OpenCanary
OpenCanary
OpenCanary (Honeypot-Daemon)
OpenCanary is an open-source, lightweight honeypot daemon that poses as various network services and raises an alarm as soon as someone interacts with them. It works like an invisible tripwire trap in one's own network. Every touch is suspicious — and thus a valuable, low-false-positive signal.
History & facts. OpenCanary comes from Thinkst and is the open-source variant of the idea behind their commercial „Canary“ products. It resource-efficiently emulates services such as SSH, FTP, SMB or databases and reports every access. The decisive advantage: since no one should legitimately work with these baits, practically every interaction is a genuine alarm signal — unlike many detection systems that drown in false positives. Related are the „Canarytokens“, which apply the same principle to individual files or credentials (see Honeytoken).
Outlook & recommendation. OpenCanary is ideal for exposing attackers already moving within the network (lateral movement): a placed bait that an intruder inevitably touches reveals their presence early. The setup is lightweight, the insight value high. In the NEOSEC stack, OpenCanary is used together with Cowrie SSH/Telnet Honeypot (Cowrie) and connected to central evaluation, so that every bait hit immediately becomes a prioritised alarm in the Security Operations Center (SOC).