MITRE Engage Guide: Planning Adversary Engagement

Most deception programmes fail not because the decoys are poor but because nobody decided what the decoys were for, who may touch the adversary, or when the operation must stop. MITRE Engage is the framework MITRE publishes for exactly that gap: it describes itself as "a framework for planning and discussing adversary engagement operations", and it gives defenders a shared vocabulary of goals, approaches and activities, a map from ATT&CK techniques to the adversary weaknesses deception can exploit, and a 10-step planning process. This guide explains the Engage Matrix and its identifiers, how to use the ATT&CK mapping, how to run the 10-step process with proper governance and gating criteria, and how to measure whether engagement is worth the effort. It is written for SOC leads, threat intelligence teams and security architects who already run, or plan to run, honeytokens and decoys and want a disciplined way to plan them. For the technology itself (honeypots, canary files, decoy credentials) see the Deception Technology Guide; this page covers planning and operations.

Key takeaways

Engage is a planning framework, not a product. MITRE's own process document says adversary engagement is "an iterative, goal-driven process, not merely the deployment of a technology stack".
Three engagement goals carry the work. Expose (reveal adversaries already present), Affect (raise their cost and lower the value of what they take) and Elicit (learn their tactics, techniques and procedures), framed by the strategic goals Prepare and Understand.
The ATT&CK mapping is the practical bridge. Engage links ATT&CK techniques to 29 adversary vulnerabilities and to the activities that exploit them, so a threat-informed defence plan can name which deception activity answers which technique.
Gating criteria and rules of engagement come before any lure. Engage requires conditions that force an "unnegotiable pause or end" of an operation, and it limits Affect activity to the defender's own network: it is not hack back.
Small teams can start. The handbook says a scoped operation can begin with very little equipment, and the value is judged by alert quality and intelligence gained, not by the number of decoys deployed.

What MITRE Engage is and how it relates to ATT&CK

MITRE released Engage (version 1.0, February 2022) as the successor to its earlier Shield active defence knowledge base. The public data set and documents sit in the mitre/engage GitHub repository, which states it "contains the data found in the MITRE Engage v1.0 website", alongside a handbook, a starter kit, a 10-step process sheet, a glossary and planning templates. The Engage website presents six tools: Matrix, Playbook, Process, Community, Standards and Mindset.

The handbook, A Practical Guide to Adversary Engagement, defines the core terms that the rest of the framework uses:

Cyber denial: the ability to prevent or otherwise impair the adversary's ability to conduct their operations.
Cyber deception: intentionally revealing deceptive facts and fictions to mislead the adversary, and concealing critical facts and fictions so they cannot form correct estimates.
Adversary engagement: denial and deception used together within strategic planning and analysis, to drive up the cost and drive down the value of the adversary's operations.

Where it sits among MITRE's other frameworks:

Framework	Question it answers	How it connects to Engage
MITRE ATT&CK	What do adversaries do?	Engage maps ATT&CK techniques to adversary vulnerabilities and engagement activities
MITRE D3FEND	Which defensive techniques counter which artefacts?	D3FEND's Deceive tactic covers decoy environments and decoy objects; Engage covers how to plan and run operations that use them
MITRE Engage	Why, where and how should we engage the adversary, and when do we stop?	Goals, approaches, activities, the 10-step process and planning templates
Adversary emulation (for example Caldera)	Do our controls detect a known behaviour?	Emulation tests your own defences; Engage operations interact with a real adversary or real malware. See the MITRE CALDERA Adversary Emulation Guide

For how ATT&CK itself is structured and used for coverage work, see the MITRE ATT&CK Guide for Defenders.

The Engage Matrix: goals, approaches and activities

The matrix has three levels (goal, approach, activity) arranged across three phases: Prepare, Operate and Understand. Strategic items carry an S prefix (SGO, SAP, SAC) and engagement items an E prefix (EGO, EAP, EAC). The identifiers below come from the official Engage v1.0 data set.

Goal	Approach	Example activities (ID)
SGO0001 Prepare	SAP0001 Plan	SAC0004 Cyber Threat Intelligence, SAC0009 Threat Model, SAC0001 Operational Objective, SAC0003 Storyboarding, SAC0002 Persona Creation, SAC0012 Engagement Environment, SAC0005 Gating Criteria
EGO0001 Expose: reveal the presence of ongoing adversary operations	EAP0001 Collect	EAC0001 API Monitoring, EAC0002 Network Monitoring, EAC0003 System Activity Monitoring, EAC0014 Software Manipulation
	EAP0002 Detect	EAC0004 Network Analysis, EAC0005 Lures, EAC0013 Malware Detonation, EAC0023 Introduced Vulnerabilities
EGO0002 Affect: negatively impact the adversary's operations	EAP0003 Prevent	EAC0019 Baseline, EAC0020 Isolation, EAC0017 Hardware Manipulation, EAC0016 Network Manipulation, EAC0018 Security Controls
	EAP0004 Direct	EAC0021 Attack Vector Migration, EAC0009 Email Manipulation, EAC0010 Peripheral Management, EAC0005 Lures
	EAP0005 Disrupt	EAC0020 Isolation, EAC0016 Network Manipulation, EAC0014 Software Manipulation, EAC0005 Lures
EGO0003 Elicit: learn about adversary TTPs	EAP0006 Reassure	EAC0006 Application Diversity, EAC0022 Artifact Diversity, EAC0007 Network Diversity, EAC0008 Burn-In, EAC0011 Pocket Litter, EAC0015 Information Manipulation
EGO0003 Elicit: learn about adversary TTPs	EAP0007 Motivate	EAC0012 Personas, EAC0023 Introduced Vulnerabilities, EAC0013 Malware Detonation, EAC0015 Information Manipulation
SGO0002 Understand	SAP0002 Analyze	SAC0006 After-Action Review, SAC0004 Cyber Threat Intelligence, SAC0009 Threat Model

