Step 3 of 8
Deploying lures
HoneyNet is seeding deceptive assets across your environment. All changes are logged and reversible.
✓ Complete
31 assets deployed in 2m 14s
$ honeyd deploy --posture balanced --tenant corp.contoso.com
[01] Authenticating to Microsoft Graph API…
✓ Entra ID tenant: corp.contoso.com (GUID 7a83c4f…)
[02] Scanning existing service accounts…
Found 1,847 accounts. Identifying safe namespace.
✓ Namespace reserved: svc-hn-{uuid}@corp.contoso.com
[03] Creating fake Entra ID service accounts (8)…
✓ svc-hn-backup-01@corp.contoso.com
✓ svc-hn-deploy-02@corp.contoso.com
… 6 more accounts created
[04] Provisioning M365 honeypot mailboxes (4)…
✓ fake_admin@corp.contoso.com — inbox active, monitoring enabled
✓ it-helpdesk-noreply@corp.contoso.com — inbox active
… 2 more mailboxes created
[05] Seeding AWS S3 ghost buckets (8) and DNS decoys (6)…
✓ corp-backup-archive-hn17 (us-east-1) — contains ghost objects
✓ internal-logs.corp.contoso.com → 10.0.99.7 (honeypot)
… 12 more assets created
[06] Creating false Secrets Manager entries (5)…
✓ /prod/legacy/db-admin — fake PG connection string
… 4 more secrets created
[07] Configuring canary tokens on all lures…
✓ Canary tokens active on 31 assets
[DONE] 31 lures deployed. HoneyNet is live and monitoring.
Alert channel: security@corp.contoso.com + Slack #soc-alerts
🛡️
Coverage active
31 lures seeded across 5 attack surfaces. Any interaction triggers a real-time alert with MITRE mapping. Estimated mean time to detection: < 1 hour for an active attacker.