Honeypot

A honeypot is a trap. It looks like something an attacker would want, such as a file server, a database or an administrator account, but no real user or process ever needs it. Because legitimate activity should never touch it, almost every interaction is suspicious, which makes honeypot alerts some of the most reliable in a SOC.

Honeypots range from low-interaction decoys that only emulate a service and log connection attempts, to high-interaction systems that let attackers in so researchers can study their tools. Smaller decoys are often called honeytokens or canary tokens: a fake credential, document or cloud key that raises an alert the moment someone uses it.

Example

A security team creates a domain account named like a backup administrator, gives it no real permissions and never uses it. Months later, a sign-in attempt with that account appears in the domain controller logs. Nobody legitimate knows the account exists, so the team immediately investigates the source machine and finds an attacker enumerating accounts.

Why it matters for a SOC analyst

Honeypots and honeytokens are a cheap way to catch attackers who are already inside, especially during reconnaissance and lateral movement, with very few false positives. Internet-facing honeypots are also a common source of threat intelligence about what is being scanned and exploited right now.