start	end	text
13880	20180	Hello, everyone. Welcome back. My name is Rubix1138, and I welcome you to the Thinkist
20180	27800	Canary workshop. If you have not already joined us in the Discord chat, please go to
27800	37940	blueteamvillage.org and click on DEF CON 28 and join us in the Discord. The text chat while we
37940	45840	go through this presentation will be in the Texts Workshops Track 1 under Flamingo Hotel.
45840	51160	Just scroll all the way down, go to Texts Workshops Track 1, and you can post your
51160	58920	questions there. I'd like to welcome Adrian and Bradley from Thinkist. Go ahead, guys,
58920	66320	take it away. Thank you. Hello, and thank you very much for that. That was a kind intro.
68280	75100	And we are very excited to be here. And we're going to talk a little bit about how
75660	83100	Canaries and Canary Tokens are now going to be integrated into OpenSOC and give you a little
83100	89540	bit of context and background on them so you can understand how to use them when going through
89540	98320	OpenSOC. So again, big, big thanks to OpenSOC. Really excited to be part of it and really glad
98320	108210	that, you know, they thought to include us in this. All right, so what we're going to do first
108210	113610	is just go through some slides real quick here. We'll go through some live demos as well. A lot
113610	118890	of what you're going to see is kind of a mix of the commercial product and the free product.
118890	125570	Really, the free stuff we have out there worked the same way. Same principles, same data you get
125570	132610	in the alerts. Just for convenience and time sake, you know, you might see a little bit of the
132610	141290	commercial product here. So some of our goals when we designed Canary and Canary Tokens was,
141290	147390	you know, a tool that gets deployed and gets used is useful. So a lot of work went into making them
147390	155130	super easy and simple to use. They take minutes to set up and deploy. So a lot of work goes into
155130	161950	making them super easy to do that. And little to no maintenance, you know. So again, you know,
161950	167810	for a tool to be useful, it has to function, you know. So any kind of maintenance, you know, we try
167810	174350	and make non-existent or, you know, we can do it automatically for you in the background. Even a
174350	181430	free tool, most of that you can just generate Canary Tokens, deploy them, forget them, deploy
181430	189270	open Canary and pretty much forget about it until it sends you alerts. So yeah, and those alerts,
189270	195230	that's a big goal also is, you know, how can we get this as close to zero false positives as possible?
196490	203570	And ultimately, you know, the goal here is to know when it matters. To know when an attacker's
203570	213220	in your environment as soon as possible, when it matters to know that. All right, so as I mentioned,
213220	219780	our open source and free products here, open Canary is available. It's well documented.
219780	226200	You can grab it from GitHub. I think the Docker container has been downloaded tens of thousands
226200	232360	of times. So we know it's getting a lot of use out there. You know, the package has been installed
232360	239840	and you can run your own Canary token server as well with a Docker container or you can use
239840	246680	canarytokens.org. I think we have over 100,000 people using canarytokens.org. You don't even
246680	251160	need to create an account to use it. You can just go there right now and start creating tokens and
251820	255360	distributing them throughout your personal devices,
255360	259840	you know, your production environment, wherever you want to use them. People use them all over.
261920	268320	All right, so talking about the context a little bit here, what are these and why would you use
268320	276080	them in a Blue Team environment or Open Sock? So the goal here is to let you know as soon as
276080	281580	the attacker gets in the environment. So, you know, over the last couple of decades, dwell time
281580	289140	is really long. Attackers are in environments way too long and they just, they go on undetected.
289140	294040	And that's a problem we set out to solve here is, you know, what if we could get that dwell
294040	299540	time down to minutes to when you at least know that there's something suspicious going on inside
299540	306500	the environment. So that's the goal here is the attacker's already in the environment and doing
306500	314040	suspicious things and that's what we alert on. So that's important context to understand.
315340	320220	And how do we do that? So I've got a quick diagram here just to show you
321520	325940	simply what we leverage to make our product work here, to make it win.
326760	332000	And when an attacker gets in, they don't know where anything is in your environment. They don't,
332000	335980	you know, unless they land on a Visio diagram, on a highly detailed Visio
335980	339320	diagram, the moment they get in, they're going to have to explore the network.
339320	342940	They're going to have to look around for what they're hoping to find.
345760	351020	And if you drop in these canaries, which are honeypots, which can look like anything else
351020	359200	in your network, anything from Windows Server 2016 to a Linux server, you know, the idea is
359200	366540	it looks like a normal server, but there's no real reason anybody should be touching it or using it.
