feat(security): deploy OpenCanary honeypot on VLAN 50 with Gotify and Discord alerting

scripts/check_recent_ak_events.py

@@ -0,0 +1,38 @@
+import urllib.request
+import ssl
+import json
+import sys
+
+sys.stdout.reconfigure(encoding='utf-8')
+
+ctx = ssl.create_default_context()
+ctx.check_hostname = False
+ctx.verify_mode = ssl.CERT_NONE
+
+AK_BASE = "https://authentik.snarfnet.net"
+AK_TOKEN = "SnarfNetPermanentAutomationToken2026"
+
+headers = {
+    "Authorization": f"Bearer {AK_TOKEN}",
+    "Content-Type": "application/json",
+    "Accept": "application/json"
+}
+
+req = urllib.request.Request(f"{AK_BASE}/api/v3/events/events/?page_size=40", headers=headers)
+with urllib.request.urlopen(req, timeout=10, context=ctx) as r:
+    data = json.loads(r.read().decode())
+    for ev in data.get("results", []):
+        created = ev.get("created")
+        action = ev.get("action")
+        user = ev.get("user", {}).get("username")
+        ctx_data = ev.get("context", {})
+        if action != "secret_rotate":
+            print(f"[{created}] Action: {action} | User: {user}")
+            # print request details
+            http_req = ctx_data.get("http_request", {})
+            if http_req:
+                print(f"   Path: {http_req.get('path')}")
+                print(f"   Args: {http_req.get('args')}")
+            if "message" in ctx_data:
+                print(f"   Message: {ctx_data.get('message')}")
+