Thinkst Canary

Thinkst Canary is a deception product used to detect cyber threats by mimicking various systems, providing early and accurate breach alerts, and is available in hardware, virtual, and cloud-based formats. For detailed information refer to the Thinkst Canary official documentation.

Integration Method: API

Tables: Authentication (3002), Detection Finding (2004), HTTP Activity (4002), File Hosting Activity (6006), SSH Activity (4007)

This integration supports the following events.

This integration supports the following versions.

Note:

Thinkst Canary is a continuously updated cloud service. As of this document preparation, the latest release was in October 2024.

Prerequisites

• The user should have access to the Thinkst Canary portal with an account that has the Global Administrator privileges.

• The user should have access to the DataBee console.

Configuration Overview

1. Generate an API token with the required scopes.

2. Add the Thinkst Canary in the DataBee console with the below parameters.

   DataBee Parameter	Thinkst Canary Parameter
   Token	Auth Token

Thinkst Canary Configuration

1. Login to your Thinkst Canary Dashboard and take note of the instance value shown in red below. This will be used later when configuring DataBee.

   
   

2. Navigate to settings > Global Settings.

   
   

3. In the Global Settings, Click the API section.

4. Turn on the ‘Enabled’ toggle and click + button.
    

5. In the Create new Global API Key, confirm the following, and click on Create.

   • API Key type: Admin

   • Name: Enter the name.
      

6. Navigate to manage Global API Keys and copy Auth Token.
    

   Note:

   The authentication Token is always accessible, allowing us to copy it at any time.

DataBee Configuration

1. Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.
    

2. Search for the Thinkst Canary and click it as shown below.
    

3. Click on the API Ingest option for collection method.
    

4. Enter feed contact information and click Next.
    

5. In the configuration page, confirm the following:

   • Authorization Method: Bearer Token

   • API Base URL: replace the <instance> with your Thinkst Canary instance.

   • Token: enter the Auth Token.

   • Event Types: preselected for all the event types that integration pulls.
      

6. Click Submit.

Troubleshooting Tips

• Ensure the token is pasted correctly.

• Ensure the Thinkst Canary scopes/permissions are correct.