366780	373000	So the attacker comes in, does that same exploration, and they start setting off alerts.
375700	382320	And furthermore, when you take canary tokens, you can set traps throughout even more of the
382320	387580	environment. You can make it even more tricky and difficult for the attacker to explore around the
387580	393060	network without setting off even more of these alerts. So really what the attacker is doing,
393060	397800	when you've deployed these traps around in your network, is they're painting a roadmap for you.
397800	402860	They're painting a picture for where they're going, what they're doing, even their motivations,
402860	408500	what servers are they targeting. When they open up some of these token files,
408500	412280	what are the file names that are getting them to double-click that? You know, are they
412280	417440	files that look like they have employee data, files that look like they have customer data,
417440	420700	files that look like they just have more passwords so that they can pivot further
420700	426400	into the environment? You know, a lot of strategies you can use when deploying both
426400	431220	the canaries and the tokens here to understand what the attacker is doing, where they're going
431220	442610	in your environment, and paint you a nice picture of what's going on. And of course,
442610	447330	when those alarms do get set off, we want to make sure they go where you can get to them. In the
447330	452470	context of OpenSOC, this is going to be Greylog. That's where you're going to see any canary token
452470	458830	alerts or any canary alerts. Of course, you know, we can send them tons of other places, but that's
458830	465110	where you're going to see them for OpenSOC. And we'll take a closer look at the kind of details
465110	472150	that you're going to get in those alerts. So whereas canaries sit on the network and let you
472150	479010	know when suspicious stuff is going on on your network, canary tokens can do it at a smaller
479010	486010	level. So canary tokens can be a bit of code, can be a file, and highly complementary to the
486010	491570	canaries. You can even have canary tokens on canaries or canary tokens within canary tokens,
491570	497950	which sit on another place that is triggered by canary tokens. You can layer these really deep
497950	503430	so that even if one or two aren't maybe triggered, you know, something is going to trigger if you
503430	509730	deploy enough of these in your environment. And understand how these work and how you would use
509730	515090	them or how you might see them used within OpenSOC. We're going to take a look at probably
515090	522410	one of the most common and popular canary tokens that get used, which is just the WordDoc canary
522410	531310	token. So in this scenario here, whoever's creating this canary token, you know, our canary
531310	538190	user creates a WordCanary token. And this token can look like a real Word file. You can even
538190	546270	upload an existing Word file. You can copy any kind of contents you want in it. Make it look
546270	551930	as realistic as you want. And you're going to name it something the attacker wants. So really,
551930	557650	thinking about this, you're fishing the attacker. You're using the same principles attackers use
558310	563150	against us against them. You know, you're trying to trick them into opening a file,
563150	568610	into taking an action that's going to trigger one of these tripwires, that's going to trigger
568610	578630	some of these alerts, and let you know what the attacker's up to. So after they grab that,
578630	584190	you know, maybe they send it off to someone else, you know, they're going to sell the data.
584910	591410	But at this point, it doesn't matter. Anybody that opens this Word document, this token Word document,
591410	596810	is going to set off an alert. As soon as it's opened, you know, before you've even seen the
596810	601230	contents of that file, it could be blank. You know, it doesn't matter how clever the file
601230	607510	is, how cleverly you've made the ruse, you could have just been lazy and left it completely blank.
607650	612010	And by the time the attacker knows that, it's already sent off an alert with some of their data
612010	619390	attached to that. And the Canary admin gets the alert and sees the details of who opened it,
619390	625830	where they opened it. And you know what's going on, you know that that file has left
625830	636100	that secure environment wherever you stored that file. Alright, so what can these alerts tell you?
636100	639680	And at this point, we're going to jump into an interactive demo here.
640420	653550	I'm going to leave the slides behind. Alright, see how big we can make this without it going
653550	666220	off the screen here. Alright, so this is my console here. I've got two Canaries running.
667000	674360	One looks like a Cisco and one is set up as a Synology NAS. And then I've got my command line
674360	680080	here. I'm just going to use this to run some nmap scans against these hosts here, just so you can
680080	685920	see what it looks like when one of these alerts does go off. So I'm going to copy this IP address,
689780	699400	do a quick scan against it. Hopefully that's big enough to see there, make that larger.
