So many times on engagement I’ve opened files that looked like canaries but we’re just dumb jokes between sysadmins (is_rsa containing “hah got you” for instanc

So many times on engagement I’ve opened files that looked like canaries but we’re just dumb jokes between sysadmins (is_rsa containing “hah got you” for instance) A dozen canary tokens will probably get your security detection program alot further than your first $2M of splunk license