Several distinctions in the matrix matter in practice:

Pocket Litter versus Lures: the handbook separates them by intent. Pocket Litter (EAC0011) is data that supports the engagement narrative and makes a system believable; Lures (EAC0005) are decoys, breadcrumbs or bait meant to elicit a specific response. The same file can be either, depending on what you planned it to do.
Burn-In (EAC0008): exercising a system so it accumulates realistic artefacts such as browser history, documents and logon records before the adversary sees it.
Baseline (EAC0019): recording key system elements so the environment can be reset to a known state after an operation, which is also your rollback.
Introduced Vulnerabilities (EAC0023): deliberately weakening a decoy. It appears under Detect and Motivate and is the activity that most needs legal and risk sign-off.

Adversary vulnerabilities and the ATT&CK mapping

Engage's central idea is that every adversary action creates an exposure. The data set records 29 engagement adversary vulnerabilities (EAV identifiers) and maps 175 ATT&CK technique IDs to them, with the activity that exploits each one. A few rows from the official mapping show how to read it:

ATT&CK technique	Adversary vulnerability (paraphrased)	Engage activity
T1078 Valid Accounts	EAV0002: interacting with the environment or personas exposes the adversary to manipulated or decoy data	Pocket Litter, Personas, Burn-In
T1078 Valid Accounts	EAV0011: using previously stolen information can reveal earlier collection activity	Lures (for example decoy credentials planted in earlier-stage locations)
T1552 Unsecured Credentials	EAV0028: collecting manipulated artefacts can reveal the adversary when they use or move them	Lures
T1105 Ingress Tool Transfer	EAV0013: reliance on resources being reachable exposes operations to disruption	Isolation
T1105 Ingress Tool Transfer	EAV0020: moving data across the network exposes it to network manipulation	Network Manipulation

The mapping was built against the ATT&CK release current in 2022. ATT&CK v20 has since revoked or restructured some techniques (for example the defence evasion reorganisation), so re-check each technique on attack.mitre.org before you put a mapping row in a plan. The practical use is to start from your prioritised techniques (from threat intelligence or a coverage map, see the MITRE ATT&CK Coverage Mapping Guide) and ask which techniques have weak detection but a strong engagement opportunity. Credential theft and discovery are the usual winners: real users rarely touch a decoy credential or a fake file share, so a hit is a high-fidelity signal.

The 10-step process

The Engage 10-step process is MITRE's refinement of Barton Whaley's "process of deception" from The Art and Science of Military Deception. Steps 1 to 6 are Prepare, step 7 is Operate and steps 8 to 10 are Understand. MITRE notes it is no accident that the engagement itself is the smallest category: preparation and analysis are what make operations useful.

Assess knowledge of your adversaries and your organisation. Build or refresh a threat model, identify critical cyber assets and use threat intelligence. Output: a short list of target adversaries and the assets they want.
Determine your operational objective. Specific, measurable and tied to strategy, with a named Target Adversary (one that targets organisations like yours, a gap in your intelligence, or one using techniques you cannot yet detect).
Determine how you want the adversary to react. The handbook stresses the difference between what the adversary thinks and what they do; plan for the reaction.
Determine what you want the adversary to perceive. Decide what to reveal and what to conceal. Engage cites M-type (misleading) deception, which builds up a wrong alternative, and A-type (ambiguity) deception, which surrounds the target with irrelevant information.
Determine presentation channels. The engagement environment and narrative: which systems, accounts, documents and network paths will carry the story.
Determine success and gating criteria. Define success, the conditions that force a pause or end, the rules of engagement, and the response protocol when a gating criterion triggers. Every operator must know them.
Execute the operation. Deploy the planned activities and monitor continuously against the rules of engagement.
Turn raw data into actionable intelligence. Analyse throughout, not only at the end.
Feed back intelligence. Push indicators, detections and adversary behaviour to the SOC, detection engineering and threat intelligence teams.
Analyse successes and failures to inform future operations. Run an after-action review (SAC0006) and update the threat model.

