Kandaro DeceptionLive

Decoys that catch intruders, and explain them.

Managed decoys that look like the NAS, printers, servers and AI tool servers on your network. Nobody should ever touch them. When something does, Kandaro tells you what happened in plain English, and what to do about it.

Start free trial Read the quickstart

From €95 per decoy / month · or €495 unlimited

app.kandaro.com/incidents/INC-0142

highINC-0142 · nas-backup-01

Finance workstation probed the backup NAS and tried to log in

What happened

Over seven minutes, one machine on the finance VLAN mapped the decoy NAS, guessed an SSH root password and then tried a named backup account over SMB. The sequence (discover, guess, go for backups) is typical of an intruder preparing ransomware.

Recommended actions

1Isolate 10.20.4.77 (FIN-WS-114)
2Reset backup-admin and review where it is used
3Check the real backup server for the same source

Timeline · 10.20.4.77

02:14:07
Port scan of 6 services
tcp.port_scan
02:16:03
SSH login as root, refused
ssh.auth
02:19:12
SMB login as backup-admin, refused
login_attempt/ntlm
02:21:40
Listed shares: Backups, Finance
smb.share_enum

→ Slack #sec-alerts→ webhook (signed)

How it works

Running in about a minute. Quiet until it matters.

Deception flips detection around: instead of guessing whether activity on real systems is bad, you place systems nobody should use. Every touch is worth reading.

01
Deploy a decoy
Pick a profile in the Console and run one hardened Docker command on any Linux host inside your network. Outbound HTTPS only; no inbound ports.
02
Wait for a touch
A decoy has no users and no purpose. Nobody has a reason to scan it, log in or read its files, so anything that does is the signal.
03
Read what happened
Every event is explained in plain English. Related events become one incident with a narrative and a recommended action, sent where your team works.

Generated in the Console

docker run -d --name kandaro-sensor \
  --read-only --tmpfs /tmp \
  --cap-drop ALL --cap-add NET_BIND_SERVICE \
  --security-opt no-new-privileges \
  -v kandaro-sensor:/app/data \
  -e KANDARO_API_URL=https://api.kandaro.com \
  -e KANDARO_ENROLL_TOKEN=<token from the Console> \
  ghcr.io/kandaro/kandaro-sensor:<version>

Non-root, read-only, all capabilities dropped except binding low ports. Cosign-signed images with an SBOM. Deployment guide

Live events streaming

02:21:40smb.share_enum · nas-backup-01high
02:19:12login.password · nas-backup-01high
02:17:55mcp.tools_call · ai-gatewaycritical
02:16:03ssh.auth · nas-backup-01medium
02:14:07tcp.port_scan · nas-backup-01medium
01:58:31snmp.get · printer-3flow
01:42:10honeycred.used · finance-sharecritical
01:39:48mysql.query · db-replicahigh
02:21:40smb.share_enum · nas-backup-01high
02:19:12login.password · nas-backup-01high
02:17:55mcp.tools_call · ai-gatewaycritical
02:16:03ssh.auth · nas-backup-01medium
02:14:07tcp.port_scan · nas-backup-01medium
01:58:31snmp.get · printer-3flow
01:42:10honeycred.used · finance-sharecritical
01:39:48mysql.query · db-replicahigh

Decoy profiles

Looks like the real thing. Down to the ports.

Each profile emulates the services an intruder expects on that kind of device. Instance ids, host keys and banners are unique per decoy, so one internet search can’t list them all.

