--- title: Cyber Deception with Koney and Dynatrace | daily.dev description: Koney is an open source Kubernetes operator from Dynatrace that automates honeytoken deployment across container workloads. It lets you define DeceptionPolicy... canonical: https://daily.dev/posts/cyber-deception-with-koney-and-dynatrace-gkcqyrxrh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cyber Deception with Koney and Dynatrace | daily.dev og:description: Koney is an open source Kubernetes operator from Dynatrace that automates honeytoken deployment across container workloads. It lets you define DeceptionPolicy... og:url: https://daily.dev/posts/cyber-deception-with-koney-and-dynatrace-gkcqyrxrh og:image: https://api.daily.dev/og/posts/gkcqyrXRH.png og:image:alt: Cyber Deception with Koney and Dynatrace og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cyber Deception with Koney and Dynatrace **[Dynatrace](https://daily.dev/sources/dynatrace)** · 10 min read · 0 upvotes · 0 comments ## Summary Koney is an open source Kubernetes operator from Dynatrace that automates honeytoken deployment across container workloads. It lets you define DeceptionPolicy custom resources to place realistic-looking fake credential files (e.g., AWS credentials) in strategic paths inside containers. When an attacker reads these files, Tetragon's eBPF-based kernel tracing detects the access and Koney generates a structured alert with full context — pod name, namespace, process binary, PID, and UID. Alerts can be forwarded to Dynatrace as security events for investigation and automated response workflows. The walkthrough covers installing Koney and Tetragon via Helm, writing a DeceptionPolicy, verifying honeytoken injection, triggering and observing alerts, and configuring a DeceptionAlertSink to push findings into Dynatrace's Threats & Exploits app. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Kubernetes Runtime Security : The Guide](https://daily.dev/posts/kubernetes-runtime-security-the-guide-frxt8zpgj) · cilium · 8 upvotes · 0 comments - [Building potctl: How I Made My Honeypot Lab Controllable with Go for DeceptionX](https://daily.dev/posts/building-potctl-how-i-made-my-honeypot-lab-controllable-with-go-for-deceptionx-103zic2cq) · Medium · 0 upvotes · 0 comments - [Automating Confidential Containers \(CoCo\) infrastructure with Kyverno](https://daily.dev/posts/automating-confidential-containers-coco-infrastructure-with-kyverno-rcxzucnzl) · CNCF · 0 upvotes · 0 comments - [Honeytokens on the Developer Workstation: When Cleanup Takes Time](https://daily.dev/posts/honeytokens-on-the-developer-workstation-when-cleanup-takes-time-9uf0dgkgo) · GitGuardian · 0 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/cyber-deception-with-koney-and-dynatrace-gkcqyrxrh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cyber Deception with Koney and Dynatrace","url":"https://daily.dev/posts/cyber-deception-with-koney-and-dynatrace-gkcqyrxrh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cyber-deception-with-koney-and-dynatrace-gkcqyrxrh"},"datePublished":"2026-07-27T17:32:59.726Z","dateModified":"2026-07-27T17:33:26.641Z","description":"Koney is an open source Kubernetes operator from Dynatrace that automates honeytoken deployment across container workloads. It lets you define DeceptionPolicy...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/21df801d29108db3afa3c7a2ecadc34a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/21df801d29108db3afa3c7a2ecadc34a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dynatrace","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dynatrace","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3ca5a9897e9748f4a39fa9736389609e","url":"https://daily.dev/sources/dynatrace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cyber-deception-with-koney-and-dynatrace-gkcqyrxrh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux,kubernetes","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dynatrace","item":"https://daily.dev/sources/dynatrace"},{"@type":"ListItem","position":3,"name":"Cyber Deception with Koney and Dynatrace"}]} ```