thinkst/opencanary
Opencanary
OpenCanary is a network service simulator and honeypot designed for network intrusion detection. It functions as a security decoy that creates fake server personalities and open ports to identify unauthorized users scanning a private network.
The system uses deception technology to mimic various server protocols, luring attackers into revealing their presence and activity. When a simulated service is accessed, it acts as an intrusion alerting gateway, transmitting notifications via email or webhooks.
The project covers internal network monitoring and intrusion source tracking to identify the location of security breaches. It utilizes a plugin-based architecture for service personalities and supports containerized deployment for consistent execution across different operating systems.
Features
- Service Emulators - Mimics common network protocols through fake socket listeners to lure and identify unauthorized traffic.
- Service Honeypots - Functions as a service honeypot that emulates network protocols to detect unauthorized scanning.
- Service Network Mocks - Provides simulated network listeners and target groups to identify intruders scanning the network.
- Deceptive Service Mocks - Mimics various server personalities to attract unauthorized users and identify their activity.
- Security Access Alerts - Sends immediate security-critical access alerts via email or webhooks upon detection of an intruder.
- Packet Source Identifiers - Captures the remote network addresses of incoming packets to identify the source of a breach.
- Network Deception Technologies - Employs deception technology by creating simulated server personalities to trick attackers into revealing themselves.
- Network Intrusion Detection - Detects unauthorized network access by alerting administrators when fake services are interacted with.
- Decoy Services - Acts as a specialized decoy service designed to lure attackers and record their activity in a sandbox.
- Plugin-Based Architectures - Uses a modular plugin architecture to define different server personalities and their responses to intruders.
- Event-Driven Notification Triggers - Triggers immediate security notifications via webhooks or email when simulated services are accessed.
- Intrusion Source Monitoring - Tracks interactions with simulated services to identify the specific source and location of security breaches.
- Containerized Deployments - Provides a containerized environment to ensure consistent deployment of security decoys across different operating systems.
- Deceptive Protocol Configurations - Allows the definition of specific network protocols and ports to simulate for the purpose of identifying intruders.
- Alerting Integrations - Integrates with external notification services like webhooks and email to deliver breach alerts.
- Network Alerting Systems - Serves as a backend triggering system that notifies external platforms when security risks are detected.
- Security Lab Environments - Deception tool for detecting unauthorized network activity.
