placement strategies, and monitoring for enterprise network environments. Use when building deception-based network intrusion detection with Canarytokens.org and Thinkst Canary platforms.\n",[72,73,74,75,76],"T1078","T1190","T1059","T1021","T1550","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fimplementing-canary-tokens-for-network-intrusion","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":86,"prompt":96,"zipAvailable":97},[87,90,93],{"tool":88,"command":89},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill implementing-canary-tokens-for-network-intrusion",{"tool":91,"command":92},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill implementing-canary-tokens-for-network-intrusion",{"tool":94,"command":95},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill implementing-canary-tokens-for-network-intrusion","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-canary-tokens-for-network-intrusion\u002FSKILL.md",true,[99,104,110],{"path":100,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-canary-tokens-for-network-intrusion\u002FLICENSE",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fapi-reference.md","REFERENCE","参考文档",6001,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-canary-tokens-for-network-intrusion\u002Freferences\u002Fapi-reference.md",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fagent.py","SCRIPT","脚本",34194,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-canary-tokens-for-network-intrusion\u002Fscripts\u002Fagent.py",[117,156,165,174,196,223],{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":136,"publishedAt":52},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[124,127,130,133],{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":131,"categoryName":132,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":134,"categoryName":135,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000034","行政与办公人员",[119,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":157,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":164,"publishedAt":52},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[160,161,162,163],{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":131,"categoryName":132,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":134,"categoryName":135,"taxonomyType":29,"taxonomyTypeDesc":30},[119,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155],{"skillNo":166,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":173,"publishedAt":52},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[169,170,171,172],{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":131,"categoryName":132,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":134,"categoryName":135,"taxonomyType":29,"taxonomyTypeDesc":30},[119,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155],{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":180,"publishedAt":52},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[181,182,183,184,185,186,187,188,189,190,191,192,193,194,195],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":205,"publishedAt":52},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[202],{"categoryNo":203,"categoryName":204,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[206,207,208,209,210,211,212,213,214,215,216,148,149,217,218,219,220,38,221,222],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","scenario","stress",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":239,"publishedAt":52},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[229,232,235,236],{"categoryNo":230,"categoryName":231,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":233,"categoryName":234,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":203,"categoryName":204,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":237,"categoryName":238,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000036","内容创作者",[240,241,242,243,244,245,246,247,145,42,148,149,150,248,249,250,251,252,195,253],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","proposals","Academic","requirements","formatting","journal","chi"]