709260	714400	Alright, so the attacker sees this, they see what they would expect to see on a Cisco router,
714400	718880	maybe an older Cisco router, it's still got Telnet open, MAC address is Cisco,
719160	727220	the operating system looks like Cisco, looks like a Cisco 1921 router. And as you probably noticed
727220	733580	there, as I ran that scan, we got a few alerts. So, you know, first thing we know when somebody
733580	737900	scans a Canary, if you have port scan detection enabled, you're going to get alerts when you get
737900	745880	scanned. And we can even tell that it was an nmap scan, you know, the OS flag and nmap is pretty
745880	752560	easy to detect. Nothing else really looks like it. So we know when we've been, somebody's doing
752560	759560	some OS fingerprinting with nmap specifically. So maybe the attacker tries to log into SSH,
759560	764080	you know, they saw SSH was open here, maybe they're hoping for some default credentials.
774060	780180	And just like SSH, you know, they try three times, you know, it doesn't work. There is no correct
780180	785680	username or password that's going to get you into Canary. They just exist, all these services exist
785680	790140	there for the attacker to spin their wheels, waste their time trying to get in. They could
790140	795960	try to get in through the web config there, which is just basic auth, nothing fancy here.
796700	802060	But they could, it could throw a brute force, you know, dictionary attack against it. All they're
802060	806980	going to do is generate more and more alerts for you to see what they're doing. So already we have
806980	811180	this picture here, you know, they painted this story of what they're trying to do. You know,
811180	816200	they've scanned the network, they found something interesting, they tried to log into it,
816200	820320	that didn't work. And they tried to log in a different way, that didn't work.
820700	827080	And, you know, you can see what this attacker is trying to do. And the main thing you're going to
827080	832060	use to pivot off of when you see an alert from one of these Canaries is probably going to be the
832060	836620	source IP. So some of these details can help you as well. You can see the username and password
836620	842520	that they tried. You can even see the remote SSH version that might tell you something about the
842520	847420	host that they're trying to get in from. You know, so some of these details might help you.
847460	853820	But this IP address and the reverse DNS, these are going to be the main things that you're
853820	858760	probably going to pivot off of, looking through Greylog, looking through Moloch,
858760	863980	some of these other tools, that's going to point you in the right direction. And then,
863980	868600	the rest of the tools that you saw today, if you watch any of those presentations,
869040	873860	those are going to help you build that investigation and figure out what's going on.
876820	882140	When they do hit a web server on the Canary, browsers are nice enough to hand off the user
882140	886660	agent that tells you a little bit more about the attacker. In this case, obviously, I'm using a Mac
886660	892480	and that's revealed through it. Of course, an attacker could, you know, they can change their
892480	899660	user agent. You know, they could even mask their IP address. But generally, you'd be able to tell
899660	906200	if that's happening as well. You know, there's other ways of telling that. All right, so that's
906200	916660	what that looks like. Just doing a scan and trying to log into a few things on the Cisco honeypot
916660	922040	there. And this one, the Synology NAS, is also fairly interesting. We're going to do a quick
922040	926900	scan of this one. It looks a little bit different. One of the key things that's different about it
926900	934880	is it has a file share. So we're going to run a quick scan against it.
936760	942940	Again, our results come back pretty quickly here. Mac address Synology services look like what
942940	950980	you'd expect of a file share in a network storage device. They do run Linux, you know, and that's
950980	957740	what comes back as. So, you know, maybe the attacker, any attacker that sees an open file share, you got
957740	963780	to know what's on that file share, right? So we're going to pop in there and take a look.
967260	971140	And by default, we're going to make it pretty easy for them to get on there. You know, you could
971140	977280	lock it down, make them use some stolen credentials to get in there. But we really want to know what
977280	981860	they're interested in. So we're going to make it easy. You know, so with a guest login, they can get on
981860	986760	there. They can see the different files on there, you know, and this is where it gets interesting.
986760	993080	If you've got files that look like they have different types of data, depending on what they
993080	997260	go after, you know, maybe in this case, they're going to go after the router config. You know, they're
997260	1001360	still hung up on that Cisco router. They really want to get in there. They want to check out this
1001360	1007880	config, see how it's configured. Bummer, looks like the file's password protected. That's as far as
1007880	1012680	they go with that. Maybe they're trying on a few others here. But you get to see which files
1012680	1018260	they're interested in, which files they go after. So we see here in the alert, they went right after
1018260	1025340	that Cisco router config. And again, by now, you know, this has painted a pretty nice picture.
