Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Implementing Network Deception with Honeypots · mukul975 | DecimalAI

Implementing Network Deception With Honeypots

NewSkillScoreMaintained

implementing-network-deception-with-honeypots

Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/implementing-network-deception-with-honeypots/SKILL.md

decimalai skills pull implementing-network-deception-with-honeypots --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/implementing-network-deception-with-honeypots/SKILL.md https://app.decimal.ai/s/implementing-network-deception-with-honeypots/SKILL.md

Raw file: /s/implementing-network-deception-with-honeypots/SKILL.md ↗ · machine-readable summary at /s/implementing-network-deception-with-honeypots.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 56d ago

No measurable change+15% tokens0% turns13% of whole cases pass with skill (3/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	—	—
case-09	✓→✓	＝ Same ✓	—	—
case-23	✓→✓	＝ Same ✓	—	—
case-19	✗→✗	＝ Same ✗	—	—
case-18	✗→✗	＝ Same ✗	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/implementing-network-deception-with-honeypots/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/1/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Implementing Network Deception with Honeypots

When to Use

When deploying deception technology to detect lateral movement
To create early warning indicators for network intrusion
During security architecture design to add detection depth
When monitoring for unauthorized internal scanning or credential theft
To gather threat intelligence on attacker techniques and tools

Prerequisites

Linux server or VM for honeypot deployment (Ubuntu 22.04+ recommended)
Python 3.8+ with pip for OpenCanary installation
Docker for T-Pot or containerized deployment
Network segment with appropriate VLAN configuration
SIEM integration for alert forwarding (syslog, webhook, or file-based)
Firewall rules allowing inbound connections to honeypot services

Workflow

Plan Deployment: Select honeypot types and network placement strategy.
Install Honeypot: Deploy OpenCanary, Cowrie, or T-Pot on dedicated host.
Configure Services: Enable emulated services (SSH, HTTP, SMB, FTP, RDP).
Set Up Alerting: Configure log forwarding to SIEM and alert channels.
Deploy Canary Tokens: Place credential files, shares, and DNS entries.
Monitor Interactions: Analyze honeypot logs for attacker activity.
Tune and Maintain: Update configurations based on detection results.

Key Concepts

| Concept | Description | |---------|-------------| | OpenCanary | Lightweight Python honeypot with modular service emulation | | Cowrie | Medium-interaction SSH/Telnet honeypot capturing commands | | T-Pot | Multi-honeypot platform with ELK stack visualization | | Canary Token | Tripwire credential or file that alerts when accessed | | Low-Interaction | Emulates services at protocol level without full OS | | High-Interaction | Full OS honeypot capturing complete attacker sessions |

Tools & Systems

| Tool | Purpose | |------|---------| | OpenCanary | Modular honeypot daemon with service emulation | | Cowrie | SSH/Telnet honeypot with session recording | | T-Pot | All-in-one multi-honeypot platform | | Dionaea | Malware-capturing honeypot for exploit detection | | Splunk/Elastic | SIEM for honeypot alert aggregation |

Output Format

Alert: HONEYPOT-[SERVICE]-[DATE]-[SEQ]
Honeypot: [Hostname/IP]
Service: [SSH/HTTP/SMB/FTP/RDP]
Source IP: [Attacker IP]
Interaction: [Login attempt/Port scan/File access]
Credentials Used: [Username:Password if applicable]
Commands Executed: [For SSH honeypots]
Risk Level: [Critical/High/Medium/Low]

Illustrative Want to see what implementing-network-deception-with-honeypots would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 09:32 UTC · 23 cases

