Parallax Deception coordinates network decoys, simulated identities, honeytokens and canarytokens under a single operation object, with a deterministic rules engine that closes the observe → decide → deploy → adjust loop.
The category matters: start by ruling out the three things it gets confused with.
Running deception today with free tools means manual, disconnected decisions: nobody says what to deploy or when, nobody compares the plan against what actually happened, and each tool lives in its own interface with its own data model.
A honeypot covers one surface. An operation needs several, coordinated with each other and sharing common state.
The decoy is the means. Deciding where to place it, with what story and for how long, is the real work.
Detection is the outcome. Here you design, deploy and measure what makes it happen.
It is the layer above: deception tools that today each live in their own interface, unified under one operation object with an adversary profile, rules of engagement, scenarios, telemetry and a closing report.
The 7 steps are a real sequence, not a list: each one consumes what the previous one produced.
The data model implements 1:1 the seven steps of the published CTI to cyber deception methodology (Pacheco & Staino). This is not a tool that had a framework bolted on later: every step is part of the model, persisted, editable and audited.
A curated MITRE ATT&CK catalog with selection by tactic, preloading from known APT groups, and ingestion of CTI reports in .txt/.pdf — deterministic extraction presented as a suggestion, never applied on its own.
What is allowed and what is forbidden, environment, legal constraints, escalation contact, strategic objectives, roles and resources. Plus the closure criteria, including event conditions that end the operation on their own.
Each scenario with its deception level and its linked TTPs: the unit that later connects intent with the concrete capabilities that materialize it.
The See – Think – Do triple from MITRE Engage per deployed capability, with a visual activity matrix (Goals × Approaches × Activities) and suggestions derived from the expected TTPs and the strategic objective, labeled by origin.
The story that holds the fiction together and its intended psychological impact: fictional employees, infrastructure and documents telling the same story, not a set of unrelated decoys.
Expected against observed, with an ATT&CK Navigator-style TTP heatmap, typed IoCs, a report in Markdown, JSON and PDF, and STIX 2.1 export ready for a SIEM/SOAR.
A new operation preloaded with what the closed one taught: the observed TTPs that were not in the original profile go back to step 1, and the cycle starts again with more information.
Deterministic and auditable. Deliberately against the grain, with a security argument behind it.
Rules are editable YAML, evaluated in real time against the event bus, and every firing is recorded. The reason is not purism: treating untrusted content produced by an attacker as the input to an automated decision is an attack surface, not a convenience. Model-based generation does exist in the tool, but only for the content of the fiction — never for the decision.
# Every firing is kept in the operation's persisted history. rules: - name: "Scan on the edge decoy: deploy the internal lure and activate" when: event_type: interaction plugin_id: dolost-edge-1 payload: kind: scan then: - action: deploy plugin_id: honeytoken-finance-1 - action: transition to: active
An editor with syntax highlighting and inline validation against the real parser — not a JavaScript reimplementation — plus a visual builder for those who do not write YAML.
Before executing any action, the engine checks that operation's RoE. If the action is forbidden it is not executed, it does not fail silently, and it is recorded as rejected with a reason. Plus a configurable cap on actions per event chain, as a defense against cascades.
Every operator action — deploy, rotate, retire — is attributed to an identity and persisted in a SHA-256 chained history that points at the exact entry if someone altered the file. The engine keeps its own separate history.
The full path: design, validate before touching infrastructure, execute, observe, close.
Five real surfaces, a reference mock for development, and a bridge that only ingests telemetry from what you already run.
A third party integrates their own tool by declaring an entry point in their own package, without touching a line of the core. The capabilities that ship with the tool register in exactly the same way, with no special treatment.
High-interaction decoys with live container state, deployable individually or as a campaign.
Fictional employees with real activity on the machines of the fiction. Model-based generation produces content, never decisions.
Fictional credentials on disk, with no external dependencies, with access detection and content rotation that does not relocate the file.
Cloud, documents with beacons, DNS, QR, email. A direct fit with the breadcrumb model: a canarytoken is a breadcrumb.
Lightweight multi-service tripwires (SSH, FTP, HTTP, Telnet, MySQL) that record what was typed on the other side.
Ingests events from an external stack with declarative field mapping, without deploying or controlling it, and correlates them against the expected TTPs.
Built to sustain the methodology over time, not just for a demo.
With no users, the instance stays open for a local walkthrough; as soon as you create the first one, the application requires sign-in on every route. Hashed passwords, or OIDC sign-in against your provider — where the provider authenticates and the tool authorizes: a subject that was not provisioned does not get in.
Read, operation and administration over a central allowlist: a new unclassified route is denied by default, even to administration. Another team's operations return 404, not a half-filtered list.
API keys, tokens and credentials are encrypted on disk. That protects a copy, a backup or a forwarded JSON; it does not protect against someone with access to the host, and the module says so instead of implying more.
Gunicorn, nginx with TLS and a systemd unit, with unattended creation of the first user and an explicit warning about granting access to the Docker socket.
We would rather you read this here than find it out halfway through an operation.
The tool is built on one rule: it assists, it never decides for you. Both its strengths and these limits come from there — they are intentional scope, not hidden gaps.
A capability's outcome is recorded as free text, with a date and an operator. A synthetic percentage on top of that would be made up, and you will not find one on any screen.
They exist to bound what the engine does on its own. An operator deploying by hand does not go through that guard — the action is audited, not blocked.
It recognizes identifiers, technique names and group aliases against the curated catalog. It can produce real false positives and negatives; that is why it is presented as a suggestion and never applied on its own.
That is a scope decision. It coordinates and measures the deception deployed by the tools you already use, instead of replicating your environment.
It is not infinitely configurable, and the interface marks that scenario by scenario instead of pretending everything expected will be observed.
No sibling checkouts, no separate services, no container orchestration for the tool itself.
Everything lives in a single Flask process: the core, the native capabilities and the interface. Docker is only needed for container decoys and the lab, not for the application.
# install python3 -m venv venv && source venv/bin/activate pip install -e ".[dev]" # seed three complete, real example operations python examples/seed_demo.py # run python -m apate.web # http://127.0.0.1:5000
The example operations arrive with telemetry, incidents, TLP classification, an asset inventory and one already-closed operation — so you can see the report and the heatmap with real data from the first minute. Running it again does not duplicate anything.
A dual model: the same functionality, two ways to license it.
Today it includes everything: the operations model, the deterministic engine and its guards, deception capabilities, telemetry, reports, the ATT&CK and Engage catalogs, the web interface, the lab, identity, roles, auditing and extension points. The commitment is explicit: none of that moves behind a paywall later.
For organizations that cannot take on the AGPLv3 obligations when integrating, modifying or offering it as a service. There is no open core: no separate commercial code, directory or capability exists. What is monetized is a licensing authorization, not the absence of features.
Design the operation, validate the design before touching infrastructure, let the engine decide according to rules you wrote yourself, and close with a report your CTI program can ingest.