Parallax Deception
Orchestration and decision layer for cyber deception

Design the reality your adversary will believe.

Parallax Deception coordinates network decoys, simulated identities, honeytokens and canarytokens under a single operation object, with a deterministic rules engine that closes the observe → decide → deploy → adjust loop.

Install in two commands
observer a observer b real asset apparent plane what the adversary believes
Parallax: the same object occupies two apparent positions depending on where you look from. A deception operation does exactly that — and this tool decides, deploys and measures the shift.
1,950 automated tests 7 methodology steps implemented 1:1 6 registered capability types MITRE ATT&CK · MITRE Engage · STIX 2.1 Python 3.10+ · Flask AGPLv3 + commercial license
What it does

One operation object, from the hypothesis about the adversary to the closing report.

Design it, deploy it, measure it. One loop, one place.

Design

An operation, not a pile of decoys

Adversary profile, rules of engagement, scenarios and narrative: the seven steps of the CTI-to-deception methodology, with MITRE ATT&CK techniques and MITRE Engage activities as real fields, not free text. You can rehearse the design and find the gaps before touching any infrastructure.

Deploy

Six kinds of capability

Network decoys, simulated user behaviour, honeytokens, Canarytokens and OpenCanary — coordinated through one contract of three methods: deploy, rotate, retire. Adding a seventh is an entry point, not a fork.

Measure

Evidence your CTI can ingest

Live telemetry, expected versus observed techniques on an ATT&CK heatmap, incidents, TLP classification, and a closing report that exports to STIX 2.1 for your SIEM.

The engine

Auditable by reading it. That is the whole point.

Condition → action. No model decides what to deploy.

Every automatic decision comes from a rule you wrote, in YAML you can read, version and review. Before acting, the engine checks the action against your rules of engagement — and when it refuses, the refusal is recorded instead of disappearing. 

# when the adversary touches this decoy...
when:
  event_type: interaction
  plugin_id: honeytoken-finance
  payload:
    kind: access

# ...deploy the next one and mark the operation
then:
  - action: deploy
    plugin_id: decoy-backups
  - action: transition
    to: compromised

The same rule that fires on its own is the one you can explain to an auditor afterwards.

Install

No sibling checkouts, no separate services, no orchestration for the tool itself.

One command to install. One to run.

pip install -e ".[dev]"
python examples/seed_demo.py   # three complete example operations
python -m apate.web            # http://127.0.0.1:5000

The examples arrive with telemetry, incidents and one already-closed operation, so the report and the heatmap have real data from the first minute. Everything runs in a single Flask process; Docker is only for container decoys and the lab, not for the application.