Lift

0%

50% vs 50%

Agent turns

0%

1.0 vs 1.0

Tokens

+15%

2,022 vs 1,759.7

fail → pass · 1pass → pass · 2fail → fail · 20

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-19 Which network protocols and services can be emulated on an OpenCanary daemon to act as deception traps?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 We are evaluating Cowrie SSH honeypot for gathering adversary intelligence. What specific attacker interaction details does Cowrie capture during an SSH session?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 We need to harden our production Linux database servers against brute force attacks on port 22. Should we install OpenCanary on our production database servers to block root logins, or should we adjust native OpenSSH directives in sshd_config?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 We are provisioning Linux virtual machines to host our OpenCanary and T-Pot deception nodes. What specific Linux distribution and minimum version is recommended for this deployment?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-21 How does a placed Canary Token detect an intruder and notify security teams?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 We detected a lateral movement attempt hitting one of our decoy file shares and SSH traps. I need an incident notification writeup formatted according to our deception alert template, detailing the Alert record code, Honeypot system name or IP, Service type, Source IP of the intruder, Interaction classification, Credentials Used, any Commands Executed, and the evaluated Risk Level.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 In our honeypot deployment procedure, we have completed the host installation. Should we enable emulated services (SSH, SMB, HTTP) before establishing SIEM log forwarding and alert routes, or should SIEM integration occur prior to enabling emulated services?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 When assigning a severity classification to a honeypot incident alert, what are the four standardized risk level options that can be assigned?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 Our SOC wants to deploy a dedicated deception node designed specifically to capture exploit payloads and malware binaries sent across protocol attempts like SMB and HTTP. Which specific tool in our honeypot toolkit is tailored for malware payload collection?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 To catch credential theft on workstation shares, we plan to place decoy AWS credentials, fake network share links, and bogus database passwords that trigger immediate notifications when opened or queried. What is the standard security term for these tripwire files and credentials?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 Our SOC team needs a SIEM detection rule query (KQL or Splunk) to identify Kerberoasting ticket requests against active domain controllers using Event ID 4769. How should this query be constructed for Windows event logs?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 During a deception architecture rollout, when should canary tokens and decoy credentials be distributed onto production file shares and endpoints? Should they be placed before or after the honeypots and alerting infrastructure are operational?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 What analytics and dashboard stack is integrated directly into T-Pot for visualizing honeypot interaction metrics?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We recently caught an unauthorized host scanning our internal subnet and triggering our OpenCanary deception node. I need you to generate a standardized honeypot alert log entry for this event. Please format the output line-by-line showing the Alert identifier code, Honeypot host address, targeted Service, attacker Source IP, Interaction type, Credentials Used, Commands Executed, and Risk Level.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-17 When designing network placement for deception nodes to detect unauthorized internal scanning and intrusion, where in the network topology should honeypots be placed?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 What log transmission protocols or mechanisms are recommended for forwarding honeypot alert data into a SIEM platform like Splunk or Elastic?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 We need to configure iptables rules on our edge gateway to drop excessive TCP SYN flood packets and rate-limit HTTP connections. Please provide the appropriate iptables commands for SYN packet filtering.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 We need a lightweight daemon that runs modular decoy service emulations (such as SSH, FTP, and HTTP) across multiple internal subnets without requiring full operating systems for each service. Which specific software daemon matches this modular Python service emulation requirement?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 We want to deploy a single unified Docker-based framework that packages multiple honeypots together alongside a built-in Kibana and Elasticsearch visualization interface. Which deception platform provides this bundled multi-honeypot system?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We are designing a deception deployment to capture full interactive attacker session activity and complete shell command history on a decoy host rather than simple protocol handshakes. Which interaction level (low vs high) should we choose for this host, and what honeypot tool fits this session recording requirement?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 In the lifecycle management of network deception technology, what activity should be conducted after monitoring interactions and collecting initial detection logs?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-02 Our SSH honeypot captured an attacker trying to brute-force access and execute commands on a decoy server. Please summarize this event into a structured alert report. The output should include the custom Alert ID string, target Honeypot IP, Service affected, attacker Source IP, Interaction summary, any Credentials Used during the attempt, shell Commands Executed, and the assigned Risk Level.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 We are preparing a host to run containerized honeypot nodes and T-Pot. What container engine runtime is required as a host prerequisite?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of 0 percentage points is the difference between those two pass rates over the 23 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 50%
Pass rate with the skill: 50%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 1
Skill version measured: v1
Run completed: 7/28/2026, 09:32 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signalsno signals yet

BenchmarkRun a verified benchmark with positive lift

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-13% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

No signals yet — run a benchmark or collect evaluated traces to earn a score.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.