Building Canaries with ELK & ElastAlert

The talk introduces canary tokens, also called honey tokens, which are decoys such as a fake admin account, a fake payroll spreadsheet, or fake API keys that nobody should ever use. The speakers, systems engineers at a higher-education institution, explain why they built theirs on an existing Elasticsearch, Logstash and Kibana stack, with ElastAlert 2 running queries and sending alerts. They stress that alerting must happen in near real time rather than in a next-morning report.

Their canaries sat on internet-facing sites, including scripts embedded in login pages that attackers were cloning. Tuning Lucene queries was still needed, because translation services, search engines, test servers and accessibility tools caused harmless false positives. The most valuable results were phishing and credential harvesting campaigns, which often launched around holidays. Attackers frequently tested their kits from one IP address first, letting the team block those domains and filter email before delivery.

Attackers showed mixed sophistication: some deobfuscated code, some cloned sites lazily, and others stitched pages together from several organizations. The speakers encourage creative canary placement, while warning analysts not to poke around live phishing backends they discover, since that can be risky. The takeaway is that inexpensive decoys wired into existing logging can shorten response time considerably.