---
title: "Thinkst Canary"
slug: "thinkst-canary"
updated: 2025-03-25T14:03:26Z
published: 2025-03-25T14:03:26Z
canonical: "docs.databee.buzz/thinkst-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# Thinkst Canary

Thinkst Canary is a deception product used to detect cyber threats by mimicking various systems, providing early and accurate breach alerts, and is available in hardware, virtual, and cloud-based formats. For detailed information refer to the [Thinkst Canary official documentation](https://canary.tools/).

**Integration Method:** API

**Tables**: Authentication (3002), Detection Finding (2004), HTTP Activity (4002), File Hosting Activity (6006), SSH Activity (4007)

This integration supports the following events.

| **Event** | **Description** |
| --- | --- |
| Incidents | Retrieves a List of all incidents. |

This integration supports the following versions.

| Thinkst Canary API version Supported | v1 |
| --- | --- |

> [!NOTE]
> **Note**:
> 
> Thinkst Canary is a continuously updated cloud service. As of this document preparation, the latest release was in [October 2024](https://canary.tools/new).

## Prerequisites

- The user should have access to the Thinkst Canary portal with an account that has the Global Administrator privileges.
- The user should have access to the DataBee console.

## Configuration Overview

1. Generate an API token with the required scopes.
2. Add the [Thinkst Canary](/user-manual/docs/thinkst-canary#databee-configuration) in the DataBee console with the below parameters.

| **DataBee Parameter** | **Thinkst Canary Parameter** |
| --- | --- |
| Token | Auth Token |

## Thinkst Canary Configuration

1. Login to your Thinkst Canary Dashboard and take note of the instance value shown in red below. This will be used later when configuring DataBee.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/ThinkstLogin.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A06Z&se=2026-10-30T12%3A35%3A06Z&sr=c&sp=r&sig=oZmCG61v4SrPk8IcojiN7%2BY1J43vPb%2BX%2BuPOaZk3UOs%3D)
2. Navigate to **settings** > **Global Settings**.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/thinkst-canary-doc-standard-image-93eoz0wi.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A06Z&se=2026-10-30T12%3A35%3A06Z&sr=c&sp=r&sig=oZmCG61v4SrPk8IcojiN7%2BY1J43vPb%2BX%2BuPOaZk3UOs%3D)
3. In the Global Settings, Click the **API section.**
4. Turn on the ‘Enabled’ toggle and click **+** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/thinkst-canary-doc-standard-image-84jo4uhs.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A06Z&se=2026-10-30T12%3A35%3A06Z&sr=c&sp=r&sig=oZmCG61v4SrPk8IcojiN7%2BY1J43vPb%2BX%2BuPOaZk3UOs%3D)
5. In the Create new Global API Key, confirm the following, and click on **Create**.
  - API Key type: Admin
  - Name: Enter the name. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/thinkst-canary-doc-standard-image-kytsyvyd.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A06Z&se=2026-10-30T12%3A35%3A06Z&sr=c&sp=r&sig=oZmCG61v4SrPk8IcojiN7%2BY1J43vPb%2BX%2BuPOaZk3UOs%3D)
6. Navigate to manage **Global API Keys** and copy **Auth Token.** ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/thinkst-canary-doc-standard-image-w0l2oqbx.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A06Z&se=2026-10-30T12%3A35%3A06Z&sr=c&sp=r&sig=oZmCG61v4SrPk8IcojiN7%2BY1J43vPb%2BX%2BuPOaZk3UOs%3D)

> [!NOTE]
> Note:
> 
> The authentication Token is always accessible, allowing us to copy it at any time.

## DataBee Configuration

1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/thinkst-canary-doc-standard-image-qhl45n0v.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A06Z&se=2026-10-30T12%3A35%3A06Z&sr=c&sp=r&sig=oZmCG61v4SrPk8IcojiN7%2BY1J43vPb%2BX%2BuPOaZk3UOs%3D)
2. Search for the **Thinkst Canary** and click it as shown below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/thinkst-canary-doc-standard-image-ojaqhw0f.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A06Z&se=2026-10-30T12%3A35%3A06Z&sr=c&sp=r&sig=oZmCG61v4SrPk8IcojiN7%2BY1J43vPb%2BX%2BuPOaZk3UOs%3D)
3. Click on the **API Ingest** option for collection method. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/thinkst-canary-doc-standard-image-wftqvai9.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A06Z&se=2026-10-30T12%3A35%3A06Z&sr=c&sp=r&sig=oZmCG61v4SrPk8IcojiN7%2BY1J43vPb%2BX%2BuPOaZk3UOs%3D)
4. Enter feed contact information and click **Next.** ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/thinkst-canary-doc-standard-image-wizq8ndv.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A06Z&se=2026-10-30T12%3A35%3A06Z&sr=c&sp=r&sig=oZmCG61v4SrPk8IcojiN7%2BY1J43vPb%2BX%2BuPOaZk3UOs%3D)
5. In the configuration page, confirm the following:
  - Authorization Method: Bearer Token
  - API Base URL: replace the <instance> with your Thinkst Canary instance.
  - Token: enter the Auth Token.
  - Event Types: preselected for all the event types that integration pulls. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/thinkst-canary-doc-standard-image-8pr4spsd.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A06Z&se=2026-10-30T12%3A35%3A06Z&sr=c&sp=r&sig=oZmCG61v4SrPk8IcojiN7%2BY1J43vPb%2BX%2BuPOaZk3UOs%3D)
6. Click **Submit**.

## Troubleshooting Tips

- Ensure the token is pasted correctly.
- Ensure the Thinkst Canary scopes/permissions are correct.