The Deploy Wizard allows you to create and deploy Deception VMs on your network. These Deception VMs appear as real endpoints to the hacker and can collect valuable information about attacks.
- Go to Deception > Deploy Wizard.
- Click + to add a Deception VM.
- Configure the following:
Specify the name of the deployment profile in 1-15 characters. A-Z, a-z, 0-9, dash or underscore allowed. Cannot be duplicate of the existing profile name.
Select one of the available VM Images. Windows or Ubuntu VM Images are available.
The selected services are shown. This field is not editable.
- Set SSH or SAMBA to ON for an Ubuntu VM. Set RDP or SMB to ON for Windows.
- Click Add Decoy for the respective service and configure the following:
Specify the username for the decoy in 1-19 characters. A-Z, a-z, or 0-9, allowed.
Specify the password for the decoy in 1-14 non-unicode characters.
Specify a Sharename in 3-63 characters. A-Z, a-z, or 0-9, allowed. This option is for a SAMBA (Ubuntu) or SMB (Windows).
Update or Cancel
Click Update to save the username and password. Click Cancel to discard the username and password. Click Delete to delete an existing decoy.
- Repeat step 5 to add more decoys.
- Switch Launch Immediately to ON to launch the Deception VMs.
- Click Next.
- Specify the Hostname in 1-15 characters.The hostname can start with English characters/digits, and must not end with a hyphen. It may contain only the ASCII letters a through z (in a case-insensitive manner), the digits 0 through 9, and the hyphen ('-'). No other symbols, punctuation characters, or white space are permitted. Hostname cannot conflict with existing Decoy names.
- Click Add Interface.
- In the Add Interface for Deception VM screen, select the Deploy Interface. This is the VLAN or Subnet added in the following topic: Set up the Monitored Network
- Configure the following settings in the Add Interface for Deception VM screen:
- Click Done.
- Click Template to save as a template. The template is visible with the Profile Name in Deception > Deploy Wizard.
- Click Deploy to deploy the decoys on the network.