01 / Discovery
A service worth a closer look.
A database, file service or administrative endpoint represents the kind of infrastructure an intruder may explore.
Tero for data centres
Spot the access
that shouldn’t happen.
Your infrastructure runs thousands of legitimate interactions. Tero deploys realistic Decoys that reveal suspicious access—and captures the evidence your team needs to investigate.
A focused detection layer alongside your existing security controls.
01
Look familiar to an intruder.Represent services worth exploring.
02
Record what they attempt.Keep the request and observed outcome.
03
Give your team a clear lead.Investigate with deployment context.
Make the interaction tell the story
They explore.
You get the evidence.
Give suspicious activity somewhere believable to go. Tero Decoys capture the interaction so your team can follow the evidence.
02 / Interaction
A request with a recorded outcome.
The Decoy responds through its supported capability and records the interaction, including attempted operations.
03 / Investigation
An investigation with context.
Review the service, observed source, session and recorded evidence to understand what happened.
Focus on the services that matter
Give unwanted exploration
somewhere to reveal itself.
Choose relevant Decoys for approved network segments. Keep their content synthetic and their purpose specific.
DATABASE SERVICES
“What data lives here?”
Represent reporting and application databases with realistic synthetic records. Review authentication, discovery and query activity supported by the selected capability.
PostgreSQLMySQLRedis
Reveal database exploration.
FILES & BUSINESS SERVICES
“What can I find?”
Make selected internal file shares and business services look relevant. Follow browsing, access attempts and the evidence those interactions produce.
SMBFinance sharesInternal portals
Expose interest in internal resources.
ACCESS & ENGINEERING
“Where can I go next?”
Represent supported access and engineering services in a selected segment. Inspect connection attempts, discovery and measured response outcomes.
SSHGitArtifact services
Watch administrative-service exploration.
Capability availability depends on the verified Sensor release, platform, runtime and host requirements.
From signal to investigation
A database was explored.
Show your team how.
A connection alone doesn’t explain the activity. Tero brings the recorded operations, observed responses and deployment context together so your team can assess the interaction.
- The target: which Decoy and environment were involved.
- The sequence: what was requested and what was recorded.
- The outcome: distinguish an attempt from a confirmed response.
CASE EXAMPLE / DATABASENeeds review
Reporting database
— schema exploration
Recorded activity on a synthetic PostgreSQL service.
- Environment
- Infrastructure services
- Decoy
- Reporting database
- Observed source
- 10.60.20.14
Account authentication
Succeededreporting_readerSchema discovery query
Response sentinformation_schema.tablesWrite operation attempted
DeniedUPDATE reporting.invoices …Attempt and outcome, kept together.
Human identity and production impact remain unconfirmed.
Fit it to your infrastructure
Place a Sensor.
Choose the segment.
Verify the visibility.
Deploy on an approved, supported host with private connectivity to the clients you want to observe. Tero deploys the selected Decoys alongside your existing workloads.
01Define the scope
Choose an approved network segment and relevant services.
02Deploy and verify
Install the Sensor, configure access and check Decoy readiness.
03Test from a separate client
Confirm connectivity, source attribution and recorded evidence.
Approved infrastructure segment
Existing workloadsYour applications and business services
Tero Sensor hostRealistic Decoy endpoints
DatabaseFile serviceAccess service
Selected clients interact with the Decoy endpoints
Required outbound connectivity
Tero consoleDeployment visibility & recorded investigations
Network policy, supported capabilities and readiness are verified for each deployment. This is not an inline traffic-inspection diagram.
Before you deploy
Practical answers
for your team.
Where does the Sensor run?
On an approved host in your environment, using a supported Sensor platform and release. Plan private connectivity, network access and host resources for the selected Decoy services.
Does Tero inspect all production traffic?
This solution monitors interactions with deployed Tero Decoys. It complements your existing security controls; it does not imply visibility into every production connection.
Does it require copies of production data?
The examples use synthetic Decoy content. Choose realistic services and business context without copying sensitive production records into the Decoy.
What should we validate in a pilot?
Sensor connectivity, Decoy readiness, separate-client access, observed-source attribution, recorded evidence and the investigation workflow for the selected capabilities.
Your infrastructure. A clearer signal.
Put a focused layer of detection
where exploration would matter.
Tell us about the services and network segments you want to monitor. We’ll help you plan a practical Tero deployment.
Plan your deploymentStart with a defined scope. Verify the evidence.