Hey folks,

Just open-sourced a project called HoneyWire, a distributed deception platform built as an alternative to commercial honeypots and traditional agent-heavy canary setups.

It allows you to turn any Linux asset into a network canary in about a minute. Instead of installing heavy background daemons, a transient CLI wrapper configures and launches lightweight, distroless decoy containers that check back into a centralized management dashboard.

If an attacker attempts lateral movement and touches one of these decoys, it triggers an instant alert to your SIEM or webhook notifications.

Project Links:

GitHub: https://github.com/andreicscs/HoneyWire

Site: https://honeywire.dev/

It’s completely free, self-hostable, and transparent. Let me know if you have any questions about the detection mechanisms or the tech stack!