About

Imported from mukul975/anthropic-cybersecurity-skills (skills/implementing-network-deception-with-honeypots/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill implementing-network-deception-with-honeypots. Copyright stays with the author (Apache-2.0).

Implementing Network Deception with Honeypots

Name: implementing-network-deception-with-honeypots
Author: mukul975

When to Use

When deploying deception technology to detect lateral movement
To create early warning indicators for network intrusion
During security architecture design to add detection depth
When monitoring for unauthorized internal scanning or credential theft
To gather threat intelligence on attacker techniques and tools

Prerequisites

Linux server or VM for honeypot deployment (Ubuntu 22.04+ recommended)
Python 3.8+ with pip for OpenCanary installation
Docker for T-Pot or containerized deployment
Network segment with appropriate VLAN configuration
SIEM integration for alert forwarding (syslog, webhook, or file-based)
Firewall rules allowing inbound connections to honeypot services

Workflow

Plan Deployment: Select honeypot types and network placement strategy.
Install Honeypot: Deploy OpenCanary, Cowrie, or T-Pot on dedicated host.
Configure Services: Enable emulated services (SSH, HTTP, SMB, FTP, RDP).
Set Up Alerting: Configure log forwarding to SIEM and alert channels.
Deploy Canary Tokens: Place credential files, shares, and DNS entries.
Monitor Interactions: Analyze honeypot logs for attacker activity.
Tune and Maintain: Update configurations based on detection results.

Key Concepts

Concept	Description
OpenCanary	Lightweight Python honeypot with modular service emulation
Cowrie	Medium-interaction SSH/Telnet honeypot capturing commands
T-Pot	Multi-honeypot platform with ELK stack visualization
Canary Token	Tripwire credential or file that alerts when accessed
Low-Interaction	Emulates services at protocol level without full OS
High-Interaction	Full OS honeypot capturing complete attacker sessions

Tools & Systems

Tool	Purpose
OpenCanary	Modular honeypot daemon with service emulation
Cowrie	SSH/Telnet honeypot with session recording
T-Pot	All-in-one multi-honeypot platform
Dionaea	Malware-capturing honeypot for exploit detection
Splunk/Elastic	SIEM for honeypot alert aggregation

Output Format

Alert: HONEYPOT-[SERVICE]-[DATE]-[SEQ]
Honeypot: [Hostname/IP]
Service: [SSH/HTTP/SMB/FTP/RDP]
Source IP: [Attacker IP]
Interaction: [Login attempt/Port scan/File access]
Credentials Used: [Username:Password if applicable]
Commands Executed: [For SSH honeypots]
Risk Level: [Critical/High/Medium/Low]

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-implementing-net-780e17/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-implementing-net-780e17.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-implementing-net-780e17",
  "kind": "skill",
  "name": "implementing-network-deception-with-honeypots",
  "description": "Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "deception",
      "honeypot",
      "opencanary",
      "cowrie",
      "t-pot",
      "detection",
      "lateral-movement",
      "network-security",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/implementing-network-deception-with-honeypots/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/implementing-network-deception-with-honeypots/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/implementing-network-deception-with-honeypots/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Implementing Network Deception with Honeypots\n\n## When to Use\n\n- When deploying deception technology to detect lateral movement\n- To create early warning indicators for network intrusion\n- During security architecture design to add detection depth\n- When monitoring for unauthorized internal scanning or credential theft\n- To gather threat intelligence on attacker techniques and tools\n\n## Prerequisites\n\n- Linux server or VM for honeypot deployment (Ubuntu 22.04+ recommended)\n- Python 3.8+ with pip for OpenCanary installation\n- Docker for T-Pot or containerized deployment\n- Network segment with",
  "cost": {
    "context_tokens": 627
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-implementing-net-780e17/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.