Parallax Deception
Orchestration and decision layer for cyber deception

Design the reality your adversary will believe.

Decoys, fake identities and honeytokens are the easy part. This is what turns them into one operation you can design, run and prove — driven by rules you wrote, not by a model's guess.

Install in two commands See how it decides
observer a observer b real asset apparent plane what the adversary believes
Parallax: the same object occupies two apparent positions depending on where you look from. A deception operation does exactly that — and this tool decides, deploys and measures the shift.
Impact centre: MITRE ATT&CK coverage by tactic, counters for events, observed techniques, indicators and triggered rules, a live activity feed and the status of the deployed infrastructure.
The impact centre, with data from three example operations that ship with the tool.
1,940 passing tests 7 methodology steps implemented 1:1 6 registered capability types MITRE ATT&CK · MITRE Engage · STIX 2.1 Python 3.10+ · Flask AGPLv3 + commercial license

A honeypot tells you someone touched it.
An operation tells you what they believed, what they did next, and whether your controls held.

What it does

One operation object, from the hypothesis about the adversary to the closing report.

Find the holes before the adversary does.

Design

Rehearse it dry

Lay out the adversary, the scenarios and the story, and the tool walks the design looking for what does not hold: a technique nothing covers, a lure that leads nowhere. Before you deploy anything.

Deploy

Six kinds of bait, one lifecycle

Network decoys, simulated employees, honeytokens, Canarytokens, OpenCanary. Same three verbs for all of them — deploy, rotate, retire — so the operation is one thing, not five consoles.

Prove

Close with evidence

What you expected against what actually happened, on an ATT&CK heatmap. Then export it as STIX 2.1 and your SIEM ingests it. The operation ends in a document, not in an anecdote.

The engine

Auditable by reading it. That is the whole point.

It reacts on its own. You still know why.

Every automatic decision comes from a rule you wrote, in YAML you can read, version and put through review. Before acting, the engine checks it against your rules of engagement — and when it refuses, the refusal is on the record instead of vanishing. 

# when the adversary touches this decoy...
when:
  event_type: interaction
  plugin_id: honeytoken-finance
  payload:
    kind: access

# ...deploy the next one and mark the operation
then:
  - action: deploy
    plugin_id: decoy-backups
  - action: transition
    to: compromised

The same rule that fires on its own is the one you can explain to an auditor afterwards.

Install

No sibling checkouts, no separate services, no orchestration for the tool itself.

One command to install. One to run.

pip install -e ".[dev]"
python examples/seed_demo.py   # three complete example operations
python -m apate.web            # http://127.0.0.1:5000

The examples arrive with telemetry, incidents and one already-closed operation, so the report and the heatmap have real data from the first minute. Everything runs in a single Flask process; Docker is only for container decoys and the lab, not for the application.

Your next operation can start today.

Free under AGPLv3, with three complete example operations so the first thing you see has real data in it.

Install in two commands Leer en español

Running it in an organisation that cannot take on the AGPLv3 terms, or want a walkthrough of the demo? Write and we will answer.