OpenCanary is a modular and decentralised honeypot that runs as a daemon to detect network intrusions.
The tool addresses the need to detect when attackers have breached a network by implementing multiple common network protocols and alerting operators when those services are accessed. OpenCanary runs as a background daemon that mimics network-accessible services, then sends alerts through various mechanisms when suspicious activity is detected, identifying the threat source IP address and the point of breach.
OpenCanary suits organisations wanting lightweight threat detection across diverse environments. Its Python implementation makes it cross-platform, though Linux deployments offer the most features. The tool has minimal resource requirements and can run on constrained hardware such as Raspberry Pi devices or minimal VMs. It is the open-source counterpart to a commercial honeypot offering. Optional modules extend functionality to include SNMP monitoring, port scan detection, and Windows File Share emulation, though some features are platform-specific; the Samba module requires a working Samba installation, and port scan detection is Linux-only.
The project maintains active engagement with contributors through documented channels for bug reports, feature requests, and security vulnerability disclosure. Development activity shows consistent attention to dependency management and installation flexibility, with support for multiple Python package managers and virtual environment approaches. The codebase receives updates addressing both core functionality and optional protocol modules.
