skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-deception-based-detection-with-canarytoken

Deploy and monitor Canary Tokens via the Thinkst Canary API for deception-based breach detection.

954|172|Updated Mar 13, 2026
Search Tags:#early warning#breach detection#deception#tripwire#honeytokens#canarytoken#thinkst canary
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-deception-based-detection-with-canarytoken
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-deception-based-detection-with-canarytoken
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/deception-technology/implementing-deception-based-detection-with-canarytoken
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-deception-based-detection-with-canarytoken

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests.

What problem does it solve?

Security teams often lack early-warning signals when attackers move laterally through internal systems. This Skill deploys lightweight tripwire tokens that alert the moment an attacker touches a decoy resource, providing deception-based breach detection without heavy infrastructure.

Core Features & Use Cases

  • Token Creation via Thinkst Canary API: Programmatically create web bug (HTTP) tokens, DNS tokens, MS Word document tokens, and AWS API key tokens.
  • Alert Monitoring: List active tokens, query trigger history, and retrieve recent alert events from the Canary Console.
  • Coverage Reporting: Generate JSON deception coverage reports with deployment recommendations across network segments.
  • Use Case: A security engineer seeds decoy AWS credentials in .aws/credentials files and document tokens on file shares, then verifies each token fires correctly and that alerts reach the monitored channel.

Quick Start

Use the canarytoken skill to create a DNS token and an AWS key token, deploy them to the file share, and show me any triggered alerts.

Frequently Asked Questions about implementing-deception-based-detection-with-canarytoken

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create Canary Tokens with the Thinkst Canary API?▼

Authenticate to the Canary Console API with your auth token, then call the token creation endpoints for web bugs, DNS tokens, MS Word documents, or AWS keys. Each token returns a unique hostname, URL, or file you deploy to the target location.

What types of Canary Tokens can I deploy for breach detection?▼

This skill supports web bug (HTTP) tokens for embedding in pages and documents, DNS tokens for monitoring resolution attempts, MS Word document tokens for file shares, and AWS API key tokens that alert when used.

Why is my Canary Token not triggering an alert?▼

Common causes include blocked DNS or HTTP egress preventing the callback, DLP or Office sanitizers stripping the embedded web bug, or the token being placed where attackers never look. Trip the token yourself and verify the alert reaches the console.

Where should I place honeytokens for best detection coverage?▼

Place tokens where lateral movement actually lands: file shares, .aws/credentials files, browser history, and config repositories. Name them like genuine bait such as AWS_prod_keys.txt rather than obvious trap names.

What do I need to use the Thinkst Canary API for token deployment?▼

You need a Thinkst Canary Console or canarytokens.org account, an API auth token from the console, Python 3.9+ with the requests library, and file system access for deploying document and file tokens.

Related Skills

Explore More Software Engineering Skills→
starwreckntxstarwreckntx

Reconnaissance Agent

Perform network reconnaissance to map topology and enumerate ports and services.

Community
Basic
GhostPWNGhostPWN
4

CSOC Operations & Playbook Automation

Automate SOC alert triage and shift reporting with Python scripts.

Official
Advanced
starwreckntxstarwreckntx

Intrusion Detection Agent

Detect intrusions by correlating alerts and analyzing attack patterns in networked environments.

Community
Basic
DCx7C5DCx7C5

SKILL.md-

Deploy honeypots, honeytokens, and canaries to detect attacker activity.

Community
Advanced