Canarytokens vs SNARE

Canarytokens are decoy tokens placed in networks, computers, and cloud environments to alert users when accessed. The hosted service lets users create tokens without installing software; they can provide an email address to receive an alert when a token is triggered. Some token types also accept a webhook address. Documented examples include HTTP, DNS, Windows directory, AWS API key, Kubernetes configuration, and WireGuard tokens. The Fake IdP SAML App token has setup instructions for Microsoft Entra ID and Okta. Fake App is a Progressive Web App that alerts when opened and can include device location if location access is allowed; it currently supports Safari and Google Chrome. Sensitive Command monitors execution of a specified command on Windows and requires importing its registry file with administrator permissions. The Slack API Token is deprecated, and new tokens cannot be created, though existing ones continue to work. Use of the hosted service through canarytokens.org costs nothing. The maker also publishes the server as open-source software and recommends Docker for self-hosting.

SNARE has no write-up on Specifiction yet; its figures are above.