🚀 Submit a Challenge — SecDim AppSec Village CTF at DEF CON 34 and Win a ROG Xbox Ally

Sign InContact sales
Sign InContact sales

Honeytokens and Secure Logging

3h 45mBeginnerDevSecOpsFeatured

Application logs are the primary source of evidence during a security incident and a frequent source of data exposure. This course teaches developers how to design logs that detect attacks, how to scrub sensitive data before it leaves the application, and how to plant honeytokens that catch attackers the moment they start probing. We cover credential stuffing detection, IDOR probing, prompt injection in AI applications, cloud-credential canaries, and tamper-evident audit trails.

Begin course

Topics

  1. Introduction

    Lesson5m

    Course summary, learning objective and list of modules

  2. What to Log and What Never to Log

    Lesson15m

    Security event taxonomy, the four questions every event must answer, and the paths through which credentials and PII end up in logs.

  3. Structured Logging for Security Detection

    Lesson15m

    Structured vs freeform log formats, event schema design, correlation IDs, and log aggregation in containerised deployments.

  4. Log Injection and Alerting Blind Spots

    Lesson15m

    Newline and JSON injection attacks, sanitisation techniques, alerting gaps, and log integrity controls.

  5. Sensitive Data Masking and Log Scrubbing

    Lesson15m

    Implementing a scrubbing utility that redacts sensitive fields from log events, applying it as a logging filter, and writing tests to verify redaction is working.

  6. Detecting Attacks From Logs Using Sigma

    Lesson20m

    Log signals for credential stuffing, account enumeration, IDOR probing, and bulk data exfiltration; application-level counters that emit those signals as structured events.

  7. Detecting Attacks using Sigma Lab

    Lab30m

    Learn how to use Sigma to detect security attacks

  8. Honeytokens: Detecting Attackers in Your Application

    Lesson15m

    Planting application-level and cloud-credential honeytokens, emitting structured alerts when they fire, and following a forensic checklist after a trigger.

  9. Honeytokens in AI Applications

    Lesson15m

    Canary words in LLM system prompts, decoy secrets in RAG context, and decoy MCP tools -- detecting system prompt extraction, prompt injection exfiltration, and agent reconnaissance.

  10. Honeytoken Lab

    Lab30m

    Learn how to implement Honeytoken in a cloud native application

  11. Audit Logging

    Lesson20m

    Distinguishing audit logs from application logs, implementing an append-only audit trail for privileged operations, and what PCI-DSS and SOC 2 require the application layer to emit.

  12. Log Injection Lab

    Challenge30m

    Complete this hands-on app to put your learning into the practice.