Updating a Connected Server

Updating a cloud-connected decoy server is incredibly easy.

If updating from the local server, simply go to settings and under 'Decoy Configuration', click the 'Update Decoys' or 'Update GUI' button.

Note: the update may take a couple of minutes to complete.

Once the package install completes, the new decoy definitions in the update are ready for use.

If updating from the cloud, go to Decoy Servers and flag the "Update Decoy Engine" action on the server(s) you wish to be updated. The update will commence on the next poll cycle.

Updating a Standalone Server

Updating a standalone server (for example, a server placed into a network without internet connectivity) is also relatively straightforward.

Per the delivery mechanism chosen, you will receive a new decoy package file from us.

First, use a method of choice to transfer the new decoy package file onto the decoy server host. For example, using scp as the transfer method:

Now that the new decoy package file is on the local decoy server, on the side navigation, go to Decoy Packages and select the active "default" package.

Under the package information screen, click 'Refresh' and you should see the new decoy package file under the header 'List of installable image packages'.

Click on the link to the new decoy package file and you should be presented with a overview of the new decoy package contents.

Then, simply click on "Install Package to Server" which will install the new decoy package onto the server.

Note! This may take a minute to complete.

Once the package install completes, the new decoy definitions in the package file are ready for use.

Deploy How-To

If you followed the documentation on your first deployment, you'll already be aware that you can deploy decoys both from the local Decoy Server as well as from the Capabilities page (if the local Decoy Server is connected to Defused Cloud.)

Detection Logic

The detection logic of decoys matches incoming attack traffic with the appropriate label best suited to gauge its severity.

Detection events are mapped on the decoy side to match the best hit within the decoy detection parameters. Alerts like 'Vulnerability Exploited' and 'Service Scan' can be generally considered to be highly accurate.

If a decoy has a vulnerability emulator enabled, traffic that does not exploit the vulnerability fully but is still recognized by the decoy is generally labelled as 'Possible exploit attempt.' Note that this is not a direct guarantee that the traffic was aiming to exploit, as sometimes e.g. a network scanner may trigger this in a vulnerability emulation.

Dynamic Sandbox

The Dynamic Sandbox creates a post-exploit sandbox environment where an attacker can be dropped into for further analysis of their actions.

The sandbox environments monitor and record attacker actions in real time, and also collect any files dropped by the attacker into the shell environment.

Not all decoy types currently contain sandbox environments - the Sandbox label denotes decoys with embedded sandbox environments when deploying via Capabilities.

Cloud Integration

The cloud enables management of the local decoy servers without having to actively log into the local servers.

Currently, you can remotely manage the following actions from the cloud:

• Alert Aggregration (collect all alerts from all servers into the cloud)
• New decoy deployment
• Decoy deletion from local environments
• Updating decoy definitions
• Updating the GUI (coming on the next update)

The local server uses your API key to communicate into the cloud. If you haven't already, generate yourself a key in Settings. Note that the key is only visible to you when generating it, so remember to store it somewhere, e.g. a password manager or a similar solution.

When the Cloud Integration is enabled, depending on the Poll Interval variable set on the local server, the local server checks the cloud for new actions to be done based on this interval. It is recommended to set the poll interval at a fairly low number, e.g. 120 seconds.

Capabilities

The Capabilities page in Defused Cloud contains ready-made templates for quickly deploying new decoy types into your local environments. A prerequisite for using Capabilities is enabling the Cloud Integration.

Capabilities contains both individual decoy templates that can be selected for deployment one-by-one and, as a developing functionality, Decoy Bundles which deploy multiple decoy types to cover a specific capability set on the network.

Teams

Adding team members to the Defused platform enhances collaboration by enabling users to share incidents, manage them, and communicate via the incident view.

Managing Teams

To begin the process, go to the Settings tab on your dashboard.

Inside Settings, click on the Team submenu.

Creating a Team

If you are not in a team yet and wish to create one, you can create a team by clicking the "Create Team" button. This will create a team for you and make you the administrator of the team.

