📊 Honey Dashboard

Fake monitoring dashboards.

→ Explore in ATT&CK matrix (3 mappings) Deployment detail

What it is

A monitoring dashboard that shows decoy resources as if they matter. Attackers read dashboards to learn what an organisation values and where it lives. Its main value is as a breadcrumb that leads to decoys which alert; the dashboard read itself is a weaker signal.

Implementation requirements

Create a dashboard (CloudWatch, Azure Workbook, Grafana) named like an operations or security view, showing decoy resources (D011, D019) as if they matter
Its main value is as a breadcrumb: it leads an intruder to decoys that alert. The dashboard read itself is a weaker signal: CloudWatch GetDashboard is a logged read, and Grafana records views only where its audit logging is enabled
Safety: the dashboard shows no real data. OPSEC: refresh intervals and widgets like real dashboards
Rollback: Delete the dashboard, and the decoys it points to if they exist only for it.
Upkeep: Keep its widgets pointing at decoys that still exist.

Technologies

AWSAzure

ATT&CK coverage 3

Technique	Tactic	Status	Confidence	Tier
T1538 Cloud Service Dashboard	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1538 Cloud Service Dashboard as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1538 to its Lures activity.
T1654 Log Enumeration	Discovery	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1654 as highly feasible for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1654 Log Enumeration as an adversary behaviour. Reading a decoy log is logged only where read access is audited.
T1657 Financial Theft	Impact	theoretical	weak	T4
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1657 Financial Theft as an adversary behaviour. Financial theft is an outcome; access to decoy billing data is collection.

Evidence

Decoy Object (D3-DO) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard