Tracebit Tracebit Integration

TL;DR

Overview

Tracebit is a deception-based detection platform that deploys realistic canary resources — such as S3 buckets, IAM roles, and credentials — across cloud environments to detect attacker behavior following initial access. When an attacker or unauthorized principal enumerates, accesses, or otherwise interacts with one of these canary resources, Tracebit generates a high-confidence alert describing the activity, including the identity that triggered it, the cloud provider context, the specific API operation performed, the resources touched, and network/client metadata such as source IP and user agent. Because canary resources serve no legitimate business purpose, any interaction with them is inherently suspicious, making these alerts extremely high-fidelity signals for detecting lateral movement, credential theft, and unauthorized reconnaissance in cloud environments. Integrating Tracebit with Hunters allows these high-confidence alerts to be correlated with the rest of your security telemetry, enriching investigations and accelerating detection of post-compromise activity.

Supported data types

Tracebit Canary Alerts

Table name: tracebit_alerts

This data type contains alerts generated when a Tracebit canary resource is enumerated, accessed, or otherwise interacted with. Each alert includes the triggering principal's identity and ARN, the canary resource's details, the API operation performed, the resources touched, and client metadata such as source IP and user agent — covering security events such as lateral movement, credential theft, and unauthorized reconnaissance.

Expected format

Logs are expected in JSON format.

{"discriminator":{"type":"tracebit_alert_log","subtype":"canary_resource_accessed"},"id":"3f1a2b4c-2222-4a2b-8c3d-9e0f12345679","alert_id":"01948888-aaaa-7000-8000-000000000001","tracebit_portal_url":"https://acmeorg1.tracebit.com/alerts/01948888-aaaa-7000-8000-000000000001","timestamp":"2025-01-21T11:04:10Z","provider":"aws","message":"Canary resource activity detected in AWS","severity":"Medium","canary":{"tracebit_id":"a1b2c3d4-0001-4e5f-8a9b-1234567890ab","provider_id":"arn:aws:s3:::example-research-archives-app","provider_account_id":"123456789012","name":"example-research-archives-app","type":"AWS::S3::Bucket","aws":{"account_id":"123456789012","account_name":"product-studio","arn":"arn:aws:s3:::example-research-archives-app"}},"principal":{"id":"AWSReservedSSO_AWSReadOnlyAccess_1a2b3c4d5e6f7890/jane.doe@example.com","aws":{"account_id":"123456789012","type":"AssumedRole","arn":"arn:aws:sts::123456789012:assumed-role/AWSReservedSSO_AWSReadOnlyAccess_1a2b3c4d5e6f7890/jane.doe@example.com"}},"event":{"id":"3f1a2b4c-2222-4a2b-8c3d-9e0f12345679","operation":"HeadObject","request":{"user_agent":{"raw":"[Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36]","label":"Chrome 131.0.0 Mac OS X 10.15.7 Mac"},"ip":"198.51.100.23"},"resources":[{"id":"example-research-archives-app","type":"AWS::S3::Bucket"},{"id":"example-research-archives-app/backup/2024/03/10/dump-4138174.712722271.sql.7z","type":"AWS::S3::Object"}]}}

Send data to Hunters

Hunters supports the collection of Tracebit logs using S3 List or S3 Notifications.

To connect Tracebit logs:

1. Route Tracebit logs into an AWS S3 bucket.
2. Once logs are in S3, follow the steps in this section.