Adding Members

Here you can add new team members by entering their email addresses. If the email is not found on the platform, an invitation is sent to them to sign up, and on signup the user is automatically added to your team.

Only team admins can add and delete new teammembers.

Sharing Incidents

Team members can share incidents with one another. This is useful for coordinating responses to issues.

Once team members are added, they can manage incidents and communicate with each other directly in the incident view.

Automation

Automation helps you discover and automate how to structure your decoy operations, for example by highlighting and automatically deploying relevant new decoy types to your decoy servers.

Automation is a beta feature and available only for Defused Enterprise Accounts.

Credits

Upcoming feature - full documentation coming soon.

Alerts

Alerts are generated when a decoy is attacked. Each alert is contextually labelled with useful details like CVE numbers denoting which attack vector was used, MITRE ATT&CK tactics, attacker source IP and further information where applicable, like a raw representation of the network data. This ultimate is designed to make it easier for the defender to make decisions on the alerts.

Defused has two ways to show you these alerts: 'Verbose' and 'Condensed.' In 'Verbose,' you see a detailed list of every single alert. In 'Condensed,' alerts from the same attacker and close in time are grouped together for quick review.

Incident View

You can group many alerts into one Incident. This lets you see related alerts together. You can also easily share this Incident with teammates using a special link.

If sandbox events occur, 'Incident Mode' activates automatically. This groups related alerts for you, no extra steps needed.

Forensics files

Decoys with the shell emulator enabled can collect files transferred into them by the attacker. The files become available for download for the user in the incident view tab. Files also persist on the decoy server in case the attacker attempts to delete the artifacts on the machine.

Integrations

ServiceNow

The ServiceNow integration allows you to connect your ServiceNow account to the application, enabling you to create and manage tickets directly from alerts. This integration helps streamline your incident management and ticketing process by connecting directly with your ServiceNow instance.

Configuration Status

The configuration status of the ServiceNow integration is displayed within the application. If the status is Configured, your ServiceNow account is successfully connected. If the status is Not Connected, you need to configure the integration.

Configuration Steps

1. ServiceNow Instance Location:

   Enter the URL of your ServiceNow instance in the format https://devXXXX.service-now.com/.

2. ServiceNow Credentials:

   Provide the username and password for your ServiceNow account.

3. ServiceNow Priority:

   Set the priority for tickets created from the integration. Enter a value between 1 and 5.

4. ServiceNow Table (Optional):

   Specify the ServiceNow table for the tickets. By default, tickets are created in the "incident" table. You can specify other tables like "problem" or "change."

5. ServiceNow Caller ID:

   Enter the caller ID for the tickets. Leave this field empty to use the default test account.

After filling in the required fields, click Link Accounts or Update Config to save your settings.

Usage

Once configured, the "Create Incident (ServiceNow)" button becomes available in each of the alert views.

Troubleshooting

If you encounter any issues with the integration, check the following:

• Ensure that your ServiceNow instance URL is correct and accessible.
• Verify that your ServiceNow credentials are valid and have the necessary permissions.
• Check if the ServiceNow instance allows API access and if the user has appropriate roles.
• Refer to the ServiceNow documentation for additional troubleshooting steps.

Slack

The Slack integration allows you to send events and alerts directly to a Slack channel of choice using an incoming webhook. This integration helps you keep your team updated in real-time by sending critical notifications to your preferred Slack channel.

Configuration Status

The status of the Slack integration is displayed within the application. If the status is Configured, your Slack webhook is successfully set up. If the status is Not Connected, you need to configure the webhook.

Configuration Steps

Follow these steps to configure the Slack integration using an incoming webhook.

1. Click the "Add to Slack" Button

   Use the "Add to Slack" button in the Slack Integration page to initiate the Slack incoming webhook setup.

