01 ·
Package installed by you
You install the package yourselves: it is verified with SHA-256 and registered with a single-use registration code.
Deception: decoys in the network and DMZ, whoever touches them is hostile.
The Deception module of the Fortgale Defence Platform places decoys installed by you in the internal network or a DMZ. No legitimate traffic touches them, so every contact is a signal. The result is a dashboard in the portal.
Decoy services
SSH
Telnet
Common network protocols
Where
Internal network
DMZ
How it works
How it works.
Decoys that no legitimate user has any reason to touch: that is why every contact counts as a signal.
02 ·
Internal network or DMZ
Decoys sit in the internal network or in a DMZ with a public address, where whoever probes the company arrives first.
03 ·
Decoy services
They expose SSH, Telnet and common network protocols. No legitimate traffic should touch them: every contact is a signal.
In the portal
What you see in the portal.
In the Fortgale Defence Platform dashboard you find the sources, the credentials tried, the malware and the commands executed. Reputation, country and ASN of the hostile sources can be reused on the real perimeter. The state of the decoys is always visible; the reading window is 7 or 30 days and history goes back 90 days.
MDR
With MDR or on its own.
Deception can be activated without other services: with an MDR domain the events join the defence cycle, on their own they stay in the portal. The service that reads them: Managed Detection and Response.
More decoys
One decoy included, more on request.
One decoy is included. More decoys can be added on request, for different sites or network segments.
Limits
What Deception does not do.
It does not send alerts or notifications, does not export data, is not an IDS or an NDR and does not inspect network traffic. It does not replace EDR and SOC and produces no periodic report.
FAQ
Frequently asked questions about Deception.
Do I need an MDR service?
No. Deception can be activated on its own. With an MDR domain the events join the defence cycle; on their own they stay in the portal.
Where is it installed?
In the internal network or in a DMZ with a public address. The package is verified with SHA-256 and registered with a single-use code.
Is whoever touches a decoy really hostile?
No legitimate use reaches them, so yes, except for declared internal scans. Every contact is a signal to read.
How many decoys do I need?
One is included. More decoys can be added on request, for different sites or network segments.
Deliverable
A dashboard in the Fortgale Defence Platform.
Deliverable: dashboard in the Fortgale Defence Platform, no periodic report included. The platform with all modules: Fortgale Defence Platform.
What is on your network
Whoever probes your network leaves a trace.
Let us talk about where to place decoys and how to read the events. SOC in Milan, operating since 2017, 24·7·365.