Local Tampering Detected Alert

Canaries use sandboxed, memory-safe services and integrity checks to detect compromise attempts, alerting you to rare but serious signs of advanced or physical attacks.

We expend a lot of effort to make sure that Canaries are not easily compromised.

Fake Canary services are sandboxed and written in memory-safe languages.

We DON'T keep secrets on them, so actually compromising a Canary should be more difficult than most other boxes on your network and should yield less joy to an attacker. (At the very best, they shouldn't be in a better place than they were before they compromised your Canary.)

However, even if it won't put the attacker in a better place, we'd like to know if a Canary has actually been compromised. To this end, your bird has several local integrity checks that signal when they have been compromised.

Please feel free to reach out to us immediately if you receive this alert and need assistance figuring out what's going on.