[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-engage\u002Foverview":3},{"item":4,"lessons":16,"controls":22,"related":27},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"mitre-engage","overview","Engage","MITRE Engage",1,"MITRE","**What it is.** MITRE Engage is a framework for planning and discussing adversary engagement, deception and denial activities. It helps defenders use deception technology and controlled environments to detect attackers, slow them down and learn about their behaviour, and it maps engagement activities to ATT&CK techniques.\n\n**How to use it.** Teams use Engage to set engagement goals, choose approaches such as decoy credentials, lure systems or monitored environments, and plan operations safely with clear rules. It works best alongside existing detection and response, giving high-confidence alerts because legitimate users have no reason to touch decoys.\n\n**Common pitfalls.** Deploying decoys without clear goals or monitoring adds work without value. Engagement needs legal and organisational approval, careful isolation so decoys do not become a path into real systems, and regular maintenance so they stay believable.",null,"https:\u002F\u002Fengage.mitre.org\u002F","Open MITRE Engage","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18],{"slug":19,"title":20,"published_at":21},"cisa-guidance-deploy-cyber-decoys-to-detect-and-disrupt-adversaries","CISA Guidance: Deploy Cyber Decoys to Detect and Disrupt Adversaries","2026-09-16T18:22:19.71+00:00",[23],{"slug":24,"name":25,"problem":26,"stories":9},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",[28,33,37,42,47,51],{"family":29,"item":30,"code":31,"title":32,"together":9},"cis","13","Control 13","Network Monitoring and Defense",{"family":29,"item":34,"code":35,"title":36,"together":9},"17","Control 17","Incident Response Management",{"family":38,"item":39,"code":40,"title":41,"together":9},"mitre-attack","t1218","T1218","System Binary Proxy Execution",{"family":43,"item":44,"code":45,"title":46,"together":9},"nist-csf","de-ae","DE.AE-2","Adverse Event Analysis",{"family":43,"item":48,"code":49,"title":50,"together":9},"de-cm","DE.CM-1","Continuous Monitoring",{"family":52,"item":53,"code":54,"title":55,"together":9},"nist-sp","800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management"]