ShadowTrackr

Integrate canary tokens

Miners used to carry canaries into the mine: if the bird went quiet, it was time to leave. Canary tokens are the digital version. Plant one where nobody should look, and the moment someone does, you know.

Thinkst offers canary tokens for free on canarytokens.org. Out of the box they send an email. If you point them at ShadowTrackr instead, every trigger lands on your timeline, you can alert on it like any other event, and all your canaries are managed in one place. Read the introduction on the Thinkst blog if you want the background.

Set it up in three steps

  1. Create the canary in ShadowTrackrGo to Alerts > Canaries, give it a name that says where you will hide it, and press Add canary. Copy the webhook URL.
  2. Create the token on canarytokens.orgPick a token type, choose the webhook notification option and paste the URL. In the memo, write what the token is and where you placed it: that text is sent along when it fires.
  3. Plant itDownload or copy the token and put it where an intruder would look. Test it once yourself and check that the trigger shows up under your canary.
How to integrate a canary token
The webhook URL is private: anyone who has it can trigger your canary. Keep it out of shared documents and tickets.

What to plant

A Word or PDF document

Name it "Passwords.docx" or "Annual bonus plan.docx" and fill it with fake data. It fires when opened, with the IP address and browser of whoever did. Word works in more places than PDF.

An email address

Add it as a user in a web shop, portal or remote-work system, or in a sensitive mailing list. If the user table is stolen and abused, you hear about it. Remove it before a real mailing goes out.

A web bug or fake page

Hide a link or image in an internal wiki, an admin page copy or a cloned site. Anyone loading it, including a scraper, sets it off.

A DNS name or cloud key

A hostname in a config file or credentials in a repo fire when an attacker tries to use them.

Tell the people who monitor ShadowTrackr which canaries exist, so a colleague who stumbles on one is not mistaken for an attacker.

<- back to FAQ