Files
T

1011 B

Ransomware Honeypot Deployment Template

Deployment Plan

Share Canary Count File Types Naming Convention Monitoring Method

Canary File Inventory

File Path Type Hash (SHA-256) Deploy Date Status

Honeypot Shares

Share Name Server Apparent Content Access Logging Alert Destination

Alert Integration

  • SIEM webhook configured
  • Automated NAC quarantine tested
  • EDR isolation API integrated
  • Email/SMS alerts configured for on-call
  • Canary alerts have CRITICAL priority in SIEM

Validation Testing

Test Date Method Canaries Triggered Alert Time Containment Time Result