1025340	1030780	You know, we know who the attacker is. We know they're scanning the network, and we know
1030780	1036060	they're trying to get into things. So pretty clear picture of what's going on. And that's really
1036060	1041080	the goal of the product here, is to paint a clear picture that, you know, that yes, this is
1041080	1048740	probably a malicious attack, and we need to investigate it. That early breach detection.
1048740	1051900	So now you're going to take that, you're going to pivot to other tools,
1051900	1057880	and you're going to start to dive deeper. So I'm going to clean up these alerts real quick here.
1062240	1071360	And we will talk a bit about canary tokens. So like I mentioned before, where canaries let you
1071360	1076900	know when suspicious stuff is going on in the network, as we saw with scans, login attempts there,
1076900	1082660	canary tokens, you can go even deeper. You can complement that. Some of those files in that file
1082660	1087980	share I just showed you could have been token files. And what that means, so in the case of
1087980	1095200	the Word doc here, and as I mentioned before, you can even upload your own Word doc. So I can take
1095200	1103620	my fake pen test results here. I can just, I need to give it a memo. So one of the key things here
1103620	1111440	is you really want to use one token per location. So, you know, maybe I'm going to put this on my
1111440	1120880	secret flash drive. I don't know why it's secret. It's just a flash drive. I only have one flash
1120880	1127740	drive. Let's say that. So I'm going to put that there. I'm not going to put it in my email. I'm
1127740	1132860	not going to put it on my desktop. It's only going to exist on that flash drive. So if I see
1132860	1137560	any alert from this canary token, I know somebody's got my flash drive.
1139740	1144000	Simple as that, because that's the only way somebody could have found this token.
1145680	1151900	So we download that. And remember, this was an existing Word doc that I had.
1152800	1159300	You know, I haven't done anything special to this. It's just a normal Word doc that you can grab,
1159300	1166060	you can upload, and we've just added a token to it. So the attacker opens it up. There's
1166060	1173240	no indication that this canary token has sent out anything. There's no indication that
1173700	1181160	the attacker has fallen into a trap here. But in fact, it has sent out several alerts.
1182160	1189980	Our Word doc canary tokens have what we call our DNS primitive, our DNS tokens embedded within it,
1189980	1195040	and our web tokens embedded within it. And part of the reason we do that is because it doubles
1195040	1202060	our chance of getting the alert out. On some networks, maybe HTTP port 80 isn't allowed
1202060	1208980	outbound. You know, only HTTPS is allowed outbound. So this wouldn't have gotten back
1208980	1215820	to the console. But as long as the person that opened that Word file had working DNS,
1215820	1221760	we would still get that back. You know, so we've got a really good chance of knowing when somebody
1221760	1228760	opens one of these Word docs. And you can see we get a, you know, the user agent here doesn't give
1228760	1233820	as many details, but we can see what version of Office they've got. But the key information here
1233820	1240660	is somebody would have had to have physical access to my flash drive for this alert to trigger. And
1240660	1245120	they were interested in this file out of all the files that were on my flash drive. This is,
1245120	1250560	you know, the first token file that they opened. Let's say I had multiple token files on there with,
1251040	1255840	you know, different file names suggesting they have different types of data in them.
1255840	1259760	And they went after this one first. So that's useful to me also.
1260140	1267860	And then I've got the, you know, both the DNS server that handed off that DNS token that triggered.
1267860	1275120	And then the web token got out as well. So, you know, that's my actual IP address that's assigned
1275120	1281080	to me by my ISP. That's what the web server sees when this Word document opens and it reaches back
1281080	1285480	the canary token server that lives on the console here.
1285880	1291100	So a couple useful pieces of information there that I can leverage.
1294460	1302060	So, yeah, that's the Word.canary token. We do have, as you can see here, there's different
1302060	1308700	tokens for all sorts of different purposes. And this is pretty similar to what canarytokens.org
1309280	1314740	shows. I think we have almost every single one of these tokens there as well.
1314880	1318480	The other one I'm going to show you here is the QR code token.
