DOCSEARCHbyAlgolia
Submit Docs

Defused Documentation

website·Indexed 30 days ago

https://defuseddocs.netlify.app/

Documentation for Defused, a threat intelligence platform providing honeypots and deception capabilities. Features include real-time attack data streams via Defused TF, external attack surface visibility via Defused EX, a curated threat intelligence feed called Radar, and a programmatic API for data correlation, blocklisting, and detection writing.

Tokens
8.4K
Snippets
24
Records
71
Agent score
75%

What's inside Defused

  1. Overview of Defused managed deception services

    Defused is a managed service that provides continuously maintained honeypots and deception capabilities. It collects and normalizes attacker activity into actionable telemetry, allowing users to gain visibility into emerging threats and targeted behavior without managing the underlying infrastructure. The service aligns with security frameworks such as NIST SP 800-53 (control SC-26), MITRE Engage, and ENISA guidance.

  2. Overview of Defused TF capabilities

    Defused TF provides a real-time stream of attack data collected from a distributed network of honeypots. It allows users to subscribe to honeypot feeds based on specific technology profiles to monitor live adversary behavior, inspect payloads, and correlate attacker infrastructure and campaigns.

  3. Overview of Defused EX capabilities

    Defused EX provides real-time visibility into attacks targeting external attack surfaces, including firewalls, VPN gateways, public webapps, and cloud management endpoints. It is designed for pre-breach detection and the collection of 0-day and N-day indicators of compromise (IOCs) without requiring infrastructure deployment or maintenance.

    Core capabilities include:

    • On-demand Honeypots: Single-click deployment of decoys mimicking critical external services.
    • Payload & IOC Harvesting: Automatic capture of dropped files, command lines, URIs, and artifacts.
    • Alerting & Enrichment: Integration with SIEM/SOAR platforms with added reputation and context.
    • Export & Reporting: CSV exports and templated intelligence reports.

  4. Understand Defused Radar threat intelligence signals

    The Defused Radar is a curated threat intelligence feed based on real activity observed by a distributed fleet of honeypots. It filters raw noise to surface four specific types of actionable signals:

    • Emerging Vulnerabilities: Handpicked alerts (not auto-generated CVE feeds) regarding significant new vulnerabilities, including context on exploitation and expected wild behavior.
    • Honeypot Launches: Announcements of new honeypot types or decoy feeds, detailing what is emulated, the traffic captured, and subscription methods.
    • Discoveries: Confirmed novel findings from honeypot traffic, such as zero-days, early exploitation before wide reporting, unseen exploit patterns, or unusual payload structures.
    • Trends: Trajectory tracking for vulnerabilities once they are first exploited in live traffic, covering volume changes, new variants, and comparisons to baseline traffic.

  5. Understand Defused deployment models

    Defused offers three primary ways to deploy decoys and honeypots for intelligence collection:

    • Defused TF: Provides access to a globally distributed, internally hosted honeypot network. Data is streamed from pre-built feeds.
    • Defused EX: Managed deployment of dedicated honeypots where alerts and telemetry belong exclusively to a single account and are not shared across tenants.
    • Defused Builder: Self-deployed option for running Defused on your own cloud, on-prem, or hybrid infrastructure.

  6. Choose a Defused service tier based on use case

    Defused offers three primary plans tailored to different security monitoring needs:

    • Defused TF: Provides visibility into current global attacker exploits via a network of honeypots managed by Defused.
    • Defused EX: Deploys managed honeypots on your own perimeter to catch real attacks targeting your specific edge infrastructure.
    • Defused Builder: Allows you to run Defused on your own infrastructure, supporting cloud, on-prem, or hybrid deployments.

  7. Understand Defused Webhook trigger types

    Defused supports two distinct types of events that can trigger a webhook:

    1. Alert Events (Alert): Triggered by alerts from your own deployed decoys and sensors (Defused EX). These are tenant-scoped, meaning only alerts belonging to the same customer will trigger them. Common use cases include ticket creation, blocking automation, and SOC notifications.
    2. Intel Events (Intel Feed): Triggered by events from the honeypot intelligence feed (Defused TF). These are global subscriptions and do not have a customer attached. Common use cases include threat intelligence ingestion and research pipelines.

  8. Analyze suspicious requests against known alerting structures

    To determine if a suspicious request is a variant of a known exploitation path, compare it against the path patterns monitored in the Capabilities section of the product card for each honeypot type. Look for alignments with:

    • Authentication bypass attempts
    • RCE or deserialization routes
    • Admin panel discovery
    • Key configuration or metadata endpoints

  9. Implement pre-breach monitoring and 0-day detection with Defused EX

    Defused EX can be used for three primary security tasks:

    1. Pre-Breach Monitoring: Deploy decoy assets that match your organization's public asset base. Triage alerts (e.g., unusual admin login sequences) and correlate them with actual asset logs to contain threats before initial access.
    2. 0-Day Detection: Capture previously unseen payloads and command shells targeting internet-facing appliances to extract and push high-confidence IOCs to blocklists and detection pipelines.
    3. Detection Validation: Deploy a honeypot clone of a vulnerable VPN or web admin panel to observe live attacker POCs and scanners, then use those events to author and validate detection logic.

  10. Use Defused telemetry for Threat Research

    Analyze payloads, exploit attempts, scanning patterns, and attacker tooling to support rapid threat research, malware triage, and exploit replication.

  11. Detect potential 0-day signals using low-frequency heuristics

    A strong heuristic for discovering 0-day or early n-day signals is to look for requests that meet the following criteria:

    • Seen only against one specific honeypot type.
    • Very low total count (especially within the last 24 hours).
    • Paths that appear structured or exploit-like (e.g., long query strings, uncommon API routes, or traversal patterns).

    Example: A request path appearing only on FortiWeb with 1-3 total hits that resembles known FortiWeb pathing but yields no search engine results is a potential 0-day.

  12. Use Defused telemetry for Detection Writing

    Leverage high-fidelity exploit and enumeration activity gathered from honeypots to create or refine SIEM/SOAR detection rules, queries, signatures, and enrichment logic.