Profiles reference

Linux server
Ubuntu database / web server
device
The classic lateral-movement target: SSH, a web admin, MySQL and Redis.
SSH 22HTTP 80MySQL 3306Redis 6379
Windows file server
Windows file server
device
Shares, RDP and IIS: exactly what ransomware operators go looking for.
SMB 445NetBIOS 139RPC 135RDP 3389IIS 80+1
NAS
NAS / backup storage
device
Backups are the first thing an intruder wants to find, and destroy.
Web 5000HTTP 80SSH 22FTP 21SMB 445/139
Network printer
Office network printer
device
Blends into any office VLAN. Nobody logs into a printer by accident.
HTTP 80JetDirect 9100LPD 515IPP 631Telnet 23+1
Managed switch
Managed switch / router
device
Network gear with Telnet, SSH, a Basic Auth web admin and SNMP.
Telnet 23SSH 22HTTP 80SNMP 161/udp
IP camera
IP camera (BusyBox)
device
A favourite of botnets and curious insiders: web login, RTSP and Telnet.
HTTP 80RTSP 554Telnet 23TCP 8000
AI agent server
LLM / AI agent server
app
Ollama, an OpenAI-compatible API, an MCP tool server and a vector DB. Bait for AI-powered attackers.
Ollama 11434OpenAI API 8000MCP 3000Agent console 8080Vector DB 6333+2
Integration platform
Message bus / integration hub
app
RabbitMQ, Kafka Connect and Node-RED: where the credentials of every system meet.
AMQP 5672RabbitMQ mgmt 15672Kafka 9092Kafka Connect 8083Node-RED 1880+1
n8n automation
n8n workflow automation
app
Workflow automation full of API keys, plus its Postgres database.
n8n 5678PostgreSQL 5432SSH 22

AI explanations

You don’t need to read SMB to know what just happened.

Every event gets a plain-English explanation and the raw detail beside it. If the AI is ever unavailable you get a template summary, never nothing.

Raw eventsmb2 · 445/tcp

{
  "sensor": "nas-backup-01",
  "profile": "nas",
  "proto": "smb2",
  "type": "login_attempt/ntlm",
  "src": "10.20.4.77:51322",
  "dst": "10.20.8.250:445",
  "ntlm": {
    "user": "backup-admin",
    "domain": "ACME",
    "workstation": "FIN-WS-114"
  },
  "result": "STATUS_LOGON_FAILURE",
  "ts": "2026-10-08T02:19:12Z"
}

Plain Englishhigh

Someone on the finance network tried to sign in to your backup NAS.

The workstation FIN-WS-114 (10.20.4.77) tried the account backup-admin on a decoy file share. This device isn't real, so no legitimate user or job should ever connect to it.

Recommended action

Isolate FIN-WS-114, then reset the backup-admin password and check where it is used.

Incidents

Seven events. One story. One thing to do.

Kandaro groups related events from the same source into an incident, writes the narrative, and escalates severity as the activity escalates.

Narrative of what happened, in order, in plain English
Recommended actions you can hand to anyone on the team
Severity that only goes up with the evidence, never quietly down
Your own scanners on an ignore list, so they never page you

#sec-alerts02:21

highFinance workstation probed the backup NAS and tried to log in

7 events from 10.20.4.77 over 7 minutes. Recommended: isolate the workstation and reset backup-admin.

POST /hooks/kandaro200 · signed

{ "type": "incident.created",
  "incident": { "severity": "high",
    "recommendedAction": "Isolate 10.20.4.77…" } }

For your SOC

An alert your SOC can act on without triage.

Most of a SOC’s work is deciding which alerts are real. A decoy hit skips that step, whether your own analysts, an MDR provider or an AI SOC reads it. Kandaro’s own AI SOC, Investigation, is in development.

Kandaro and your SOC

MITRE ATT&CK on every incident
Techniques come from a fixed table, not from AI, so the same activity always maps the same way and you can write rules against it.
Straight into your SIEM
Splunk, Elasticsearch and Microsoft Sentinel receive each incident in the OCSF format, with its most recent events.
Readable by AI agents
A read-only API and MCP server let an AI SOC agent ask what a source did, across every decoy.
Attacker text stays data
What the attacker typed travels in clearly named fields, shortened and cleaned, so it is not mistaken for an instruction.

highincident.createdT1110 Brute ForceT1046 Network Service Discoverysource 10.20.4.77class_uid 2004 · Detection Finding

Beyond decoys

Bait the path. Slow them down. Catch the agents.

Decoys work best when attackers are led to them. Kandaro plants the breadcrumbs, holds the connection, and speaks the protocols AI agents use.

Planned next: decoy tools among your own AI agents’ tools, and decoy credentials for cloud accounts and build pipelines. Deception only detects; Kandaro Protection, in development, will be the product that cuts off whoever touched a decoy.

Honeycreds & breadcrumbs

Credentials that only an intruder would ever use.

Plant fake passwords, API tokens and connection strings where attackers and AI agents look: config files, scripts, shared drives and the new favourites, .mcp.json and AGENTS.md. Any use of a honeycred, anywhere it reaches a decoy, raises a critical incident.

