👻 GhostIam v1.0.0 — Deploy Decoys. Detect Recon.

🎉 GhostIam v1.0.0 — Initial Release

The most advanced open-source honeytoken framework for AWS identity threat detection.

✨ What's Included

• 👻 Ghost User Deployment — Deploy decoy IAM users with realistic-but-harmless policies to AWS or locally
• 🚨 Real-time Detection — CloudTrail → EventBridge → Lambda → Slack in under 2 seconds
• 📊 Web Dashboard — Live SSE alert feed, Chart.js analytics, journey viewer, mesh status
• 🗺️ Attack Journey Replay — 5-step kill chain with Mermaid graphs + MITRE ATT&CK mapping
• 🌐 Cross-Platform Ghost Mesh — Correlated identities across AWS IAM, GitHub, and Okta
• 🎣 Token Seeder — Auto-plant ghost access keys in GitHub repos, S3 buckets, and Pastebin
• 🔧 Full CLI — deploy, simulate, status, clean, seed, mesh, journey, replay, dashboard
• ⚡ Local Mode — Zero AWS dependencies for instant demos

🚀 Quickstart

git clone https://github.com/kakashi-kx/ghostiam
cd ghostiam
make build
export SLACK_WEBHOOK_URL="https://hooks.slack.com/services/..."
./build/ghostiam deploy --local --count 5 --prefix prod
./build/ghostiam simulate --local --username ghost-prod-db-read-xxxxxx --journey
./build/ghostiam dashboard --port 8080

📦 Downloads

• Source code (zip)
• Source code (tar.gz)

🔗 Links

• Full Documentation

---

Built with Go · HTMX · Chart.js · SQLite · AWS SDK