Concepts / Detection and response

Detection and response

Canary token

Also called honeytoken, honey file, decoy credential

A planted file, credential or URL that is never used legitimately, so any use of it signals an intruder.

The honeypot idea, shrunk to a single artifact: a tempting fake — a passwords.xlsx, an API key, a database row — that no real workflow touches. Its only job is to be used by someone who should not, which fires an alert naming the moment and often the source. Canary tokens are cheap to scatter widely and, like a honeypot, raise almost no false positives because legitimate use is zero.

See it on real machines

Learn it on real machines.

Every lab is a small network of real Linux machines in your browser. Start with a free account: Google or email, no card.

Start this lab, free