Skip to content

user deception and canary tokens

Jump to bottom
MD MUFTHAKHERUL ISLAM MIRAZ edited this page Jun 24, 2026 · 2 revisions

Note

👋 Hey there! Siyarix is a personal passion project built by a single developer that is growing and under active development. The feature described on this page is currently Planned / Under Development and may not be fully functional in the codebase yet. Stay tuned for updates! 🚀

🪤 Deception Technology & Canary Tokens

Catch attackers in the act! Deception technology flips the script, allowing you to lay traps for malicious actors inside your network.

Warning

Active Development Notice: Siyarix's deception capabilities are currently under heavy construction! A CanaryTokenManager stub exists, and we are working hard on the full implementation, which will include honeypots, canary tokens, and trapdoor credentials.

🚧 Current Status

Right now, the CanaryTokenManager class is acting as a placeholder in the codebase. You can call the commands, but they will currently return empty results while we finish building the engine.

from siyarix.chat.stubs import CanaryTokenManager, CanaryTokenType

manager = CanaryTokenManager()

# This is a stub! It currently returns None.
manager.deploy_to_target("webapp.example.com", [CanaryTokenType.WEB])

# This is a stub! It currently returns an empty list [].
tokens = manager.list_tokens()

🔮 Planned Capabilities

We are building a robust suite of deception tools. Here is what you can expect in upcoming releases:

🐤 Canary Tokens

Canary tokens are fake digital assets. When an attacker touches them, you get an immediate, high-fidelity alert.

Token Type How It Traps Attackers Where We Deploy It
WEB A unique URL that triggers an alert the moment it's requested. Web access logs, emails
DNS (planned) A unique DNS name that alerts you when someone tries to resolve it. DNS zone files
AWS Key (planned) A fake AWS credential that screams if someone tries to use it. Config files, GitHub
Credential (planned) A juicy-looking username and password pair. Credential stores, memory
File (planned) A document that alerts you the second it is opened. Desktop, shared drives
DB Record (planned) A fake database entry that triggers when queried. Production databases
API Key (planned) A decoy API key waiting to be scraped. Config files, source code

🍯 Honeypot Detection (Planned)

Want to know if you're exploring a real system or a trap? Siyarix will be able to detect known honeypots:

  • Signature Analysis: Identifying common honeypots like Cowrie, Dionaea, Honeyd, and T-Pot.
  • Banner Analysis: Checking SSH banners for deceptive patterns.
  • Fingerprinting: Analyzing HTTP responses and service behaviors for anomalies.

🎭 Fake Banners (Planned)

Confuse attackers by making your systems look like something else!

  • Deploy highly realistic decoy banners for SSH, HTTP, FTP, etc.
  • Customize service fingerprints to waste attackers' time.
  • Fully automated deployment across your decoy infrastructure.

🚪 Trapdoor Credentials (Planned)

  • Generate fake credentials that exist solely to trigger alarms when used.
  • Seamless integration with your existing credential stores.
  • Instant alert routing directly to your security team.

📣 Stay Tuned!

We are incredibly excited about the deception technology suite. We are actively developing these features and will share updates and release timelines as soon as they are ready!

Note

👋 Welcome to Siyarix! This is a personal passion project built by a single developer. It's currently under active development and growing fast. Expect rough edges, but lots of love! ❤️

🗺️ Siyarix Documentation Map

Welcome to the Siyarix Documentation Map! This page serves as your master compass for navigating the extensive documentation we have built for the platform.

Whether you are a brand new user, a seasoned security operator, or a developer looking to contribute to the core engine, you can find exactly what you need here.

🧭 Quick Navigation

Not sure where to start? Pick the path that best describes you:

🌱 For New Users

Just getting started? We highly recommend following these guides in order:

  1. Installation Guide — Get Siyarix running on your machine.
  2. Onboarding Wizard — Let our interactive wizard help you set up your API keys and environment.
  3. Setup & Configuration — A deeper dive into customizing your setup.
  4. Your First Run — A gentle walkthrough of your very first Siyarix command.

