Agents/Deceptor
Deceptor

Deceptor

Sets the trap Active

Deploys decoys and traps across the environment to lure attackers, capture their tactics, and buy the team time.

12
Decoys armed
2
Attackers engaged
7
TTPs captured
16:00:36
Last engagement
Honeypot assets
Decoys the Deceptor has deployed across the environment
🍯
honey-db-02
Decoy database · Attacker ran 4 SELECT queries at 16:00:38
Engaged
🍯
Decoy credentials (Lambda env)
Canary access keys · Used at 16:00:36 — any use is malicious by definition
Triggered
🍯
honey-s3-backups
Decoy bucket · Named to look like prod backups · no touches
Armed
🍯
honey-admin-portal
Decoy login · Fake console · no touches
Armed
Attacker engagements
How the decoys were used — captured in real time
16:00:36
Attacker authenticated with the decoy credentials from 2.54.178.107.
16:00:38
Ran 4 SELECT queries against honey-db-02 — captured queries, client User-Agent and timing.
16:00:41
Confirmed hands-on-keyboard intent; fingerprint handed to Hunter and Investigator.