Service: Adversary Telemetry & Data Streams

Managing deception infrastructure in-house is a pain in the ass. You don’t want to babysit Active Directory forests, simulate fake employee Slack chatter, or manage decoy AWS accounts just to collect threat intelligence.

We run the synthetic organizations. You get the data.

FakeOrg deploys and maintains living, autonomous corporate environments that mirror real enterprise operations down to internal emails, ERP systems, and cloud IAM roles. Adversaries break in, burn their zero-days, and spend days navigating rabbit holes.

We capture every keystroke, probe, and exfiltration attempt—and pipe the raw, high-fidelity telemetry straight to your data pipelines.

# How It Works

┌───────────────────────────────┐
│   FakeOrg Synthetic Nets      │
│  (Living Enterprise Topologies)│
└───────────────┬───────────────┘
                │
                ▼ Raw Adversary Interactions (100% Hostile)
┌───────────────────────────────┐
│    FakeOrg Ingestion Engine   │
│  - Session Replay & IOC Parser│
│  - OPSEC Anonymization Filter │
└───────┬───────────────┬───────┘
        │               │
        ▼               ▼
 ┌─────────────┐ ┌─────────────┐
 │ S3 Delivery │ │   Pub/Sub   │
 │ (Parquet/   │ │ (Real-Time  │
 │   JSONL)    │ │   Streaming)│
 └─────────────┘ └─────────────┘

# Infrastructure OPSEC & Anonymization

A deception grid only works as long as the adversary believes it’s real. If subscribers or downstream feeds could see live decoy domains or target host IPs, the entire deception fleet would get cataloged and burned on cybercrime forums within weeks.

To ensure the safety and longevity of the service, our ingestion pipeline systematically anonymizes all victim-side infrastructure before data egress:

• Target Domains & Synthetic Brands: Public-facing decoy domains, company names, and employee identities are pseudonymized into stable entity tokens (e.g. synthetic-ent-09, tenant-finance-prod). You can still correlate campaigns and lateral movement across a synthetic org without exposing its real-world identity.
• Internal Decoy IPs & Topology: Hostnames, internal RFC 1918 subnets, and MAC addresses are pseudonymized using deterministic salted hashing, preserving subnet structural relationships while masking actual infrastructure.
• Unmasked Adversary Telemetry: We only protect our decoys. Everything relating to the adversary—source IPs, ingress ASNs, command arguments, dropped payloads, tool hashes, JA3/JA4 TLS fingerprints, and exfil C2 destinations—remains 100% raw, unmasked, and instantly actionable.

# Data Delivery Methods

## 1. Direct S3 Bucket Sync

For security analytics teams, data scientists, and threat hunters who want raw, structured data ready for analysis:

• Formats: Partitioned Apache Parquet (optimized for Athena, Snowflake, Databricks, BigQuery) and NDJSON.
• Artifacts Included:
  • Full network PCAPs and decrypted TLS sessions (with target-side metadata sanitized).
  • Shell transcripts with timestamps, keystroke timings, and tool arguments.
  • Extracted payload binaries with SHA-256 hashes and VirusTotal cross-references.
  • Honeytoken and canary credential access logs.
• Delivery Cadence: Streamed in micro-batches or hourly/daily syncs directly into your private AWS S3 bucket via cross-account IAM roles or bucket policies.

### Quick Querying with DuckDB

Because files are stored in partitioned Apache Parquet, you don’t even need a database server to query millions of events—just point DuckDB at the bucket:

-- Query S3 Parquet directly with DuckDB (zero setup required)
INSTALL httpfs; LOAD httpfs;
SET s3_region = 'us-east-1';

-- Top 5 attacker ASNs hitting synthetic Active Directory
SELECT 
    attacker_asn, 
    COUNT(*) AS total_probes
FROM 's3://your-company-feed/events/*/*.parquet'
WHERE target_service = 'active_directory'
GROUP BY attacker_asn
ORDER BY total_probes DESC
LIMIT 5;

-- Find lateral movement commands hunting for credentials
SELECT attacker_ip, command_line, timestamp
FROM 's3://your-company-feed/sessions/*/*.parquet'
WHERE command_line ILIKE '%aws_access_key%'
ORDER BY timestamp DESC
LIMIT 10;

## 2. Real-Time Pub/Sub Streaming

For SOC automation, immediate threat blocking, and live detection engineering:

• Message Brokers: Native support for Google Cloud Pub/Sub, AWS Kinesis / EventBridge, and Apache Kafka.
• Latency: Sub-second event delivery from the instant an adversary interacts with a synthetic node.
• Automated Response: Pipe live attacker IPs, user-agent strings, and exploit payloads directly into your SOAR workflows, WAF blocklists, or EDR alert feeds before the attacker discovers your actual perimeter.

# The Platform: Real-Time Stats, Zero Fluff

You don’t need another convoluted, sluggish SIEM console. The FakeOrg dashboard gives you instant, high-level situational awareness:

• Live Campaign Tracking: View real-time adversary probing across synthetic business units.
• TTP Heatmaps: Automated MITRE ATT&CK mapping based on executed commands and lateral movement attempts.
• Top Targeted Assets: Discover whether threat actors are hunting for finance records, engineering repos, or executive credentials.
• IOC Feeds: Export verified hostile IPs, file hashes, and domain patterns via simple REST API or direct webhook.

# Why FakeOrg Data Hits Different

Ready to plug authentic adversary telemetry into your data lake? Get in touch via our About page to request access or sample datasets.