Honeycreds are stored hashed only
Breadcrumbs point at your decoys
Formats for .env, .mcp.json, AGENTS.md and more

~/projects/payments-api/.mcp.jsonbreadcrumb

{
  "mcpServers": {
    "internal-tools": {
      "url": "http://ai-gateway.corp:3000/mcp",
      "headers": {
        "Authorization": "Bearer kdo_live_7f3a…e91c"
      }
    }
  }
}

Token is a honeycred · any use raises a critical incident

Tarpits

Endless fake data, served very slowly.

When an intruder starts pulling data from a decoy database or share, Kandaro keeps them busy with realistic, endless and entirely fake records, buying your team time while every request is logged.

Fake rows and files, never real data
Capped per connection and per source
UDP is never tarpitted, so no amplification

mysql · db-replica:3306 held 14m 32s

mysql> SELECT * FROM customers;
10418 | [email protected]   | NL91ABNA0417164300 | 2019-03-11
10419 | [email protected]    | NL20INGB0001234567 | 2019-03-12
10420 | [email protected]    | NL02RABO0123456789 | 2019-03-14
10421 | [email protected]    | NL69ABNA0456712345 | 2019-03-15
10422 | [email protected]      | NL39RABO0300065264 | 2019-03-17
10423 | [email protected]    | NL44INGB0006519274 | 2019-03-18

rows: fake · rate: 1 row/2s · source logged in every event

AI-agent decoys

Bait for attackers that run on LLMs.

Autonomous agents read every file they find and talk to anything that looks helpful. Kandaro runs decoy MCP servers, OpenAI-compatible LLM APIs and agent-to-agent (A2A) endpoints. People don’t speak these protocols by hand, so a call is a strong sign an automated agent is loose in your network.

MCP tool servers with tempting tools
OpenAI-compatible and Ollama-style APIs
A2A agent endpoints and vector DBs

ai-gateway · MCP :3000critical

initializeclientInfo: "agent-runner/0.4"
tools/list9 tools returned (decoy)
tools/callread_file { path: "~/.aws/credentials" }
tools/callquery_db { sql: "SELECT * FROM users" }

Explained

An MCP client connected to a decoy tool server and went straight for cloud credentials. People don't speak MCP by hand: this is an automated agent working through your network.

Integrations

Alerts where your team already works.

Route incidents by severity to email, Slack, your SIEM or any system that accepts a webhook. Each one carries MITRE ATT&CK techniques, so a SOC or an AI SOC platform can act on it without triage.

Email
Escaped, readable incident emails to people or shared inboxes.
Slack
Incoming webhooks; attacker text can’t mention @channel or inject links.
SIEM and webhooks
Connectors for Splunk, Elasticsearch and Microsoft Sentinel. Signed webhooks for SOAR and ticketing.
Severity routing
Pick the minimum severity per channel. Ignore lists for your own tools.

Data-only sensors

Configuration arrives as validated data. A sensor never executes anything we send.

Attacker text stays text

Rendered as text only in the Console, escaped per channel in every alert.

API and export

A read-only API and MCP server, and a JSON export of your events and incidents. Your data, your exit.

Pricing

€95 per decoy, or €495 a month for as many as you like.

Every feature on both plans. 14-day free trial, card required. Save 20% when you pay yearly.

Compare plans Start free trial

Put a decoy on your network today.

Start a 14-day trial of Kandaro Deception. Your first decoy is running in about a minute.

Start free trial View packages

Card required · cancel before day 14 and pay nothing

Decoys that catch intruders, and explain them.

Running in about a minute. Quiet until it matters.

Deploy a decoy

Wait for a touch

Read what happened

Looks like the real thing. Down to the ports.

Linux server

Windows file server

NAS

Network printer

Managed switch

IP camera

AI agent server

Integration platform

n8n automation

You don’t need to read SMB to know what just happened.

Seven events. One story. One thing to do.

An alert your SOC can act on without triage.

MITRE ATT&CK on every incident

Straight into your SIEM

Readable by AI agents

Attacker text stays data

Bait the path. Slow them down. Catch the agents.

Credentials that only an intruder would ever use.

Endless fake data, served very slowly.

Bait for attackers that run on LLMs.

Alerts where your team already works.

Email

Slack

SIEM and webhooks

Severity routing

€95 per decoy, or €495 a month for as many as you like.

Put a decoy on your network today.