How long does the integration take?

Change one base URL in an OpenAI-compatible client, or install the Python or TypeScript SDK; the quickstart routes a first request in a few minutes.

Will this lock us into another vendor?

No. The router is Apache-2.0 open source, your provider keys stay yours, and the API is OpenAI-compatible, so leaving is a change of base URL.

What happens when a provider fails?

The router falls back to the next model your policy allows and records the fallback in the trace, so an outage costs a retry, not an incident.

implementing-network-deception-with-honeypots - Skill

Name: implementing-network-deception-with-honeypots
Author: mukul975

Imported from mukul975/anthropic-cybersecurity-skills (skills/implementing-network-deception-with-honeypots/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill implementing-network-deception-with-honeypots. Copyright stays with the author (Apache-2.0).

Implementing Network Deception with Honeypots

When to Use

When deploying deception technology to detect lateral movement
To create early warning indicators for network intrusion
During security architecture design to add detection depth
When monitoring for unauthorized internal scanning or credential theft
To gather threat intelligence on attacker techniques and tools

Prerequisites

Linux server or VM for honeypot deployment (Ubuntu 22.04+ recommended)
Python 3.8+ with pip for OpenCanary installation
Docker for T-Pot or containerized deployment
Network segment with appropriate VLAN configuration
SIEM integration for alert forwarding (syslog, webhook, or file-based)
Firewall rules allowing inbound connections to honeypot services

Workflow

Plan Deployment: Select honeypot types and network placement strategy.
Install Honeypot: Deploy OpenCanary, Cowrie, or T-Pot on dedicated host.
Configure Services: Enable emulated services (SSH, HTTP, SMB, FTP, RDP).
Set Up Alerting: Configure log forwarding to SIEM and alert channels.
Deploy Canary Tokens: Place credential files, shares, and DNS entries.
Monitor Interactions: Analyze honeypot logs for attacker activity.
Tune and Maintain: Update configurations based on detection results.

Key Concepts

Concept	Description
OpenCanary	Lightweight Python honeypot with modular service emulation
Cowrie	Medium-interaction SSH/Telnet honeypot capturing commands
T-Pot	Multi-honeypot platform with ELK stack visualization
Canary Token	Tripwire credential or file that alerts when accessed
Low-Interaction	Emulates services at protocol level without full OS
High-Interaction	Full OS honeypot capturing complete attacker sessions

Tools & Systems

Tool	Purpose
OpenCanary	Modular honeypot daemon with service emulation
Cowrie	SSH/Telnet honeypot with session recording
T-Pot	All-in-one multi-honeypot platform
Dionaea	Malware-capturing honeypot for exploit detection
Splunk/Elastic	SIEM for honeypot alert aggregation

Output Format

Alert: HONEYPOT-[SERVICE]-[DATE]-[SEQ]
Honeypot: [Hostname/IP]
Service: [SSH/HTTP/SMB/FTP/RDP]
Source IP: [Attacker IP]
Interaction: [Login attempt/Port scan/File access]
Credentials Used: [Username:Password if applicable]
Commands Executed: [For SSH honeypots]
Risk Level: [Critical/High/Medium/Low]

Install implementing-network-deception-with-honeypots and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "mukul975-anthropic-cybersecurity-skills-implementing-net-780e17", "kind": "skill", "name": "implementing-network-deception-with-honeypots", "description": "Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance.", "publisher": "mukul975", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "deception", "honeypot", "opencanary", "cowrie", "t-pot", "detection", "lateral-movement", "network-security", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills", "path": "skills/implementing-network-deception-with-honeypots/SKILL.md", "ref": "HEAD", "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/implementing-network-deception-with-honeypots/SKILL.md", "key": "mukul975/anthropic-cybersecurity-skills/skills/implementing-network-deception-with-honeypots/SKILL.md" }, "license": "Apache-2.0" }, "instructions": "# Implementing Network Deception with Honeypots\n\n## When to Use\n\n- When deploying deception technology to detect lateral movement\n- To create early warning indicators for network intrusion\n- During security architecture design to add detection depth\n- When monitoring for unauthorized internal scanning or credential theft\n- To gather threat intelligence on attacker techniques and tools\n\n## Prerequisites\n\n- Linux server or VM for honeypot deployment (Ubuntu 22.04+ recommended)\n- Python 3.8+ with pip for OpenCanary installation\n- Docker for T-Pot or containerized deployment\n- Network segment with", "cost": { "context_tokens": 627 } }

implementing-network-deception-with-honeypots

About

Implementing Network Deception with Honeypots

When to Use

Prerequisites

Workflow

Key Concepts

Tools & Systems

Output Format

Install implementing-network-deception-with-honeypots and it becomes one more candidate the router can pick - when it fits.

What it costs to adopt - in engineering time.

One base URL

No vendor lock-in

Failover built in

Use it

Manifest

Reviews