1319100	1324680	This is a fun one because it's very versatile. There's a lot of ways that we see QR codes used
1324680	1335420	in technology today. So setting up your multi-factor authentication, setting up,
1335420	1344640	um, enrollment, you know, maybe into your MDM, EMM product. You know, you see them out and about
1344640	1350020	in physical places all the time. You know, scan here for more information about this house that's
1350020	1354900	for sale, that kind of thing. So the sky's the limit for how you can use these. You can use
1354900	1361260	them digitally or you can use them in physical environments. So let's say I want to know if
1361260	1366480	somebody gets into Adrian's lunchbox. You know, I don't want to know if somebody's just touched
1366480	1378160	my lunchbox. I want to know if they've actually opened it. Because I've stuck this QR code on the
1378160	1385260	inside of my lunchbox. I've printed this out, stuck it in there, um, you know, maybe put some
1385260	1392180	text around it like, uh, recipe for Adrian's, uh, you know, Adrian's secret recipe, you know,
1392180	1397860	handed down through the generations. Something to that, uh, that respect. You know, something
1397860	1405500	somebody would be really interested in scanning. So I put this QR code there. If I ever get an
1405500	1410280	alert on this, I know somebody has not only touched my lunchbox, but they've opened it up,
1410280	1414660	they spotted the QR code on the inside, they read the words around it, and they chose to scan it
1414660	1419920	with their phone. You know, that's the only way I would get that figure. So that's the power there.
1419920	1425360	And, uh, we've seen people put these in all kinds of locations. Um, I think one of my favorites
1425920	1430940	is somebody told me that the, uh, they print this out on a sheet of paper, they put the words
1430940	1435820	Microsoft Authentic Recovery, uh, around it, and they just leave that sheet of paper on their desk
1435820	1445760	at work and just wait. And, uh, that's great. Four people are checking out my lunchbox.
1445760	1450020	They want to see that secret recipe. I know this one is me. You know, we, first of all,
1450020	1454780	we just saw that source IP. Everybody knows this is me by now. Uh, we'll actually do a
1454780	1462020	GeoIP look up here, um, get some details there. Uh, and, uh, you know, we can even see what kind
1462020	1467840	of phone I'm using here. You know, we, you get different, uh, details out of these user agents,
1467840	1473560	depending on, on how they're scanned, what devices scan them. Um, you know, so maybe
1473560	1479100	there's some crazy situation where that, those kinds of details are useful. But, um, you know,
1479100	1485440	the key point here again is I've only put this token one place. You know, it took me 30 seconds
1485440	1491320	to do it, to scan it out, uh, tape it to the inside of my lunchbox. Um, but I can just leave
1491320	1496540	it there forever. And if I ever get a trigger off of that, I know that somebody has been in that
1496540	1501060	lunchbox. And maybe that lunchbox is, maybe it's not a lunchbox. Maybe it's a data center. Maybe
1501060	1506940	it's a network closet. Maybe it's underneath the battery on a laptop, you know, all kinds of
1506940	1511420	different places that you could hide these. It looks like we've got somebody from Oklahoma that
1511420	1515520	scanned it. Again, you know, if you're coming through a VPN or something like that, that would
1515520	1525660	be reflected here. Uh, but we've got, uh, an Android, uh, Pixel 3 XL. Um, we've got, uh,
1525660	1532580	Mission Viejo, somebody coming from California. And, uh, a lot of these user agents will, um,
1532580	1537720	refer to the application used, uh, to open it. Like I think that previous one we looked at,
1537720	1545560	uh, ZXING, that's a barcode scanner app. And then one more here, uh, that would be Bradley.
1546280	1552900	Uh, Bradley's in, uh, up very early in the morning in South Africa and scanned it with his iPhone.
1556170	1562150	So hope that helps to, to demonstrate the, the power of how you can use these tokens, um,
1562150	1566750	and, and how the canaries are used. And most importantly, when you see alerts from these,
1566750	1571110	understanding what the attacker had to do to trigger those alerts and what it tells you about
1571110	1576590	the attacker, where they are, and maybe even their, their motivations and where they're going to go
1576590	1584170	next. And help you pivot between, uh, some of the different applications here. So really that's,
1584690	1589170	that's it in a nutshell. I think we still have 20 minutes. If there's any questions,
1589170	1596330	we could absolutely take some of those. Bradley, I appreciate it. This was a great,
1596330	1600290	uh, great presentation. I did mark down a couple of questions that were asked during the
1600290	1607290	presentation. Uh, does carrot, does canary token create, uh, or does the canary token created
1607930	1613610	based off of the session plus protocol plus application? Is that, uh, uniquely identified?
