Introduction

FortiDeceptor creates a network of Decoy VMs to lure attackers and monitor their activities on the network. When attackers attack Decoy VMs, their actions are analyzed to protect the network.

Key features of FortiDeceptor include:

• Deception OS: Windows, Linux, SCADA OS, IoT OS, ERP OS, Medical OS, SSL-VPN OS, or POS OS images are available to create Decoy VMs.
• Decoy VMs: Decoy VMs that behave like real network assets can be deployed through FortiDeceptor.
• Deception Lures: Deception Lures are services, applications, or users added to a Decoy VM to simulate a real user environment.
• FortiDeceptor token package: Install a FortiDeceptor token package to add breadcrumbs on real endpoints and lure an attacker to a Decoy VM. Tokens are normally distributed within the real endpoints and other IT assets on the network to maximize the deception surface. Use tokens to influence attackers' lateral movements and activities. Examples of what you can use in a token include: cached credentials, database connections, network share, data files, and configuration files.
• Monitor the hacker's actions: Monitor Incidents, Events, and Campaign.
• An Event represents a single action. For example, a login-logout event on a victim host.
• An Incident represents all actions on a single victim host. Examples include, a login-logout, file system change, a registry modification, and a website visit on a single victim host.
• A Campaign represents the hacker's lateral movement. All related Incidents are a Campaign. For example, an attacker logs on to a system using the credentials found on another system.
• Log Events: Log all FortiDeceptor system events.