Build Your Own CanaryToken Server - CanaryToken

Join me as we use docker to spin up our very own CanaryToken server. Deploy some tripwires to detect malicious intent on your network! Join me as we explore and learn together.
Defend with us on Slack: bit.ly/2Pi1byt
Check us out: www.opensecure...
Interact with our demo: www.opensecure...
Hire us: www.opensecure...

[@andrewhartnett7033]

Great tutorial. Thank you. Three is a new log4j cananry token but it does not seem to work :(

[@sayankumardey6826]

Getting this error while running docker-compose up "Required setting WG_PRIVATE_KEY_SEED not defined in a *.env file"

[@taylorwalton_socfortress]

Check step 6 under “Setup” github.com/thinkst/canarytokens-docker

[@davidgajic6253]

Is there any way of feeding this into a SIEM as opposed to receiving email alerts?

[@taylorwalton_socfortress]

Hey David, yes you can. You will need to install a wazuh agent onto the canary token server and forward the json file where canary token writes its alerts to. You will then need to create a decoder so that the wazuh manager can parse these logs. the decoder file is on the wazuh manager under /var/ossec/etc/decooders/local_decoder.xml. input the below:
^\S+ \S+ [HTTPChannel,
'src_ip': '(\d+.\d+.\d+.\d+), (\d+.\d+.\d+.\d+)', 'useragent': '(\.*)', 'referer': '(\.*)', 'location': '(\.*)'
ip1,ip2,ua,ref,loc
and restart the wazuh-manager.
Let me know if you have anymore questions and thanks for watching!

[@gittin_funky]

@@taylorwalton_socfortress Is it possible to see the web beacon code that is used in a canary token so I could add that to other document types?

[@krolokek]

Can i setup these using my own smtp server? How can i do this?)

[@Ecrfour]

Yes you can, detailed here: github.com/thinkst/canarytokens/pull/23

[@RsforLf]

Is it safe?