andreicscs/honeywireOpen-source deception platform that turns any Linux machine into a high-signal canary. Deploy tripwire sensors on files, ports, and network services to detect intruders with instant forensics and push notifications.
HoneyWire is a lightweight, Distributed High-Signal Security Early-Warning System Builder, designed for internal networks. It leverages its architecture and UX to make it incredibly easy to build a new Cyber Canary server or deploy HoneyWires on existing ones. Using deception technology, it replaces the "magnifying glass" approach of traditional SIEMs which often drown analysts in false positives by surveilling legitimate traffic with a High-Fidelity Tripwire model.
Place a sensor exactly where you want it. If it trips, you have an intruder.
Set up multiple and you start to have a pretty clear idea of the lateral movement of an intruder. No tuning, no noise, just instant forensics. If you have legitimate automated security scanners tripping HoneyWires just whitelist them from the Hub's settings.
Note: If you build your sensor using the official HoneyWire SDKs, this JSON formatting and delivery is handled for you automatically.
The true power of HoneyWire is that the Hub and Wizard are completely sensor-agnostic. You are not limited to the included official sensors.
By adhering to the HoneyWire Event Standard V2.0, you can write a script in any language (Bash, Go, Rust, Python) to monitor anything, and the Sentinel UI will dynamically parse, syntax-highlight, and render your forensic data.
Whether it is a Deep Packet Inspection (DPI) engine, a DNS sinkhole, a Canary Token embedded in a PDF, an Email Honeypot, or a simple TCP Port Tripwire, just POST the Universal Event Standard JSON payload to the Hub.
HoneyWire is split into four independent microservices:
/Hub: The central brain. A pure Go binary running an embedded SQLite database and the Vue.js dashboard. It runs as a non-root user inside a Distroless container, safely mounting data to a dedicated volume./Sensors: The decoy nodes. Statically-linked Go binaries that listen on vulnerable ports, trap attackers, and securely POST intrusion data back to the Hub./SDKs: Official libraries (like sdk-go) that handle secure Hub communication so community developers can easily build new sensors./wizard: Setup wizard cli tool to automate operator tasks such as discovery, deployment and testing of HoneyWires.Check out the full architecture docs Read the User Operations Guide
Deploying the HoneyWire Hub takes less than 60 seconds using our pre-built GitHub Container images.
Create a new directory on your server, create a docker-compose.yml file, and paste the following:
services:
# 1. THE PERMISSION FIXER: Runs once to ensure the Hub can write to the data volume
permission-fixer:
image: alpine:latest
container_name: honeywire-permission-fixer
command: sh -c "chown -R 65532:65532 /data"
volumes:
- ./honeywire_data:/data
# 2. THE HUB: The central Go-based dashboard and API
hub:
image: ghcr.io/andreicscs/honeywire-hub:latest
container_name: honeywire-hub
restart: unless-stopped
ports:
- "8080:8080"
volumes:
- ./honeywire_data:/data
depends_on:
permission-fixer:
condition: service_completed_successfully
# Strict Security Sandbox
user: "65532:65532"
read_only: true
cap_drop: ["ALL"]
security_opt: ["no-new-privileges:true"]
environment:
- HW_ENV=development # Required if not using HTTPS, or the cookie will have the secure flag set, in production it is highly recommended to remove this and run this behind a reverse proxy using https
- HW_PORT=8080
- HW_DB_PATH=/data/honeywire.db
# Optional: Hardcode the dashboard password (disables the UI password reset feature)
# - HW_DASHBOARD_PASSWORD=admin
Start the Hub:
docker compose up -d
Navigate to http://<your-server-ip>:HW_PORT in your browser. You will be greeted by the Initialize Sentinel screen.
honeywire apply on the node to reconcile desired state or run honeywire discover to let the Setup wizard automatically scan and suggest HoneyWires based on environment.Once your containers are up, the Tarpit sensor should appear as ONLINE within 30 seconds.
Run honeywire firedrill to make the HoneyWires send a mock event to the hub to test connectivity.
Note: For a deeper dive into managing nodes, updating sensors, and handling rollbacks, see the User Operations Guide.
Node Key to communicate with the Hub. The Hub will reject any payloads with mismatched or invalid keys.gcr.io/distroless/static-debian12:nonroot. We follow the principle of least privilege to make sure that if a container is compromised, the blast is contained.net/http (Standard Library), SQLite (ModernC Pure Go Driver)Hub endpoint:
GET /api/v2/version → returns { "version": "v2.x.x" }