https://community.splunk.com/t5/Getting-Data-In/How-to-Integrate-Canary-Honeypot-with-Splunk-for-Enhanced/m-p/740673#M117743 <P>I’m implementing a Canary Honeypot in my company and want to integrate its data with Splunk. What key information should I prioritize ingesting? and how can this data enhance threat detection (e.g., correlating with firewall logs, spotting lateral movement)? Are there recommended Splunk TAs or SPL queries to structure and analyze this data effectively?</P> Tue, 04 Mar 2025 04:07:47 GMT KKuser 2025-03-04T04:07:47Z https://community.splunk.com/t5/Getting-Data-In/How-to-Integrate-Canary-Honeypot-with-Splunk-for-Enhanced/m-p/740673#M117743 <P>I’m implementing a Canary Honeypot in my company and want to integrate its data with Splunk. What key information should I prioritize ingesting? and how can this data enhance threat detection (e.g., correlating with firewall logs, spotting lateral movement)? Are there recommended Splunk TAs or SPL queries to structure and analyze this data effectively?</P> Tue, 04 Mar 2025 04:07:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-Integrate-Canary-Honeypot-with-Splunk-for-Enhanced/m-p/740673#M117743 KKuser 2025-03-04T04:07:47Z https://community.splunk.com/t5/Getting-Data-In/How-to-Integrate-Canary-Honeypot-with-Splunk-for-Enhanced/m-p/740694#M117747 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/276389">@KKuser</a>&nbsp;</P><P>Are you referring to the&nbsp;Thinkst Canary tool? If so there are a couple of&nbsp;Thinkst apps for Splunk that will help you out.&nbsp;</P><P>Check out the app [for visualising the data] (<A href="https://splunkbase.splunk.com/app/6196" target="_blank">https://splunkbase.splunk.com/app/6196</A>) and the Add-On [for bringing the data in] (<A href="https://splunkbase.splunk.com/app/6195" target="_blank">https://splunkbase.splunk.com/app/6195</A>).</P><P>The priority order of onboarding will depend a lot on your teams ability to respond, and company policy around priorities on threats. Do you have any internal processes which dictate what type of security event is higher priority than others?</P><P>Please let me know how you get on and consider adding karma to this or any other answer if it has helped.<BR />Regards</P><P>Will</P> Tue, 04 Mar 2025 09:00:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-Integrate-Canary-Honeypot-with-Splunk-for-Enhanced/m-p/740694#M117747 livehybrid 2025-03-04T09:00:56Z