How to Integrate Canary Honeypot with Splunk for Enhanced Security Monitoring?

[KKuser]

I’m implementing a Canary Honeypot in my company and want to integrate its data with Splunk. What key information should I prioritize ingesting? and how can this data enhance threat detection (e.g., correlating with firewall logs, spotting lateral movement)? Are there recommended Splunk TAs or SPL queries to structure and analyze this data effectively?

[livehybrid]

Hi @KKuser 

Are you referring to the Thinkst Canary tool? If so there are a couple of Thinkst apps for Splunk that will help you out. 

Check out the app [for visualising the data] (https://splunkbase.splunk.com/app/6196) and the Add-On [for bringing the data in] (https://splunkbase.splunk.com/app/6195).

The priority order of onboarding will depend a lot on your teams ability to respond, and company policy around priorities on threats. Do you have any internal processes which dictate what type of security event is higher priority than others?

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will