skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-network-deception-with-honeypots

Deploy and configure network honeypots to detect lateral movement and unauthorized access.

954|172|Updated Mar 13, 2026
Search Tags:#honeypot#lateral movement#intrusion detection#deception#opencanary#cowrie#t-pot
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-network-deception-with-honeypots
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-network-deception-with-honeypots
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/deception-technology/implementing-network-deception-with-honeypots
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-network-deception-with-honeypots

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Internal networks often lack early-warning detection for attackers who have bypassed perimeter defenses, leaving lateral movement, credential theft, and internal reconnaissance invisible until damage is done.

Core Features & Use Cases

  • Honeypot Deployment Guidance: Step-by-step workflow for installing and configuring OpenCanary, Cowrie, or T-Pot on dedicated Linux hosts with emulated SSH, HTTP, SMB, FTP, and RDP services.
  • Alerting & SIEM Integration: Instructions for forwarding honeypot logs via syslog or webhooks to Splunk or Elastic so every interaction triggers a detection rule.
  • Misconfiguration Avoidance: Covers common failures such as monitor-only deployments, fingerprintable default banners, and poor network placement off the attack path.
  • Use Case: A security engineer places a Cowrie SSH honeypot inside a production VLAN; when an attacker attempts a credentialed login during lateral movement, the SIEM fires an alert capturing source IP, credentials used, and commands executed.

Quick Start

Ask the AI to walk you through deploying an OpenCanary honeypot on an Ubuntu server with SSH and SMB services enabled and alerts forwarded to your SIEM.

Frequently Asked Questions about implementing-network-deception-with-honeypots

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I deploy a honeypot to detect lateral movement?▼

Install OpenCanary, Cowrie, or T-Pot on a dedicated Linux host placed inside network segments where lateral movement occurs. Enable emulated services like SSH, SMB, and RDP, then forward logs to your SIEM so any interaction triggers an alert.

OpenCanary vs Cowrie vs T-Pot: which honeypot should I use?▼

OpenCanary is a lightweight Python daemon with modular service emulation, Cowrie is a medium-interaction SSH/Telnet honeypot that records attacker commands, and T-Pot is an all-in-one multi-honeypot platform with ELK stack visualization.

How do I integrate honeypot alerts with Splunk or Elastic?▼

Configure log forwarding from the honeypot using syslog, webhooks, or file-based shipping to your SIEM. Verify the integration by generating a test interaction and confirming a detection rule fires with correct source IP and service details.

Why is my honeypot only capturing internet background noise?▼

Honeypots placed on isolated VLANs or exposed to the internet mostly see mass scanner traffic. Move decoys into internal segments where real lateral movement happens and tune out known scanner ranges so credentialed login attempts stand out.

How do attackers detect and avoid honeypots?▼

Default configurations like Cowrie's hostname svr04 or T-Pot's canonical banner set are trivially fingerprintable. Customize banners, hostnames, and filesystem contents away from known defaults so attackers cannot identify the decoy.

Related Skills

Explore More Software Engineering Skills→
0x0pointer0x0pointer
13

network-assess

Map internal networks and enumerate hosts, services, and VLANs with network tools.

Official
Advanced
starwreckntxstarwreckntx

Intrusion Detection Agent

Detect intrusions by correlating alerts and analyzing attack patterns in networked environments.

Community
Basic
DCx7C5DCx7C5

SKILL.md-

Deploy honeypots, honeytokens, and canaries to detect attacker activity.

Community
Advanced
benchflow-aibenchflow-ai
317

suricata-rules-basics

Construct Suricata network intrusion detection signatures with sticky buffers and DPI logic.

Official
Intermediate