🛡️ For Security Operators

Ready to put Siyarix to work? Dive into our operational guides:

💻 For Developers & Contributors

Looking under the hood or wanting to write some code? Start here:

📂 The Complete Documentation Tree

If you prefer to browse the raw structure, here is a complete layout of the docs/ folder:

docs/
├── 🚀 getting-started/       # Installation, onboarding, and configuration
│   ├── installation.md       # Multi-platform install (pip, brew, winget, docker)
│   ├── onboarding.md         # The interactive 11-step setup wizard
│   ├── setup.md              # Managing API keys, credentials, and settings
│   ├── first-run.md          # A walkthrough of your first session
│   ├── configuration.md      # A deep-dive into advanced settings
│   └── troubleshooting.md    # Common issues and how to fix them instantly
│
├── 📖 user/                  # Daily operations and workflows
│   ├── cli-commands.md       # Reference for 50+ CLI commands across 12 groups
│   ├── interactive-chat.md   # Mastering the AI REPL and 54+ slash commands
│   ├── security-workflows.md # Recon, vulnerability assessment, incident response
│   ├── cloud-scanning.md     # Multi-cloud security scanning (under development)
│   ├── compliance.md         # Framework mapping (SOC 2, NIST, GDPR, PCI-DSS)
│   ├── threat-intelligence.md# Integrations with OTX, NVD, and MITRE ATT&CK
│   ├── playbooks.md          # Building automated YAML-based IR playbooks
│   ├── workflow-files.md     # DAG workflow reference (programmatic API)
│   ├── reporting.md          # Multi-format report generation
│   ├── offline-registry.md   # Running without AI (Offline/Registry execution mode)
│   └── ai-workflows.md       # Advanced AI-driven autonomous operations
│
├── 💻 developer/             # Building, testing, and extending Siyarix
│   ├── codebase-overview.md  # Full module structure mapping
│   ├── contribution-guide.md # How to submit PRs and our coding standards
│   ├── module-architecture.md# Component design and responsibilities
│   ├── testing.md            # Writing tests (pytest), coverage, and CI/CD
│   └── building.md           # Packaging, distribution, and Docker builds
│
├── 🏗️ architecture/          # System design and core internals
│   ├── overview.md           # High-level data flow and layered orchestration
│   ├── ai-agent-pipeline.md  # The AgentCore reasoning and execution pipeline
│   ├── provider-abstraction.md# How we unify 26 different AI providers
│   ├── execution-engine.md   # Plan-based step orchestration
│   ├── memory-and-state.md   # Knowledge graph, session persistence, and learning
│   ├── security-model.md     # The Permission Gate, DLP, audit logging, and OPSEC
│   └── intent-routing.md     # Semantic intent classification and routing
│
├── 🧠 ai/                    # Deep dive into the AI provider & agent systems
│   ├── routing.md            # Managing 26 providers, failovers, and circuit breakers
│   ├── persona-system.md     # Overview of our 10 security personas
│   ├── agent-reasoning.md    # The Observe-Reason-Act loop and tool call repair
│   ├── tool-execution.md     # The tool registry, capability graph, and parsers
│   ├── ensemble.md           # Parallel LLM voting strategies
│   ├── multi-wave.md         # Iterative goal execution with context carry-over
│   ├── prompt-architecture.md# System prompt design and management
│   └── safety.md             # Our rigorous 8-layer hallucination mitigation system
│
├── 🛡️ security/              # Safety, ethics, and threat models
│   ├── reporting.md          # How to safely report vulnerabilities to us
│   ├── threat-model.md       # System threat model and our mitigations
│   ├── operational-security.md# TOR routing, stealth modes, and OPSEC controls
│   ├── ethical-policy.md     # Mandatory rules of engagement for all users
│   └── abuse-prevention.md   # How we prevent misuse of the AI engine
│
└── ⚖️ legal/                 # Licensing and governance
    ├── agpl-guide.md         # A plain-English overview of the AGPL-3.0-or-later license
    ├── why-agpl.md           # The philosophy behind our license choice
    ├── trademark-policy.md   # Branding and trademark guidelines
    ├── responsible-ai.md     # Our framework for ethical AI usage
    ├── disclaimer.md         # Important legal disclaimers
    └── plugin-exception.md   # The license exception for building custom plugins

📖 Key Terminology

As you read through the documentation, you might encounter some specific terms. Here is a quick cheat sheet:

Term What It Means
Provider The backend AI engine powering Siyarix (e.g., OpenAI, Anthropic, Ollama).
Tool A traditional security executable installed on your system (e.g., nmap, nuclei).
Plan A step-by-step sequence of tool commands intelligently generated by the AI.
Workflow A hardcoded, predefined execution path (usually defined in YAML/JSON) that doesn't require AI generation.
Persona A specialized behavioral profile given to the AI (e.g., instructing it to act specifically as a "Network Recon Specialist").
Knowledge Graph Siyarix's internal memory where it stores findings (like IP addresses, open ports) to contextually inform future steps.

Need help finding something specific? Feel free to use the search bar at the top of the documentation site, or open a discussion on our GitHub!

Clone this wiki locally