Description
Update SOC runbooks and incident response playbooks with intelligence gained from deception operations. Incorporate new attack scenarios, detection indicators, and response procedures derived from observed adversary behavior.
Rationale
SOC playbooks benefit from reviewed observations of activity in the deception environment. Incorporating corroborated findings can make response procedures more relevant, while recognizing that a bounded deception interaction may not represent broader adversary behavior in production.
Supporting Basis
Author-derived extensionMITRE Engage describes integrating observations and responses with SOC activity but does not directly define this playbook-enhancement record.
These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.
Implementation Steps
Review current playbooks
Audit existing SOC playbooks for gaps revealed by deception intelligence. Identify scenarios that are not covered or procedures that proved inadequate.
Develop new scenarios
Create new playbook entries for attack scenarios observed in the deception environment. Include specific indicators, response steps, and escalation criteria.
Update existing procedures
Modify existing playbook procedures to incorporate deception-specific indicators and deception-triggered response steps.
Train SOC analysts
Conduct training sessions for SOC analysts on updated playbooks, with emphasis on deception-specific scenarios and alert handling procedures.
Technical Implementation Examples(1)
SOAR Playbook for Deception Alerts
Automated response playbook for SOC teams when a deception asset triggers an alert
# soar-playbooks/shadow-cdf-deception-alert.yml
# Automated response playbook for deception asset interactions
name: "ShadowMatrix CDF Deception Alert Response"
description: >
Automated triage and response when a deception asset interaction
is detected. Enriches the alert with context, assesses severity,
and initiates the appropriate response workflow.
trigger:
type: alert
conditions:
- field: alert.tags
contains: "shadow_cdf"
steps:
- id: enrich_source
name: "Enrich Source IP"
action: lookup
target: asset_inventory
input:
ip: "{{ alert.source_ip }}"
output:
hostname: "{{ result.hostname }}"
owner: "{{ result.owner }}"
asset_type: "{{ result.type }}"
is_known_asset: "{{ result.found }}"
- id: check_trap_credential
name: "Check if Trap Credential Was Used"
action: lookup
target: trap_credential_inventory
input:
username: "{{ alert.username }}"
output:
is_trap: "{{ result.found }}"
trap_placement: "{{ result.placement }}"
- id: assess_severity
name: "Determine Response Level"
action: evaluate
conditions:
- if: "{{ check_trap_credential.is_trap }} == true"
set_severity: "critical"
set_action: "immediate_containment"
- if: "{{ alert.event_type }} == 'ssh_login_success'"
set_severity: "critical"
set_action: "immediate_containment"
- if: "{{ alert.event_type }} == 'port_scan'"
set_severity: "high"
set_action: "investigate"
- default:
set_severity: "medium"
set_action: "investigate"
- id: create_incident
name: "Create Incident Ticket"
action: create_ticket
input:
title: >
[ShadowMatrix CDF] Deception alert: {{ alert.event_type }}
from {{ alert.source_ip }}
severity: "{{ assess_severity.severity }}"
description: >
Deception asset {{ alert.destination_ip }} received interaction
from {{ alert.source_ip }} ({{ enrich_source.hostname }}).
Action: {{ alert.event_type }}.
Trap credential used: {{ check_trap_credential.is_trap }}.
assignee: "soc-tier2"
tags: ["shadow-cdf", "deception", "{{ assess_severity.severity }}"]
- id: notify_soc
name: "Send SOC Notification"
action: send_message
target: soc_channel
input:
message: >
:rotating_light: DECEPTION ALERT [{{ assess_severity.severity }}]
Source: {{ alert.source_ip }} ({{ enrich_source.hostname }})
Target: {{ alert.destination_ip }}
Action: {{ alert.event_type }}
Trap Cred: {{ check_trap_credential.is_trap }}
Incident: {{ create_incident.ticket_id }}
- id: capture_forensics
name: "Initiate Forensic Capture"
condition: "{{ assess_severity.action }} == 'immediate_containment'"
action: run_script
input:
script: "capture-deception-forensics.sh"
args:
- "{{ alert.destination_ip }}"
- "{{ alert.source_ip }}"Considerations
- Include deception-specific alert handling in playbooks. SOC analysts need clear procedures for what to do when a deception alert fires.
- Playbook updates should be versioned and traceable back to the deception intelligence that motivated them.
- Conduct tabletop exercises using actual deception scenarios to validate that updated playbooks are effective.
Supported Environments
Tools & Resources
- Playbook management platforms
- Training environments
- Tabletop exercise frameworks
Related Techniques
Quick Stats
- Phase
- Respond
- Difficulty
- intermediate
- Detection Value
- medium
- Cost
- low
- Time
- 3-7 days
- ATT&CK Mappings
- 0