Layers of Deception: Intrusion Detection Honeypots w/ Security Onion
summary
Script clones a GitHub repo and runs idh_setup.sh to convert a Security Onion forward node into an idh node that runs OpenCanary in Docker, disables sensor services, and forwards logs to the manager (requires SO ≥ 2.3.80). Demo shows SSH on 222 and FTP on 21 generating OpenCanary logs, Hunt entries and a Security Onion playbook alert. The integration is experimental beta, configurable via open-canary.conf, low-resource, and successfully produced alerts during the demo.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:59Understanding honeypots
- 4:00Intrusion detection honeypots
- 6:41Use cases and scenarios
- 12:22Deployment and tools
- 14:45Security Onion integration demo
- 24:32Customizing configurations
- 30:42Live Q&A session
related talks
35mCyber Deception 2.0: Adaptive Honeynets and Canary Intelligence in Production
01h 45mPeel Back the Layers of Your Enterprise with the NEW Security Onion 2.0!
30mYou See Honey, I See Beehive: Developing Honey Networks
34mWhat Minesweeper Can Teach Us About Security
32mFaking a Factory: Creating and Operating a Realistic Honeypot
31mWeb Application Honeypot Threat Intelligence
39mBuild Your Own Honeypot with ContainerSSH
26mWeb Honeypot Project