   
2. Authorize the App and Select a Channel

   A new window will open, prompting you to select a Slack workspace and authorize the Defused Slackbot. You will need to have sufficient user privileges on the select workspace for installing the Defused Slackbot.
   You will also choose a Slack channel where you want to send alerts.

   

   Once authorized, a webhook URL will be automatically generated and configured in your Defused app. This URL will be used to send events to your Slack channel. A notification will confirm the Defused App has been added to your selected channel.

   

Selecting an Interval

Once you have enabled the incoming webhook, you may configure the frequency of the webhook triggering. The default is 60 minutes, meaning each alert severity will only trigger once during this interval.

Email

The Email integration allows you to receive alerts and notifications directly to your preferred email address. This ensures you are kept informed of critical events even when you are not actively monitoring the application.

Configuration Status

The status of the Email integration is displayed within the application. If the status is Configured, your email forwarding is successfully set up. If the status is Not Configured, you need to enable the email integration.

Configuration Steps

Follow these steps to configure the Email integration for forwarding alerts.

1. Navigate to the Email Integration Page

   Go to the Email Integration page in your application.

   
2. Enable the Email Integration

   Click the "Enable" slider to activate email forwarding. This will turn on the functionality to send alerts and notifications to your email address.

   
3. Configure Email Settings (Optional)

   Optionally, you can configure the email interval and external address forwarding. These settings allow you to customize the frequency of email alerts and specify an alternative email address for notifications.
   

   • Frequency (minutes): Set the interval at which you want to receive email notifications. Each alert severity will trigger an email once within this frequency. The default is 60 minutes.
   • External Address Forwarding: Enter external email addresses if you prefer to forward alert email to different addresses from the email specified in your Defused account.

Webhooks

Webhooks allow you to define HTTP endpoints that are triggered automatically when specific Defused alert events occur.

Webhook Configuration Fields

Defused Alert Fields

Defused alert fields are automatically included in the webhook payload and provide detailed information about the alert event. These fields are enclosed within <<>> symbols in the JSON data and should not be modified.

JSON Data Field

Users can add their own JSON elements to the webhook payload. The defused alert fields enclosed within <<>> symbols must remain unchanged. You can add any custom fields or modify existing ones, as long as the defused alert fields are preserved.

{
  "alert": "<>",
  "attackerip": "<>",
  "decoyip": "<>",
  "decoyname": "<>",
  "datetime": "<>",
  "location": "<>",
  "rawdata": "<>",
  "customfield": "Your value here"
}

HTTP Representation & Copy as cURL

An HTTP Representation of your currently configured webhook is displayed at the end of the form:

curl -X POST "YOUR_WEBHOOK_URL" \
            -H "Content-Type: application/json" \
            -H "Authorization: Bearer YOUR_TOKEN" \
            -d '{ 
                "Alert Type": "<>", 
                "Attacker IP": "<>", 
                "Decoy IP": "<>", 
                "Decoy Name": "<>", 
                "Datetime": "<>", 
                "Location": "<>", 
                "Raw Data": "<>",
                "Custom Field": "Your value here" 
            }'

Clicking "Copy as cURL" copies your webhook as a cURL command, enabling easy testing of the endpoint you're adding the webhook to.

Save Webhook

After filling out all the required fields, click the "Save Webhook" button to save your configuration. This will ensure that your webhook is triggered when an alert event matching your criteria occurs.

FAQ

A Capabilities template is disabled and says "Available after decoy engine update."

The Decoy Server VM you're trying to deploy into doesn't have a new enough decoy engine. You can update the engine in the local server by setting the "Update Decoy Engine" action to trigger on the next update cycle.

The top navigation bar says I have "unapplied decoys."

In Defused Cloud, if you use Capabilities to deploy a decoy type into a location (or a Decoy Bundle), you need to set the "Send new decoys" action onto the server you have deployed the decoys into.

In Defused Standalone, if you use the "New Decoy" menu to deploy decoys, you need to run "Apply Config" under Settings whenever you have created new decoy configurations.