Built for the stack you run.
Findings land in the SIEM and SOAR your SOC already works in. Decoys sit in your cloud, your clusters, your pipelines and your AI tools.
Findings where your SOC already works.
Pick a preset and FalseTrail sends each finding in that product’s own format, over its own transport.
- SplunkSplunk
HTTP Event Collector, or your forwarder on the export
The TA-falsetrail add-on: props and CIM Alerts mapping
- QRadarIBM
LEEF 2.0 over syslog, TCP or TLS
An event map and DSM setup steps
- SentinelMicrosoft
CEF over syslog through the Azure Monitor Agent
A KQL parser and an analytics rule
- Cortex XSIAMPalo Alto Networks
HTTP log collector, or Broker VM syslog
JSON or CEF, with collector steps
- Cortex XSOARPalo Alto Networks
Generic Webhook integration
Incidents with the finding’s fields mapped
- FortiSIEMFortinet
CEF over syslog
Setup steps
Deduplicate and correlate
Every line carries a notification ID and a finding ID that stay stable, so escalations update the same case.
Causality, labelled
Each line says whether it is linked through issued material or only grouped by placement, source and decoy.
Nothing secret leaves
The placement’s location label, never its value. No credentials, tokens or raw evidence in any format.
Delivery you can see
At least once, with retries. A failing output shows in status, the console and the metrics.
Decoys where attackers look next.
Cloud keys and secrets, cluster credentials, pipeline tokens and AI tool configurations: each one placed by your tooling and detected the moment it is used.
- AWSCloudTrail
Access-key canaries and decoy secrets in Secrets Manager, detected in your CloudTrail
Terraform for the trail intake and deny-all canary users
- KubernetesHelm
FalseTrail on your cluster with its Helm chart; kubeconfig decoys and a synthetic cluster API
Helm chart, NetworkPolicy, read-only namespace inventory
- GitHub ActionsCI
A fresh placement for every pipeline run, retired when the run ends
A workflow step
- GitLab CICI
A fresh placement for every pipeline run, retired when the run ends
A job snippet
- MCPAI tools
A standard .mcp.json that ordinary MCP clients load, pointing to a real MCP server decoy
The mcp-config-v2 pack
Anything else, the standard way.
No preset for your product? Every output also speaks the open formats. Placements go out through the deployment tooling you already run.
- Syslog RFC 5424
- TLS
- CEF
- LEEF 2.0
- Webhook
- JSON export
- Prometheus metrics
- Group Policy
- Intune
- MDM
- Ansible
- Terraform
- Kubernetes
- EDR live response
Put a false trail in front of your next attacker.
Evaluate FalseTrail on your own estate. We start with a walkthrough on a sample environment, then scope an evaluation inside your network.
- A finding followed from first interaction to evidence trail
- Where placements would fit in your estate
- How it deploys and what stays inside your network