Fortinet Document Library

Version:

Version:


Table of Contents

Related Videos

Deploy FortiDeceptor's Linux Decoy & Incident View

  • 192 views
  • 2 months ago

FortiDeceptor SCADA Decoy Demonstration

  • 472 views
  • 2 months ago

FortiDeceptor ARAE & Fabric Integration in Action

  • 112 views
  • 2 months ago
Download PDF
Copy Link

Introduction

FortiDeceptor creates a network of decoy VMs to lure attackers and monitor their activities on the network. When attackers attack decoy VMs, their actions are analyzed to protect the network.

Key features of FortiDeceptor include:

  • Deception OS: Windows, Linux, or SCADA OS images are available to create Decoy VMs.
  • Decoy VMs: Decoy VMs that behave like real endpoints can be deployed through FortiDeceptor.
  • Lures: Lures are services, applications, or users added to a Decoy VM to simulate a real user environment.
  • FortiDeceptor Token Package: Install a FortiDeceptor Token Package to add breadcrumbs on real endpoints and lure an attacker to a Decoy VM. Tokens are normally distributed within the real endpoints and other IT assets on the network to maximize the deception surface. Use tokens to influence attackers' lateral movements and activities. Examples of what you can use in a token include: cached credentials, database connections, network share, data files, and configuration files.
  • Monitor the hacker's actions: Monitor Incidents, Events, and Campaign.
    • An Event represents a single action, for example, a login-logout event on a victim host.
    • An Incident represents all actions on a single victim host, for example, a login-logout, file system change, a registry modification, and a website visit on a single victim host.
    • A Campaign represents the hacker's lateral movement. All related Incidents are a Campaign. For example, an attacker logs on to a system using the credentials found on another system.
  • Log Events: Log all FortiDeceptor system events.

Related Videos

Deploy FortiDeceptor's Linux Decoy & Incident View

  • 192 views
  • 2 months ago

FortiDeceptor SCADA Decoy Demonstration

  • 472 views
  • 2 months ago

FortiDeceptor ARAE & Fabric Integration in Action

  • 112 views
  • 2 months ago

Introduction

FortiDeceptor creates a network of decoy VMs to lure attackers and monitor their activities on the network. When attackers attack decoy VMs, their actions are analyzed to protect the network.

Key features of FortiDeceptor include:

  • Deception OS: Windows, Linux, or SCADA OS images are available to create Decoy VMs.
  • Decoy VMs: Decoy VMs that behave like real endpoints can be deployed through FortiDeceptor.
  • Lures: Lures are services, applications, or users added to a Decoy VM to simulate a real user environment.
  • FortiDeceptor Token Package: Install a FortiDeceptor Token Package to add breadcrumbs on real endpoints and lure an attacker to a Decoy VM. Tokens are normally distributed within the real endpoints and other IT assets on the network to maximize the deception surface. Use tokens to influence attackers' lateral movements and activities. Examples of what you can use in a token include: cached credentials, database connections, network share, data files, and configuration files.
  • Monitor the hacker's actions: Monitor Incidents, Events, and Campaign.
    • An Event represents a single action, for example, a login-logout event on a victim host.
    • An Incident represents all actions on a single victim host, for example, a login-logout, file system change, a registry modification, and a website visit on a single victim host.
    • A Campaign represents the hacker's lateral movement. All related Incidents are a Campaign. For example, an attacker logs on to a system using the credentials found on another system.
  • Log Events: Log all FortiDeceptor system events.