honeycreds.conf

# --------- SETTINGS ----------
# You can set these once or specify them on the command line.
# Please... change these... really. If I see this on a pentest, I will cry.

[general]
#Choose a legit looking username
def_username = honeycreds 

#This can match your current Short Domain
def_domain = EMC

#Make this whatever you want. Note: HTTP requests will send this in plaintext
def_password = This is a honey cred account.

#The FQDN. Leave .local at ethe end.
def_fqdn = emc.com.local

#The hostname that DOES NOT EXIST but looks legit.
def_hostname = SQLDEV01

#The log file and location
def_logfile = honeycreds.log

[protocols]
#Ability to turn SMB or HTTP on or off. Set to "OFF" to turn off.
SMB = ON
HTTP = ON

#The time to pause in seconds between requests.
SMB_SLEEP = 5
HTTP_SLEEP = 5

[forwarders]
#Forwarders - set to ON to enable.
SPLUNK = OFF
ELK = OFF #Coming Soon

[splunk]
#Splunk Forwarding
#To assign a password or token, add =
#To leave an item blank, do not include the = sign.
#The free version of splunk does not take a password. Just the username of admin.
#Example:
#SPLUNK_PASSWORD = Letmein123!
#SPLUNK_TOKEN = abc1234
SPLUNK_HOSTNAME = localhost
SPLUNK_PORT = 8089
SPLUNK_USERNAME = admin
SPLUNK_PASSWORD
SPLUNK_TOKEN
SPLUNK_INDEX = honeycreds