Thinkst Canary

What Thinkst Canary is

Thinkst Canary emulates attractive network targets and alerts when someone interacts with them, helping teams detect intruders. Canaries can be deployed as hardware, virtual, cloud, or container instances; Thinkst describes deployment as taking under two minutes. Each customer receives a hosted management console to configure and manage Canaries and handle events. Alerts can go to email, text message, Slack, webhooks, or Syslog. The service also includes unlimited Canarytokens, tripwires that alert on interaction. The Canary API manages configurations, alerts, users, Canarytokens, and Flocks, with read-only, analyst, and admin key types. Listed integrations include Microsoft Sentinel, Google SecOps SOAR, Tines, Rapid7 InsightIDR, Elastic SIEM, CrowdStrike SIEM, ServiceNow, DataDog, Splunk, PagerDuty, IBM QRadar, and runZero. Thinkst says customer consoles are single-tenant and Canaries send the console only information in alerts triggered by interaction, rather than collecting or storing sensitive environment data. The listed annual bundle covers five Canaries, costs $7,500 a year, and includes a hosted AWS Canary Console, unlimited Canarytokens, support, maintenance, and updates for one year.

Who it suits

Thinkst Canary suits security teams seeking deployable decoys and interaction alerts across hardware, virtual, cloud, or container environments. Teams that route security events into the listed integrations or use the API to manage Canaries, alerts, users, and tokens may also find it a fit.

Limits

The listed bundle covers five Canaries and costs $7,500 a year. Docker Canaries lack IP stack fingerprinting, Windows personalities, firewall and portscan modules, Windows File Share, remote webroot uploads, and DNS over HTTPS support.

Getting started

1. Visit https://canary.tools/
2. Choose the Thinkst Canary — 5 Canaries annual bundle
3. Select hardware, virtual, cloud, or container deployment options
4. Deploy Canaries; Thinkst describes deployment as taking under two minutes
5. Use the hosted management console to configure Canaries and handle events

Verdict

Choose Thinkst Canary if you need network decoys, interaction alerts, and a hosted console with multiple deployment options. Its five-Canary annual bundle includes support, maintenance, and updates, but costs $7,500 a year. Look elsewhere if you need a free plan or Docker Canaries with the listed missing capabilities.