Quickstart

Your first decoy in about a minute

Create a sensor in the Console, run one Docker command, poke it, and read what happened.

Before you start

A Kandaro account (the 14-day trial is fine) with MFA set up.
A Linux host with Docker inside the network you want to watch. A small VM or a Raspberry Pi-class device (amd64 or arm64) is enough.
Outbound HTTPS from that host to api.kandaro.com. No inbound ports are needed.

1. Create a sensor

In the Console, open Sensors → New sensor, give it a name (for example nas-backup-01) and pick a profile. Not sure? Start with nas or windows-server; see the profiles reference. The Console shows a single-use enrolment token that is valid for 24 hours.

2. Run it

Copy the command from the Console. It looks like this:

shell

docker run -d --name kandaro-sensor \
  --read-only --tmpfs /tmp \
  --cap-drop ALL --cap-add NET_BIND_SERVICE \
  --security-opt no-new-privileges \
  -v kandaro-sensor:/app/data \
  -e KANDARO_API_URL=https://api.kandaro.com \
  -e KANDARO_ENROLL_TOKEN=<token from the Console> \
  ghcr.io/kandaro/kandaro-sensor:<version>

Within a few seconds the sensor enrols and the Console shows it as online. For a decoy with its own IP and MAC address on the LAN (recommended), see Deploying a sensor.

3. Touch it

Nothing should ever talk to a decoy, so you will have to do it yourself once:

shell

# From another machine on the same network:
nmap -sT -p 21,22,80,139,445,5000 <decoy-ip>
ssh root@<decoy-ip>
curl -X POST http://<decoy-ip>/login -d 'username=admin&password=admin123'

4. Read the explanation

Open Events in the Console. Every event shows the raw details and a plain-English explanation. Related events from the same source become an incident with a narrative and a recommended action.

5. Get alerted

Under Settings → Alerts, add an email address, a Slack incoming webhook or a signed webhook, and choose the minimum severity for each. Add your own monitoring and vulnerability scanners to the ignore list so they don’t trigger alerts.