Reference

Profiles reference

A profile decides what a sensor pretends to be. Pick one per sensor in the Console, or override it locally with KANDARO_PROFILE.

Linux server

linux-server

Poses as: Ubuntu database / web server

The classic lateral-movement target: SSH, a web admin, MySQL and Redis.

SSH 22HTTP 80MySQL 3306Redis 6379

Windows file server

windows-server

Poses as: Windows file server

Shares, RDP and IIS: exactly what ransomware operators go looking for.

SMB 445NetBIOS 139RPC 135RDP 3389IIS 80FTP 21

NAS

nas

Poses as: NAS / backup storage

Backups are the first thing an intruder wants to find, and destroy.

Web 5000HTTP 80SSH 22FTP 21SMB 445/139

Network printer

printer

Poses as: Office network printer

Blends into any office VLAN. Nobody logs into a printer by accident.

HTTP 80JetDirect 9100LPD 515IPP 631Telnet 23SNMP 161/udp

Managed switch

switch

Poses as: Managed switch / router

Network gear with Telnet, SSH, a Basic Auth web admin and SNMP.

Telnet 23SSH 22HTTP 80SNMP 161/udp

IP camera

ip-camera

Poses as: IP camera (BusyBox)

A favourite of botnets and curious insiders: web login, RTSP and Telnet.

HTTP 80RTSP 554Telnet 23TCP 8000

AI agent server

ai-agent-server

Poses as: LLM / AI agent server

Ollama, an OpenAI-compatible API, an MCP tool server and a vector DB. Bait for AI-powered attackers.

Ollama 11434OpenAI API 8000MCP 3000Agent console 8080Vector DB 6333Redis 6379SSH 22

Integration platform

integration-platform

Poses as: Message bus / integration hub

RabbitMQ, Kafka Connect and Node-RED: where the credentials of every system meet.

AMQP 5672RabbitMQ mgmt 15672Kafka 9092Kafka Connect 8083Node-RED 1880SSH 22

n8n automation

n8n

Poses as: n8n workflow automation

Workflow automation full of API keys, plus its Postgres database.

n8n 5678PostgreSQL 5432SSH 22

Ports and privileges

Profiles use the real well-known ports, which is why the hardened run command adds only the NET_BIND_SERVICE capability. To try a profile without low ports, set KANDARO_PORT_OFFSET=10000: SSH then listens on 10022, HTTP on 10080, and so on.

Every sensor is unique

Instance ids, cluster ids, SSH host keys, version digests and install dates are derived from a random per-sensor seed. Two Kandaro sensors running the same profile never present the same fingerprint, so one internet search can’t list every Kandaro customer.

UDP services

UDP sources such as SNMP can be spoofed, so UDP-only events are capped at medium severity, flagged as spoofable, and never count towards port-scan detection.