The Manager
On the management network, behind the suite's sign-in, never a decoy. It holds the repository of what is bait, the sensors and their keys, what they saw, the rule sets and the reporting. It turns events into touches and raises them.
Servers that exist to be attacked. Secrets that exist to be stolen.
Decoy hosts in the network that look like the real servers, honey tokens placed where the data is, and every touch raised as an incident. Nobody with a legitimate reason touches either, so whoever does is worth a person's time.
Two halves
A Manager that knows, sensors that know nothing
The product is two roles from one source, and the secret stays in one of them.
The sensors
Small Debian hosts beside the real servers. Each plays a persona, serves its decoy services, catches port scans on every other port, and reports outbound with a key of its own. A sensor holds nothing secret and interprets nothing.
The tokens
Credentials, web addresses, host names and directory accounts that exist nowhere but as bait. Generated by the Manager, placed by a person, proven by a test, and burned and replaced when used.
What it does
Every touch an alarm
A decoy has no users, so it has no false positives. What reaches it was looking for something.
- Personas, not just ports. A sensor plays a Windows file server, a domain controller, a PLC, a NAS, a VPN gateway or a camera, from sixteen templates. Its services answer like the product, in the versions it can play.
- Eighty services, twelve categories. Web pages and logins, SSH with a real key exchange, SMB with NTLM, RDP, VNC, LDAP, SQL Server, MySQL, PostgreSQL, Redis, MongoDB, FTP, Telnet, mail, Modbus, S7, MQTT, SNMP and SIP. Every sign-in is refused, and every user name tried is recorded.
- A honey never becomes a service. It refuses every sign-in, reads a little, lives a short while, and never amplifies. Nothing in the catalogue is a vendor's code: only what appears on the wire.
- The scan catcher and the poisoner canary. Every port the persona does not serve still answers, so a port scan is seen as a scan. A sensor asks for names nobody has, and whoever answers is poisoning the network.
- From events to touches. One source on one sensor within a window becomes one touch, with a severity that only rises: a scan, then a connection, a sign-in attempt or a command, then a poisoner or a used token at the top. Its title and summary are rewritten as it grows.
- Noise suppressed in the open. A scanner of your own is suppressed with an owner, a reason and an expiry, and counted so that a suppression hiding too much is seen.
- Tokens that say where they leaked. Every token is unique, so a use says exactly which placement was taken. A fired token is burned and replaced; the old values stay matched for a year, since copies may be out.
- Proven, not assumed. The Manager tests a placed token through the honeys, as an attacker would use it, and shows which tokens are armed and which are not yet covered by a rule set.
- Caught where it is used, too. Three rule sets are rendered from the repository and versioned by their content: the decoy names for Eagle DNS Secure, KQL for Eagle SIEM and Microsoft Sentinel, and Sigma for the decoy accounts. They carry the names, never where they were placed.
In the suite
Bait, governed
Deception raises. The rest of the suite catches, works and governs what it raised.
Eagle SIEM
Every touch in the Security Log, shipped as CEF or syslog, and the decoy accounts and names as KQL rules, so a token used on a real server is caught in the logs.
Eagle SIEMEagle DNS Secure
The decoy host names as watched names. Whoever looks one up has found a token.
Eagle DNS SecureCyber Defence Center
Every touch as an incident with its timeline and a link back, and the figures: sensors online, tokens armed, how much of the bait is covered, touches open and in the last day. Never where a token was placed.
Cyber Defence CenterEagle SOC
Where an analyst works the touch as an incident, with the clock running.
Eagle SOC
How it is secured
The map of the bait never leaves
A deception product that leaks its own map has armed the attacker. This one is built around keeping it.
- The repository stays on the Manager. The hub gets counts and the incident, the SIEM gets names in a rule set, the API never serves tokens, viewers never see them, and every reveal and export is in the Security Log.
- No way into your systems. The Manager generates a token and hands over an artefact; a person places it. Nothing of the product writes to a customer's system.
- A sensor that cannot be turned. Its own account in a sandbox with a read-only system, no home, no devices and a system-call filter. It refuses to run as root or outside its sandbox, and the one root helper accepts numbers only.
- A key per sensor. Issued once through a join code that is single use and expires within the hour, stored only as a hash, with the Manager's certificate pinned by the sensor.
- A sign-in page, and nothing else. Until somebody has signed in, the Manager serves the sign-in page and not one word about what is behind it. Accounts enrol an authenticator; every write is in the audit trail.
- Encrypted at rest. The database is encrypted, and the token secrets are sealed under the application key, whose backup code is exported only under a passphrase.
Good to know
Before you ask
Two packages, one bundle
A Debian package for the Manager, which sets up its encrypted database and certificate, and one for each sensor, which joins with a code from the Manager. Delivered as an offline bundle.
Eight languages
English, Swedish, Danish, Norwegian, German, French, Spanish and Italian.
An open door
A documented API with keys: status, touches, sensors and health, and a scope that lets another system close a touch. The token repository is never served.
Eagle SecOps Suite
One part of one system
Eagle HoneyV is part of the Eagle SecOps Suite: governance, detection, monitoring, vulnerability scanning and secure DNS, built by one team to work as one.
See Eagle HoneyV running
An hour with the people who built it, on a real system, with your questions. No slideware.