1615930	1625870	Um, I'm not sure I understand the question. Um, based off the... so it might help to talk about
1625870	1630430	the primitives a bit more. That, that might answer the question if I talk about the web and DNS
1630430	1637830	tokens that are kind of, uh, sit behind this. Yeah, I think that would be, um, the way to go,
1637830	1642910	Adrian, is to look at how the token is being created. Because I think the question is related
1642910	1651910	to whether it's being tripped by the protocol or the application. Okay. Yeah. So first one I'm
1651910	1658670	going to create here is a web token. And I'm going to create a fake email in my inbox that makes it
1658670	1664370	looks like, uh, if an attacker gets in my inbox, maybe they get all my passwords. They get access
1664370	1672530	to my last pass instance or something like that. So I can take this web token and I'm going to
1672530	1679070	create a link in this email that this fake email that I put in my inbox, and I'm gonna basically,
1679070	1684590	uh, phish, you know, or social engineer the attacker into clicking it. And so what we're
1684590	1690010	actually calling a token is this bit right here. This is the actual token that the web server is
1690010	1695890	looking for. And this address here, and if you're using canarytokens.org, you know, it would be
1695890	1700330	something based on that. You can run your own canary token server, use it on your own domain,
1700970	1706630	you know, run your own docker canary token server. So this could be anything you want.
1706650	1712810	This could also be anything you want. You know, we could name that admin files. We could name this
1716370	1721350	password.db. And that's still going to trigger an alert when we go to that.
1722470	1728690	So at its base component, and when we just demonstrated the QR code token, that's just
1728690	1735710	using an embedded web token. So super simple way of doing it by reaching out, touching a web server
1736430	1742890	with this token here, we know to map that back to Adrian's inbox. We know that that's the token
1742890	1751110	associated with this memo, with this reminder that I set for myself. So I hope that answers
1751110	1759470	the question of how that, how the token itself works. And that's the same token that we have
1759470	1765550	embedded in a lot of these other ones. So the word file has a web token embedded in it.
1766190	1770670	You know, I mentioned the QR code does, you know, and several of these others do.
1770850	1779430	The other, what we call our token primitive is DNS. So again, there's ways to get,
1779430	1787930	if somebody gets in my inbox, we can get a DNS name to resolve. So if I were to just copy this
1787930	1793950	DNS name, and again, here, this bit is the token, you can tell kind of from the length of it.
1793950	1800210	And really, it's a C name on the front of this domain, you know, that maps back to us.
1801090	1804750	So if I do an NS lookup on that,
1805350	1813590	I get an alert. So wherever I've, that NS address, if anyone resolves it, if it gets resolved for
1813590	1819630	any reason, maybe I'm just sending it in clear text on the network. Somebody captures that
1819630	1824150	traffic with Wireshark, and they view that traffic, and they tell Wireshark to resolve
1824150	1828230	all the DNS addresses, that would trigger it, you know, something as simple as that.
1828230	1836050	But if I can find files, you know, any kind of tricks, any kind of ways to get a DNS
1836050	1841950	address resolved, that can trigger a token and send me an alert.
1843170	1850130	Yeah, just to add on to what Adrian mentioned, is that we're embedding HTTP requests and a DNS
1850130	1857190	request inside of a document, and we're relying on, when the document gets opened with MS Word,
1857190	1865590	for instance, MS Word reaches out with those, to those URLs of the DNS. So it's MS Word,
1865590	1869930	the application itself, that's looking up those requests that I embedded into the
1869930	1872870	document, and that's what's triggering the alert.
1874250	1878310	Yeah, and that's important to note, you know, some of these require action from the attacker,
1878310	1883570	like in my example of the fake email in my inbox, I've got to get, I've got to convince
1883570	1889170	them to click that link. In other cases, like Bradley's example with the Word doc,
1889170	1893890	simply opening it is all they need to do. You know, they don't see it,
1893890	1899090	it happens in the background, they don't even know that those alerts have been triggered.
1900530	1902890	And there's nothing else that they need to do.
1908390	1914510	Well, I appreciate it. Thank you, Bradley. Thank you, Adrian. This has been a great presentation.
1914510	1924610	So this concludes the presentation for the workshop for Canary. In any case, if you have
1924610	1930590	any follow-up questions, the speakers will be around in the Discord for a few minutes. And
1930590	1938390	again, the Discord that we are chatting in is the text dash workshops dash track one,
1938390	1942970	in the Flamingo Hotel group, just scroll all the way down to the bottom.
1943510	1948070	And so if you guys could sort of come down, I think there's a couple of questions. If you
1948070	1952530	have some follow-up, that would be great. Otherwise, I appreciate everybody listening
1952530	1954870	in today and thank you very much for attending.