Epic: Third-party SaaS honeytokens — fake credentials in Datadog, Salesforce, AWS

[LiorFink00]

Goal

A new honeytoken plugin kind that creates fake credentials inside third-party SaaS platforms via their APIs, and detects use by polling each platform's activity/audit log — alerting through thumper's existing pipeline.

Third parties

• Datadog — create canary API keys, poll the audit trail for usage
• Salesforce — canary user/token, poll the login/event log
• AWS — canary IAM credential, poll for use

Architecture

Extends the plugin system (_KINDS gains "honeytoken"). New HoneytokenPlugin base (create_token/revoke_token/poll_usage → TokenUsageEvent), a background usage poller, honeytoken API routes + DB tables, and a "Third Party Software → SaaS" UI area.

Task breakdown (each → its own PR)

• 1. Base class, DB models, migration, store layer — HoneytokenPlugin + TokenUsageEvent; add "honeytoken" to _KINDS — feat(honeytoken): plugin kind + DB models + store (epic #256 Task 1) #265
• 2. API routes + Pydantic models — feat(honeytoken): API routes for connections + tokens (epic #256 Task 2) #266
• 3. Background usage poller — detect use → create alerts — feat(honeytoken): background usage poller (epic #256 Task 3) #267
• 4. Datadog plugin — feat(honeytoken): Datadog provider plugin (epic #256 Task 4) #268
• 5. Salesforce plugin — feat(honeytoken): Salesforce provider plugin (epic #256 Task 5) #269
• 6. AWS plugin — feat(honeytoken): AWS provider plugin (epic #256 Task 6) #275
• 7. UI — SaaS honeytokens page, nav, types/client — feat(honeytoken): Third Party SaaS UI — connections + honeytokens (epic #256 Task 7) #276
• 8. Provider logos + visual polish — feat(honeytoken): provider brand logos + polish (epic #256 Task 8) #277

Ports the enterprise implementation (Apache-2.0) task-by-task with tests. No enterprise-only subsystems or secrets are brought over.

---

✅ All 8 tasks complete — see PRs #265, #266, #267, #268, #269, #275, #276, #277 (stacked).