Decoy · Application

Integration platform decoy

An integration platform holds the credentials for every system it connects. This decoy poses as esb-prod01, with RabbitMQ and its management page, Kafka, Kafka Connect and Node-RED.

Start free trial All decoys

What it emulates

Poses as: Message bus and integration hub.

It lists connectors with names like erp-orders-source and salesforce-sink, so an intruder believes they found the place where everything meets.

SSH 22
Records every password, key and username tried, then refuses them. Only a password Kandaro planted opens a fake shell, where every command is recorded and answered with made-up output. Nothing runs.
AMQP 5672
Speaks RabbitMQ 4.1. Records the username, password and client software, then refuses access.
RabbitMQ admin 15672
The RabbitMQ management sign-in. Records every username and password and any attempt to export its definitions.
Kafka 9092
Accepts the connection and records the first bytes sent. It does not speak the protocol yet.
Kafka Connect 8083
Lists four connectors. Attempts to create, change or delete a connector are recorded and refused.
Node-RED 1880
The Node-RED sign-in. Records every login and every attempt to deploy a flow.

What it catches

Every touch, explained in plain English.

Each event gets a plain-English explanation. Related events from the same source become one incident with a recommended action.

Logins to RabbitMQ and Node-RED
Attempts to export RabbitMQ definitions, which hold credentials
Attempts to add or change Kafka connectors
Attempts to deploy Node-RED flows
Commands typed into the fake shell

MITRE ATT&CK

Techniques come from a fixed table, not from AI, so the same activity always maps the same way.

T1046Network Service Discovery
T1059Command and Scripting Interpreter
T1110Brute Force
T1190Exploit Public-Facing Application
T1552.001Unsecured Credentials: Credentials In Files
T1552.005Unsecured Credentials: Cloud Instance Metadata API

Incidents go to email, Slack, your SIEM or a signed webhook. Kandaro and your SOC

Safe by design

Built to be attacked. Never a way in.

A decoy only listens and answers with fake data. It never runs code and only connects out to Kandaro, so it can never become a way into your network.

It runs nothing
The sensor has no way to run a command, load code or update itself. Every command an intruder types gets a fake text answer.
It connects to one place only
Its only outbound connection is HTTPS to the Kandaro API address set at install time. Nothing Kandaro sends can change that address.
Kandaro can only send it settings
Which decoy to imitate, which services to turn off, which addresses to ignore. There is no field for code, files, commands or updates.
It holds no real secrets
Passwords, keys and records it shows are fake. Its only credential is its own key, which can send events for your organisation and nothing more.
It cannot be used to attack others
It never forwards traffic, never fetches a URL and never serves scripts or programs. Its only UDP replies (SNMP) are rate-limited per address.

Non-root, read-only container with signed images. How we secure sensors

Where to put it

Place it where an intruder will look.

Put it in the application or middleware network, next to your real message brokers.

Installs in about a minute with Docker, Kubernetes, Ansible, a VM or a Raspberry Pi, and needs outbound HTTPS only. Deployment guide · Where to put your first decoys

FAQ