From 7294ba6719ca3831bd5fc64fba103ce64b9fcd57 Mon Sep 17 00:00:00 2001 From: andreicscs Date: Mon, 20 Apr 2026 19:41:59 +0200 Subject: [PATCH] updated logo, minor grammatical fixes in ui, and updated documentation to match --- Hub/ui/public/favicon.svg | 17 ++++++++++++-- Hub/ui/src/components/Header.vue | 18 +++++++++++++-- Hub/ui/src/views/Login.vue | 19 ++++++++++++++-- Hub/ui/src/views/Setup.vue | 27 ++++++++++++++++++----- Hub/ui/src/views/Store.vue | 10 ++++----- README.md | 17 +++++++++----- Sensors/official/TcpTarpit/README.md | 2 +- Sensors/official/WebRouterDecoy/README.md | 2 +- 8 files changed, 87 insertions(+), 25 deletions(-) diff --git a/Hub/ui/public/favicon.svg b/Hub/ui/public/favicon.svg index a40aba3..5d81cd5 100644 --- a/Hub/ui/public/favicon.svg +++ b/Hub/ui/public/favicon.svg @@ -1,2 +1,15 @@ - - + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/Hub/ui/src/components/Header.vue b/Hub/ui/src/components/Header.vue index 0ee1c90..ca7d5e7 100644 --- a/Hub/ui/src/components/Header.vue +++ b/Hub/ui/src/components/Header.vue @@ -13,8 +13,22 @@ defineEmits(['toggle-theme', 'toggle-armed', 'mark-all-read', 'logout'])
- - + + + + + + + + + + + + + + + + HoneyWire
diff --git a/Hub/ui/src/views/Login.vue b/Hub/ui/src/views/Login.vue index 4d0ba08..b2d6636 100644 --- a/Hub/ui/src/views/Login.vue +++ b/Hub/ui/src/views/Login.vue @@ -54,8 +54,23 @@ const doLogin = async () => {
- - + + + + + + + + + + + + + + + + +

HoneyWire Sentinel

Authorized personnel only

diff --git a/Hub/ui/src/views/Setup.vue b/Hub/ui/src/views/Setup.vue index 863d6b6..0707c13 100644 --- a/Hub/ui/src/views/Setup.vue +++ b/Hub/ui/src/views/Setup.vue @@ -80,13 +80,28 @@ const doSetup = async () => {
-
-
- - +
+
+ + + + + + + + + + + + + + + + +
-

Initialize Sentinel

-

Configure your master authentication and sensor connection details.

+

HoneyWire Sentinel

+

Authorized personnel only

diff --git a/Hub/ui/src/views/Store.vue b/Hub/ui/src/views/Store.vue index d1e849f..5137b66 100644 --- a/Hub/ui/src/views/Store.vue +++ b/Hub/ui/src/views/Store.vue @@ -137,7 +137,7 @@ const sensors = [

Security Architecture

-

This sensor is architected for extreme resilience against exploits. By utilizing a minimal attack surface and enforcing strict container sandboxing, it ensures the host filesystem remains protected.

+

This sensor is architected for extreme resilience against exploits by utilizing a minimal attack surface and enforcing strict container sandboxing, ensuring the host filesystem remains protected.

  • Unprivileged Execution: Runs entirely as a non-root user (UID 65532), preventing system-level modifications even in the event of a container breach.
  • Read-Only Mounts: The target directory is mounted with strict read_only: true flags, ensuring the container cannot write to or modify the host files.
    • @@ -207,7 +207,7 @@ const sensors = [

Security Architecture

-

This sensor is architected for extreme resilience against exploits. By utilizing a minimal attack surface and enforcing strict container sandboxing, it safely intercepts raw ICMP traffic.

+

This sensor is architected for extreme resilience against exploits by utilizing a minimal attack surface and enforcing strict container sandboxing to safely intercept raw ICMP traffic.

  • Raw Socket Isolation: Bypasses heavy NIDS frameworks by interacting directly with network packets in pure Go, eliminating external C-library vulnerabilities.
  • Least Privilege Execution: Runs as container root strictly to bind the raw socket, relying on container boundaries to limit system access.
    • @@ -296,7 +296,7 @@ const sensors = [

Security Architecture

-

This sensor is architected for extreme resilience against exploits. By utilizing a minimal attack surface and enforcing strict container sandboxing, it safely handles raw network traffic.

+

This sensor is architected for extreme resilience against exploits by utilizing a minimal attack surface and enforcing strict container sandboxing to safely handle raw network traffic.

  • Raw Socket Isolation: Bypasses heavy NIDS frameworks by interacting directly with network packets in pure Go, eliminating external C-library vulnerabilities.
  • Least Privilege Execution: Runs as container root strictly to bind the raw socket, but relies on capability dropping to prevent privilege escalation.
    • @@ -393,7 +393,7 @@ const sensors = [

Security Architecture

-

This sensor is architected for extreme resilience against exploitation. By adhering to the principle of least privilege and enforcing strict resource limits.

+

This sensor is architected for extreme resilience against exploitation by adhering to the principle of least privilege and enforcing strict resource limits.

  • Kernel Capability Stripping: Drops all Linux kernel capabilities (cap_drop: ALL) via the Docker Compose configuration, neutralizing advanced kernel exploitation techniques.
  • Distroless Isolation: Built on a statically-linked Distroless image. It completely lacks a shell (/bin/sh), package managers, or common Linux utilities (like curl or wget), leaving attackers with zero tools to pivot if they achieve Remote Code Execution.
    • @@ -477,7 +477,7 @@ const sensors = [

Security Architecture

-

This sensor is architected for extreme resilience against web-based exploits. By utilizing a minimal attack surface and enforcing strict container sandboxing.

