4.4 Password Policies
4.4.1 Credential-Based Detection Policies#
The Credentials sub-tab within the Settings Policies tab (see Section 2.15.2.1) manages credential-based security policies. The Credential Policy List table displays the following columns:
| Column | Description |
|---|---|
| Name | Policy identifier |
| Type | Policy classification (e.g., LIST) |
| Control List | Items governed by this policy |
| Exception List | Excluded items from the policy |
| LDAP | LDAP integration status |
| Hit Count | Number of times the policy was triggered |
| Actions | Edit, Detail, and Delete |
4.4.2 Credential List Management#
Clicking Credential List in the left sidebar (see Section 2.15.2.1.1) displays the credential policy overview. The list shows each policy name with three action buttons:
| Button | Function |
|---|---|
| Update Credential | Edit the credential policy |
| Credential List Detail | View detailed policy information |
| Delete | Remove the credential policy |
Click the Add button to create a new credential entry with the following parameters:
| Parameter | Description |
|---|---|
| Name | A descriptive name for the credential entry |
| Credential | The credential value (username/password combination) |
4.4.3 Exception List#
The Exception List within the Credentials sub-tab (see Section 2.15.2.1.2) manages exception entries for credential policies. Click the Add button to create an exception:
| Parameter | Description |
|---|---|
| Name | A descriptive name for the exception |
| Credential | The credential value to exclude from detection |
4.4.4 Creating a New Credential Policy#
Click New Policy in the left sidebar (see Section 2.15.2.1.5) to create a credential policy. The form includes:
| Parameter | Description |
|---|---|
| Name | A descriptive name for the new policy |
| Guardpot | Select a Guardpot agent from the dropdown |
| Policy Type | Policy classification (e.g., List) |
| Credential List | Select credential entries to include |
| Exception List (Optional) | Select exception entries to exclude |
4.4.5 Credential Monitoring#
The Monitoring module (see Section 2.11.6) includes a dedicated Credential tab for checking whether specific passwords have been captured by honeypot agents. Enter a specific password string to check whether it has been captured in any credential-based attacks across the honeypot fleet. Configure additional filters as needed and click Search to execute the analysis.
4.4.6 Alert Policy for Credential Events#
The Alert Policy within the Credentials sub-tab (see Section 2.15.2.1.4) configures notifications for credential events. Configure the following:
Add User or Group:
| Parameter | Description |
|---|---|
| Select Policy | Choose an existing policy to associate with alerts |
| Select User or Group | Choose users or groups to receive notifications |
Notification Channels — one or more may be enabled simultaneously: email, call, sms, push, slack, discord, telegram.
Alert Message Template — build using the following variable categories:
| Category | Available Variables |
|---|---|
| Time | Time |
| Credentials | Username, Password |
| Location | Agent Location, Attacker Location |
| Header | Agent Name, Agent IP, Agent Description, Agent OS |
| Other Logs | Port, Attack Time, Attack Type, Attacker IP |
Was this article helpful?
Your feedback helps us improve the documentation.