SDF-PR06

Monitoring Pipeline Setup

advancedDetection Value: criticalCost: moderateTime: 1-3 weeks🔗 Network Infrastructure

Description

Establish the logging, alerting, and data collection infrastructure that will capture adversary interactions with deception assets. This pipeline must provide comprehensive visibility without being detectable by adversaries inspecting the deception environment.

Rationale

A deception environment without monitoring is a waste of resources. The monitoring pipeline is what transforms adversary interactions into actionable intelligence. It must be comprehensive enough to capture every meaningful interaction, fast enough to enable real-time alerting, and stealthy enough to avoid revealing the environment is a trap.

Supporting Basis

Direct antecedent

The sources require collection, alerting, or monitoring infrastructure before deceptive assets can provide operational observations.

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

Define monitoring requirements

Specify what data needs to be captured from each deception asset type. Include network flows, system calls, authentication events, file access, and command execution.

Deploy log collection agents

Install log shipping agents on deception hosts that forward telemetry to the central collection point. Ensure agents are not easily discoverable by adversaries.

Configure central log aggregation

Set up a SIEM or log aggregation platform to receive, parse, and index deception telemetry. Keep deception logs separated from production logs for clarity.

Build alert rules

Create rules that alert on interactions with declared deception assets. Treat a match as a high-suspicion event requiring investigation, while accounting for authorized testing, configuration errors, and unintended legitimate contact.

Test end-to-end pipeline

Generate test interactions with each deception asset and verify that telemetry flows through the entire pipeline and triggers appropriate alerts.

Technical Implementation Examples(2)

Wazuh Agent Configuration for Deception Monitoring

Wazuh ossec.conf configuration for comprehensive monitoring of deception host interactions

xml

<!-- /var/ossec/etc/ossec.conf on deception hosts -->
<!-- Wazuh agent configuration for comprehensive deception monitoring -->
<ossec_config>
  <client>
    <server>
      <address>siem.shadow-mgmt.internal</address>
      <port>1514</port>
      <protocol>tcp</protocol>
    </server>
    <enrollment>
      <enabled>yes</enabled>
      <groups>deception-hosts</groups>
    </enrollment>
  </client>

  <!-- Monitor all authentication events -->
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/auth.log</location>
  </localfile>

  <!-- Monitor SSH honeypot logs -->
  <localfile>
    <log_format>json</log_format>
    <location>/var/log/cowrie/cowrie.json</location>
    <label key="source">cowrie-honeypot</label>
  </localfile>

  <!-- Monitor web server access logs -->
  <localfile>
    <log_format>apache</log_format>
    <location>/var/log/nginx/access.log</location>
  </localfile>

  <!-- Monitor file integrity on trap files -->
  <syscheck>
    <frequency>60</frequency>
    <directories check_all="yes" realtime="yes" report_changes="yes">
      /opt/application/config
    </directories>
    <directories check_all="yes" realtime="yes">
      /home/*/Documents
    </directories>
    <directories check_all="yes" realtime="yes">
      /var/www/html
    </directories>
  </syscheck>

  <!-- Command monitoring -->
  <localfile>
    <log_format>full_command</log_format>
    <command>netstat -tulpn</command>
    <frequency>120</frequency>
    <alias>network-connections</alias>
  </localfile>

  <localfile>
    <log_format>full_command</log_format>
    <command>ps auxww</command>
    <frequency>120</frequency>
    <alias>running-processes</alias>
  </localfile>
</ossec_config>

Filebeat Configuration for Centralized Log Shipping

Filebeat configuration to ship all deception asset logs to a central Elasticsearch/SIEM instance

yaml

# filebeat/filebeat.yml
# Centralized log shipping from deception assets

filebeat.inputs:
  # Cowrie SSH honeypot JSON logs
  - type: log
    id: cowrie-honeypot
    enabled: true
    paths:
      - /var/log/cowrie/cowrie.json
    json.keys_under_root: true
    json.add_error_key: true
    fields:
      deception_source: cowrie-ssh
      asset_type: honeypot
      shadow_cdf: true
    fields_under_root: true

  # Web server access logs
  - type: log
    id: decoy-webserver
    enabled: true
    paths:
      - /var/log/nginx/access.log
    fields:
      deception_source: decoy-web
      asset_type: decoy-service
      shadow_cdf: true
    fields_under_root: true

  # Authentication logs
  - type: log
    id: auth-logs
    enabled: true
    paths:
      - /var/log/auth.log
    fields:
      deception_source: host-auth
      asset_type: decoy-host
      shadow_cdf: true
    fields_under_root: true

  # Samba/SMB honeypot logs
  - type: log
    id: smb-honeypot
    enabled: true
    paths:
      - /var/log/samba/*.log
    fields:
      deception_source: decoy-smb
      asset_type: honeypot
      shadow_cdf: true
    fields_under_root: true

# Tag all events as deception for easy filtering in SIEM
processors:
  - add_tags:
      tags: ["shadow-cdf", "deception-asset"]
  - add_host_metadata:
      when.not.contains.tags: forwarded

output.elasticsearch:
  hosts: ["${SIEM_HOST:localhost:9200}"]
  api_key: "${SIEM_API_KEY}"
  index: "shadow-cdf-deception-%{+yyyy.MM.dd}"

# Separate index for deception logs - do not mix with production
setup.template:
  name: "shadow-cdf-deception"
  pattern: "shadow-cdf-deception-*"
  settings:
    index.number_of_replicas: 1

logging.level: warning
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7

MITRE ATT&CK Mappings

Technique	Tactic	Relationship
T1070Indicator Removal	Defense Evasion	counters

Considerations

Log shipping should use out-of-band channels that adversaries cannot observe. Avoid shipping logs through the same network paths the adversary traverses.
Retention policies for deception logs may differ from production. Adversary interaction data is intelligence and may need extended retention for analysis.
Test the monitoring pipeline under load. An adversary running automated tools may generate high volumes of telemetry quickly.

Supported Environments

🏢On-Premise

☁Amazon Web Services

☁Microsoft Azure

☁Google Cloud Platform

🔄Hybrid Environment

🏭OT/ICS Environment

Tools & Resources

SIEM platforms (Wazuh, Elastic Security, Splunk)
Log shippers (Filebeat, Fluentd, Winlogbeat)
Network monitoring (Zeek, Suricata)
Packet capture tools (tcpdump, Wireshark)

Related Techniques

SDF-DT01Interaction Tripwire Monitoring

SDF-DT02Canary Alert Processing

Quick Stats

Phase: Prepare
Difficulty: advanced
Detection Value: critical
Cost: moderate
Time: 1-3 weeks
ATT&CK Mappings: 1