OpenCanary
Free · OSSDeception
Tripwire services that should never be touched — any touch is an intruder.
OpenCanary homepage ↗A tripwire daemon. Fakes services (SSH, HTTP, MySQL) that should never get touched on your network — any connection attempt is high-confidence intruder, with zero false positives.
Code complete and exposed in the dashboard, but rough edges remain. Do not pin compliance claims to this pack.
What it watches
- Connection attempts to fake services (SSH, HTTP, MySQL, RDP, SMB)
- Credential attempts against the decoys
- Port-scan + service-enumeration hits
- Source IP + first-seen of the prober
MITRE ATT&CK coverage
Tactics this connector gives CyberCLI visibility into.
Every alert this connector surfaces
2 event types
Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix.
The right column shows the operator-friendly phrase the dashboard renders. High-severity
AI-lane signals are summarized in What it watches above (Warden + Herald
handle those); the rest take the substrate's passthrough lane (no AI tokens burned).
| event_type | dashboard renders |
|---|---|
| opencanary_system | Honeypot interaction on opencanary |
| opencanary_ssh_connect | Honeypot interaction on opencanary |
What it helps you catch
What you'd see in CyberCLI
illustrativeDecoy SMB share touched by internal host FILESRV-2
- src
- 10.0.0.88 · FILESRV-2
- decoy
- FAKE-FINANCE-SHARE
- service
- SMB
- creds
- tried admin / admin
Routed to Warden (triage) → Knight (detection) → Herald (notify)
Suggested Isolate the source host · hunt lateral movement (needs approval)
⛓ every step hash-chained · replayable
What CyberCLI reads from OpenCanary
audit our mathOpenCanary is a tripwire — every event is by definition someone touching a service that should never be touched. The 36 fields we read carry attacker identity (src_ip/src_port), the faked service hit (dst_ip/dst_port + event_type from the upstream logtype enum), and the interaction promoted out of logdata: attempted_username/password, http_method/path, user_agent, smb_version, snmp_community, redis_cmd, git_repo, banner exchanges. Signal policy splits per family — auth/login/db hit rule_level=7, banner/connect/portscan stay notice, the daemon's own system messages observe-only.
Full field index · 36 fields ↓
.action.agent_name.attempted_password.attempted_username.auth_domain.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_wire_format.dst_ip.dst_port.event_id.event_time_local.event_time_raw.event_timestamp.event_type.file_name.git_repo.host_id.http_method.http_path.local_banner.logdata.logtype.redis_cmd.remote_banner.requested_hostname.rule_level.smb_version.snmp_community.src_ip.src_port.tcpbanner_banner_id.tcpbanner_data.tcpbanner_function.user_agent MITRE techniques typically mapped
Trust Ladder ceiling · L0 → L3
- ·L0–L2: digest the tripwire hit, notify Herald immediately (zero-false-positive class), summarize the interaction for the case
- ·L3 (Knight verification): reputation lookup on src_ip, pivot to concurrent Wazuh/UniFi/Suricata events from the same source, fingerprint attacker tooling from banner + user_agent
- ·L4+: containment is out-of-band for honeypots — OpenCanary is read-only by design; blocking the source routes through the UniFi/firewall connector with operator sign-off
- ·Any decision to leave the canary touched-but-unblocked to keep watching the attacker
Full ladder semantics · /trust →
Field count + sample event auto-derived from src/cybercli/connectors/opencanary/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.
Close more of the kill chain
OpenCanary covers 3 of 14 ATT&CK tactics. Pair it with these to widen coverage:
How to connect
- 1 Deploy OpenCanary on a host + enable the fake services you want to watch.
- 2 Enable JSON logging.
- 3 Run `cybercli onboard opencanary` and point it at the log.
- 4 Confirm tripwire events in the dashboard's Connectors panel.
sudo apt install python3-virtualenv && python3 -m venv canary && canary/bin/pip install opencanary && canary/bin/opencanaryd --copyconfig
Fully local. Canaries run on your hardware; the alert is the only thing that leaves the daemon.