DOAR is a method for designing decoys at the right level of realism, deploying them, routing the signal they produce, and deciding what to do the moment one fires.
89 techniques across 15 categories, from a planted access key to a whole decoy cloud account, each rated on the F1–F5 fidelity scale.
D001–D089 · cloud, identity, Kubernetes, endpoint, SaaS, AI agents Pillar 02 · OrchestrationSetup per platform, the exact log event that fires, the known blind spots, and a safety line for every decoy.
Deployment detail for 89 of 89 techniques Pillar 03 · AlertingWhere each decoy's telemetry comes from, how to keep the alert path itself hidden, and how to prioritise an interaction once it fires.
215 mappings labelled with where the decoy fires Pillar 04 · ResponseFive response tiers, from logging silently to evicting immediately, with the criteria for each and what is safe to automate.
T0 Silent Log → T4 Immediate EvictEvery technique sits somewhere on this scale. More realism catches more, and costs more in money, engineering and risk.
A planted artifact with nothing running behind it. Its only job is to be touched.
e.g. D018 Canary File F2 · 32 techniquesLooks like a real resource from the outside. Nothing works on the inside.
e.g. D001 Honey IAM Role F3 · 26 techniquesAccepts an interaction and answers with plausible, canned responses.
e.g. D012 Honey Container/Pod F4 · 14 techniquesA real, running system — isolated, instrumented, and allowed to be compromised.
e.g. D011 Honey VM Instance F5 · 2 techniquesAn environment the adversary can live in — multiple systems, identities and data.
e.g. D041 Honey Cloud AccountEach square is one ATT&CK parent technique. Every mapped row carries its own linked evidence. How each mapping is graded →
Five tiers, chosen by what the touch tells you and how close the attacker is to something real.
The interaction is recorded and enriched, and nobody is woken up. Appropriate for low-value signals that matter in aggregate — broad scanning, opportunistic enumeration — where a page per event would train your SOC to ignore the channel.
A human is told, and the session is watched. The decoy keeps running. This is the default for most first interactions: the alert is high-fidelity, but a single touch rarely justifies disrupting the business.
Access is narrowed rather than cut. Restricting instead of revoking keeps the adversary present and observable while limiting what they can reach — and avoids telling them they have been spotted. Evidence preservation starts here.
You engage deliberately: feed disinformation, extend the deception environment, keep them busy and recorded. This requires an operator and a plan, and it is the tier most likely to need legal and executive sign-off before it is ever used.
Everything stops. Sessions killed, credentials revoked, access blocked, forensic snapshots taken, incident response invoked. Reserved for confirmed destructive intent or an adversary close enough to real assets that observation is no longer defensible.
Pick a technique, deploy it, and know exactly what fires and what to do next.