Lure placement strategies
Mirror real assets: if you run Fortinet VPN in production, deploy Fortinet VPN lures on adjacent naming patterns. Place high-value personas (GitHub Enterprise mimic, Grafana) where APT campaigns target your sector—not random unused subnets.
Realism and avoiding detection
Use DNS hostnames, valid TLS, and crawled clone content. Avoid obvious strings (honeypot, test-decoy) in titles and certificates. Rotate stale personas before scanners fingerprint them as unchanged bait.
High-value deployment
Monitoring recommendations
Review dashboard D/W/M trends daily; assign owner per workspace. Alert on Critical via Slack; weekly review suppression rules and top scanner groups.
Investigation workflows and escalation
Standard escalation path
Dashboard → threat details → copy IP
Investigation profile → analysis actions → C2 check
WAF block or campaign export to SIEM
Deploy/adjust lures via Automation from exploit trends