Hi All
This is not promoting Grafana Labs merely mentioning their techniques to protect themselves via Canary Tokens, which could be used within other organisations to reduce the amount of time taken to hunt down the intrusion.
Canary tokens are digital tripwires or decoys that look valuable to an intruder but have no legitimate use. If someone finds and uses one you’ve deployed, you’ll receive an immediate alert.
Named after coal-mining canaries (early warning for toxic gas), these tokens are far lighter than honeypots. They can take many simple forms, such as API keys, files, URLs, or DNS entries, making them fast and easy to deploy across your environment.
In our case, canary tokens weren’t just an experiment, they were the primary signal that told us an attacker was inside: An AWS API key was validated by the attacker; we got a real-time alert; teams swarmed; and the intrusion was contained within minutes.
https://grafana.com/blog/2025/08/25/canary-tokens-learn-all-about-the-unsung-heroes-of-security-at-g...
Regards
Caute_cautim
