Deploy Decoy VMs with the Deployment Wizard
Use the Deception > Deployment Wizard page to create and deploy Decoy VMs on your network. Decoy VMs appear as real endpoints to hackers and can collect valuable information about attacks.
To deploy Decoys on the network:
- Go to Deception > Deployment Wizard.
- Click + to add a Decoy VM.
- Configure the following:
- If applicable, click Generate lures or Add Lure for the service and configure the lure settings. See, Lure Settings.
- To launch the decoy VM immediately, enable Launch Immediately.
- To reset the decoy VM after it detects incidents, enable Reset Decoy and specify the Reset Interval value in seconds.
- Click Next.
- Specify the DNS and Hostname. The Hostname can start with an English character or a digit, and must not end with a hyphen. Maximum 15 characters using A-Z, a-z, 0-9, or hyphen (case-sensitive). Other symbols, punctuation, or white space are not allowed. The Hostname cannot conflict with decoy names.
- Click Deploy Into Network.
- Select the Deploy Interface. Set this to the VLAN or subnet added in Set up the Deployment Network
- Configure the following settings in the Add Interface for Decoy pane:
- Click Done.
- To deploy the decoys on the network, click Deploy.
- To save this as a template in Deception > Deployment Wizard, click Template.
For deception strategies and examples, see Deployment best practices checklist and Deception decoy best practices |