WATCHTOWERNorthfield Institute of Technology
MapDeceptionTelemetryIncidentsScope

What is real in this build, what is simplified, and what is next

A deception platform earns trust by being exact about its own limits. Every capability below carries one of three tiers. We would rather tell you where the edges are than have you find them.

LIVE13
Fully built

Runs end to end. Everything in the demo you are watching.

✓Honeytoken planting across four decoy types
✓AI decoy generation→ contextual to each department
✓Access vs. use event classification→ the false-positive defence
✓Telemetry stream and live org map
✓Incident correlation with a severity ladder
✓Scoped automated containment
✓MITRE ATT&CK mapping on every event
✓Insider threat detection→ valid credentials do not help — an insider has no reason to use a decoy
✓Behavioural attacker profiling→ tooling, tradecraft and cadence, each citing the event it was read from
✓Edge rate limiting on the public surfaces→ per-source, enforced before a function runs or a row is written
✓Department self-registration→ plants starter decoys on sign-up
✓AI incident report→ written from stored facts, print-ready
✓Measured containment latency→ timed per incident, not an estimate — includes every storage round-trip
SIMPLIFIED8
Works, with a shortcut

Real logic, reduced surface. Each one names its shortcut.

Incident summary→ rule-derived from the event chain; an LLM rewrites it on request
Containment→ revokes the decoy; never issues a network-level block
Decoy placement→ recorded as a path; no agent writes to a real host
Multi-tenancy→ one organisation per instance
SIEM/SOAR forwarding→ delivery verified against a live endpoint; field mapping unconfirmed
Rate-limit counters→ per Edge instance, not shared — a speed bump against floods, not a quota
Storage→ Supabase Postgres — incidents and decoys persist across restarts
Operator authentication→ built but not enabled here — set OPERATOR_PASSPHRASE to gate the console
ROADMAP5
Not built yet

Designed and specified, deliberately out of scope for 24 hours.

□Actor identification→ naming a person, group or country — the evidence cannot support it, so we do not
□Cloud decoys (M365, Google Workspace)
□Behavioural analytics beyond thresholds
□Endpoint sensor for legacy hardware
□Auto-learned allowlisting for internal automation
THE ONE DESIGN DECISION WORTH ARGUING WITH

Containment revokes the triggered decoy and stops there. It never blocks a source address or isolates a device, even at critical severity. A clinic or a campus sits behind shared NAT, so a wrong block takes real systems offline — while revoking a credential that was never real cannot hurt anything. We treat that asymmetry as the whole point: the actions we automate are the ones that are safe to be wrong about, and everything else waits for a person.