Detection via Deception — Using your SIEM as a Free Deception Platform

This article explains how to use an existing SIEM as a free deception platform by creating honeytokens (fake user accounts, resources, and watchlists) to detect adversary activity, provides design considerations aligned with MITRE Engage, and includes a sample Microsoft Sentinel KQL query and operational recommendations (suppressions, tailoring lures to threat models).