ClearSkies Active Defense
Inside the platform
Active Defense is a native add-on that exchanges with the TDIR engine. Every trap interaction is sent with full attack-vector context, meaning who, from where and using what, and the detection outcomes come back. That exchange turns a single deception event into a coordinated response.
What Active Defense Contributes to the Platform
Active Defense is one of the six native add-ons of the ClearSkies iISOC platform. The add-ons do not exchange intelligence directly with one another. Each connects to the TDIR engine.
The signal no other layer can see
Every other layer works by inference, judging how likely observed activity is to be hostile.
The deception layer infers nothing: it observes activity that has no legitimate explanation at all. No other layer owns assets whose only purpose is to be touched by an intruder.
An internal host connecting to a file server is routine and easy to miss.
An internal host authenticating to a decoy file server with a planted credential that exists nowhere in production is an intrusion an analyst can act on immediately.
Working with the other add-ons
Active Defense never acts on another add-on's intelligence. When a trap is triggered, the engine matches it against the other signals it holds, combines them into one high-fidelity picture and drives the coordinated response. Active Defense contributes the certainty that an intruder is present and what was touched.
Attack Surface Monitoring
the external exposure
Identity Threat Protection
the compromised users and credentials
DNS Shield
the resolution-layer verdict
ETMR
the endpoint behavior
Platform integration
The integration is bidirectional
01 / To the engine
Interactions become detections
Every decoy and beacon-trap interaction carries its source, method, purpose and timestamp into the engine.
02 / Back to Active Defense
Outcomes inform the next action
Detection outcomes can trigger deeper engagement or automated response. Trap indicators are shared across tenants, while analyst dispositions tune decoy and bait placement.
A closed loop. Every deception event gains context—and helps sharpen the other layers.
MITRE ATT&CK Alignment
Deception is most powerful against the post-compromise tactics: reconnaissance, credential access and lateral movement. Every trap event carries an explicit technique identifier the moment it fires.
| Capability | ATT&CK tactic | How Active Defense helps |
|---|---|---|
| Reconnaissance decoys | Discovery | Network service scanning and discovery, T1046, against decoy services and ports. |
| Beacon trap credentials | Credential Access | Planted credentials and credential stores, T1552, that exist only as bait. |
| Decoy services and shares | Lateral Movement | Remote-service and administrative-tool abuse, T1021, as an attacker pivots onto a decoy. |
| Poisoned data files | Collection | Access to and staging of planted data, T1005, no legitimate user would open. |
| Decoy assets | Reconnaissance | Active scanning of the internal network, T1595, against assets that exist to be probed. |
| Modbus and operational technology decoys | Impact | Manipulation of industrial control systems, T0836 and the T1489 class, via emulated Modbus targets. |
Mapping is scope, not an assurance of detection. A technique listed here is claimed. A technique exercised in a purple-team run or against MITRE Engenuity ATT&CK Evaluations is demonstrated, and reporting states which of the two applies. Coverage exports as a MITRE ATT&CK Navigator layer.
Deception evidence maps to the frameworks the Regulatory Frameworks core function catalogues.
For the service provider
The same deception layer is the engine of a productized post-breach detection service. Multi-tenancy is a first-class concern at every layer, so a provider can deliver Active Defense across many customers from one deployment, and the commercial model scales with the customer base. Because deception detections are inherently high-fidelity, they absorb the ambiguity that drives triage volume.
- row-level isolation
- per-tier feature gating
- per-tenant quotas
- A cross-tenant operator console
- white-label reporting
Connect with the team
Book a demo
Have a question first
Talk to the team