Lion Cipher Lab
Deploy a multi-service honeypot with OpenCanary
- SOC Analyst / Blue Team
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Most detections drown you in false alarms: a signature-based intrusion detection system (IDS) flags anything that merely looks suspicious, so analysts spend their day dismissing benign traffic. A honeypot inverts that economy. It is a decoy service with no legitimate purpose, so nobody in your organisation ever has a reason to touch it — which means a single connection is, by definition, unexpected. That makes an internal honeypot one of the highest-signal detections you can deploy: a hit is almost always an intruder moving laterally, or a serious misconfiguration, and almost never noise.…
What you'll learn
- why internal honeypots are high-signal detections
- deploying OpenCanary with Docker
- enabling fake services in opencanary.conf
- simulating an attacker against a decoy
- reading and interpreting honeypot alerts
- low- vs high-interaction honeypots
- where to place decoys and how to route alerts
Steps in this lab
- What OpenCanary is — and the one idea that makes it powerful
- Ground rules and where a honeypot belongs
- Get OpenCanary running in Docker
- Turn on a couple of fake services
- Be the attacker: knock on your own decoy
- Read the alert — and see the near-zero-false-positive idea for real
- Low- vs high-interaction: what you just experienced, and its limits
- Make the alert actionable — routing and tuning
- The pro way, and keep the discipline