# Tutorial: plant your first estate tripwire

This lab walks through Ops plant → place artifact → (optional) decoy read →
Investigate. Use a disposable lab only.

## 1. Start Ops

From the repo root, start the Ops GUI with `CYBERHALLUCINET_REPO_ROOT` pointing
at the checkout. Open **Manage → Canaries**.

## 2. Plant a CI/CD secret

1. Decoy session: `sess-lab-1`
2. Owner: `soc-lab`
3. Kind: **CI/CD secret**
4. Location: `github/actions/LAB_DEPLOY_TOKEN` (must be unique)
5. Environment: `lab`
6. **Plant tripwire**: copy the one-time token shown in the UI

The planted artifact text has no honeypot labels. Store the token only in the
documented location (or a lab secrets store).

## 3. Import hunting queries

The plant API response includes KQL, SPL, and EQL templates that mention the
token or hash. Paste into your SIEM lab index (optional for this tutorial).

## 4. Optional: decoy VFS read

If you run a Contained sensor with endpoint packs, reading
`~/.aws/credentials` inside the decoy VFS triggers an in-sensor tripwire
(not a host auditd agent). Confirm telemetry shows `agent.canary_observed`.

## 5. Investigate

Enable Investigate ingest, sync, and look for the canary / campaign link for
`sess-lab-1`.

## 6. Revoke

Revoke the token from the Canaries table. State becomes `tombstone_revoked`;
the row remains (no hard delete).

## Next steps

- [Tripwire planter how-to](../how-to/tripwire-planter.md) (production-testing wire)
- [Tripwires and breadcrumbs](../explanation/tripwires-and-breadcrumbs.md)