+

This sensor is architected for extreme resilience against web-based exploits by utilizing a minimal attack surface and enforcing strict container sandboxing.

  • Framework-Free Execution: Built purely on Go's native net/http library, eliminating the massive attack surface and supply-chain risks associated with heavy third-party web frameworks (like FastAPI, Flask, or Express).
  • Unprivileged Execution: Runs entirely as a non-root user (UID 65532), preventing system-level modifications even in the event of a container breach.
    • diff --git a/README.md b/README.md index 5db24cb..d4c341a 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,12 @@ [![License](https://img.shields.io/badge/license-GPLv3-blue.svg)](LICENSE) +

    + HoneyWire Logo +

    +

    HoneyWire

    +--- ## 📋 Table of Contents -- [Overview](#honeywire) +- [Overview](#overview) - [Screenshots](#screenshots) - [The Universal Event Standard](#-the-universal-event-standard-bring-your-own-sensor) - [Features](#features) @@ -13,8 +18,8 @@ - [Operational Checklist](#operational-checklist) --- -# HoneyWire +## Overview **HoneyWire Sentinel** is a lightweight, Distributed High-Signal Security Early-Warning System, designed for internal networks. It replaces the "magnifying glass" approach of traditional SIEMs, which often drown analysts in false positives by surveilling legitimate traffic, with a High-Fidelity Tripwire model. Place a sensor exactly where you want it. If it trips, you have an intruder. @@ -121,7 +126,7 @@ services: security_opt: ["no-new-privileges:true"] environment: - - HW_ENV=development # Required if not using HTTPS, or the cookie will have the secure flag set, in production it is highly raccomended to remove this and run this behind a reverse proxy using https + - HW_ENV=development # Required if not using HTTPS, or the cookie will have the secure flag set, in production it is highly recommended to remove this and run this behind a reverse proxy using https - HW_PORT=8080 # Optional: Hardcode the dashboard password (disables the UI password reset feature) # - HW_DASHBOARD_PASSWORD=admin @@ -165,11 +170,11 @@ nc localhost 2222 --- ## Security Notes -* **API Secret:** Ensure your `HW_HUB_KEY` is strong and identical on both the Hub and the Sensors. The Hub will reject any payloads with mismatched keys. +* **API Secret:** Ensure your `Hub Secret Key` is strong and identical on both the Hub and the Sensors. The Hub will reject any payloads with mismatched keys. * **System Arming:** You can toggle the "System Armed" button in the Hub UI to temporarily disable push notifications while doing internal network maintenance or vulnerability scanning. * **Container Hardening:** HoneyWire utilizes `gcr.io/distroless/static-debian12:nonroot`. We follow the principle of least privilege to make sure that if a container is compromised, the blast is contained. * **Distributed Deployment:** It is highly recommended to run the Hub and its Sensors on separate physical or virtual machines. If an attacker compromises a sensor node, they should not have immediate local access to the centralized Hub. -* ⚠️ **Encryption (HTTPS):** Always serve the Hub Web GUI and API over HTTPS using a reverse proxy (like Nginx, Caddy, or Traefik) in production. Failure to do so exposes your `HW_HUB_KEY` and Dashboard password to network sniffing. +* ⚠️ **Encryption (HTTPS):** Always serve the Hub Web GUI and API over HTTPS using a reverse proxy (like Nginx, Caddy, or Traefik) in production. Failure to do so exposes your `Hub Secret Key` and Dashboard password to network sniffing. --- ## Tech Stack @@ -190,6 +195,6 @@ nc localhost 2222 ## Operational Checklist - [x] Complete the Web UI Initial Setup to set the Master Password. -- [x] Retrieve the generated `HW_HUB_KEY` from Settings and apply it to your sensors. +- [x] Retrieve the generated `Hub Secret Key` from Settings and apply it to your sensors. - [x] Configure your push notification webhooks via the Settings UI. - [x] Rebuild/redeploy containers after any version bump in `VERSION` or environment variable changes. diff --git a/Sensors/official/TcpTarpit/README.md b/Sensors/official/TcpTarpit/README.md index fe0a2f0..9d9247d 100644 --- a/Sensors/official/TcpTarpit/README.md +++ b/Sensors/official/TcpTarpit/README.md @@ -43,7 +43,7 @@ docker compose up -d ## Security Architecture -This sensor is architected for extreme resilience against exploitation. By adhering to the principle of least privilege and enforcing strict resource limits. +This sensor is architected for extreme resilience against exploitation by adhering to the principle of least privilege and enforcing strict resource limits. **Core Defense-in-Depth Measures:** * **Kernel Capability Stripping:** Drops all Linux kernel capabilities (`cap_drop: ALL`) via the Docker Compose configuration, neutralizing advanced kernel exploitation techniques. diff --git a/Sensors/official/WebRouterDecoy/README.md b/Sensors/official/WebRouterDecoy/README.md index bdad852..09ae7b1 100644 --- a/Sensors/official/WebRouterDecoy/README.md +++ b/Sensors/official/WebRouterDecoy/README.md @@ -34,7 +34,7 @@ docker compose up -d ## Security Architecture -This sensor is architected for extreme resilience against web-based exploits. By utilizing a minimal attack surface and enforcing strict container sandboxing. +This sensor is architected for extreme resilience against web-based exploits by utilizing a minimal attack surface and enforcing strict container sandboxing. **Core Defense-in-Depth Measures:** * **Framework-Free Execution:** Built purely on Go's native `net/http` library, eliminating the massive attack surface and supply-chain risks associated with heavy third-party web frameworks (like FastAPI, Flask, or Express).