Choosing an operation: environment and goal

The handbook describes two environment models, and the choice drives cost, risk and what you can learn.

Factor	Integrated (deception in production)	Isolated (synthetic engagement environment)
Typical goal	Expose: tripwires that produce high-quality alerts as the adversary moves	Elicit: observe the adversary or malware with no risk to production assets
Typical activities	Lures, decoy credentials and registry keys, decoy data, Network Monitoring	Personas, Pocket Litter, Burn-In, Malware Detonation, Network and Application Diversity
False positives	Low, because no one has a business reason to touch a decoy; time to first alert can be long	Not the measure; realism and safe containment are
Realism needed	Must match local naming, age and context	Must match what the target adversary expects; insiders need far higher realism than external actors
Main risk	Decoys leaking real data or confusing operations staff	The environment being used to attack third parties
Fits	Most organisations, including small SOCs	Mature teams with threat intelligence, legal support and analysts to process the output

Start with Expose if you have dwell-time concerns, flat networks or weak identity telemetry. Decoy credentials and file shares are cheap and give you a detection you cannot get otherwise. See the Honeytokens and Canary Credentials Guide.
Add Affect when you can safely slow or misdirect activity inside your own network, for example by isolating a compromised host into a monitored segment rather than wiping it at once. Affect needs incident response agreement, because it delays eviction.
Attempt Elicit only when you have an intelligence requirement that justifies the cost. The handbook notes practical details such as ransomware samples that will not run without a domain controller, which tells you how complete an isolated environment must be.
Small versus large organisations: a small team should run one Expose operation with a handful of lures and a clear response playbook. A large organisation can run a standing programme with a deception platform (see the Deception Technology Buyer's Guide), a persona catalogue and periodic Elicit operations tied to intelligence requirements.

Governance, legal and operational safety

Engage puts safety first. The handbook states that the number one priority must be to maintain operational security, through gating criteria and rules of engagement (RoE) agreed by stakeholders before execution.

Stay inside your own estate: Engage limits Affect activities to the defender's network and says plainly it is "NOT talking about hack back". Manipulating your own data is in scope; touching adversary infrastructure is not.
Write the rules of engagement: what operators may and may not do, who approves changes, how long the operation may run, and what data may be captured. The handbook's example rule is that the adversary must not be able to use the engagement environment to target other parties, which implies egress controls and monitoring able to see and stop outbound attacks. The Red Team Rules of Engagement Template is a useful starting structure.
Define gating criteria: examples are the adversary reaching a production system, attempting to attack a third party, touching real personal data, or the operation exceeding its time box. Each needs a named owner and a pre-agreed action (pause, isolate, collapse the environment).
Involve legal, privacy and HR early: captured content may include personal data, and an internal user may trigger a decoy. The handbook says even a non-malicious employee touching a decoy warrants a conversation.
Keep real secrets out: decoy credentials must authenticate nowhere that matters, decoy documents must contain no real business or personal data, and introduced vulnerabilities must be confined to contained systems.
Limit who knows: keep a small, named group aware of the operation, and give the SOC a deconfliction route so analysts do not escalate planned activity as a real incident.

Running a first operation: a phased rollout

Weeks 1 to 2, scope: pick one objective (for example "detect credential theft and lateral movement in the finance segment within 24 hours"), one target adversary profile and the ATT&CK techniques that matter (for example T1552 and T1078). Get written sponsor, legal and SOC sign-off on the RoE and gating criteria.
Weeks 3 to 4, build: create lures and pocket litter that match local conventions, record a Baseline (EAC0019) of each touched system, and route decoy alerts to a dedicated, high-priority queue with a response playbook.
Week 5, test: trigger each lure yourself or with a purple team exercise to prove the alert fires, reaches the right people and contains enough context. See the Purple Teaming Guide.
Weeks 6 onwards, operate: run for the agreed time box, review gating criteria at every alert, and log every operator action.
Close and review: hold the after-action review, feed new detections into detection engineering, and decide whether to extend, change or retire the operation.
Rollback: remove lures and decoy accounts using the inventory, restore baselined systems, and confirm no decoy credential still authenticates anywhere.

Where identity fits

Most production Expose operations are identity operations. Decoy user and service accounts, fake API keys in code repositories, canary cloud access keys and decoy secrets in vaults all exploit the vulnerability Engage records for T1078 and T1552: the adversary has to use what they steal, and using it reveals them. Treat these decoys as non-human identities with an owner, an inventory entry and an expiry date, make sure they hold no real privilege, and exclude them from automated clean-up that would delete them or from access reviews that would flag them noisily. See the Identity Threat Hunting Guide for using decoy hits in hunts.

Measuring whether engagement works

The handbook is explicit that the quality of alerts, not their volume, should judge return on investment. Useful measures:

True positive rate of decoy alerts: share of decoy alerts that were real malicious or policy-violating activity.
Time from lure interaction to triage: minutes between the first decoy touch and an analyst starting work.
Detection gain: number of ATT&CK techniques with no other detection that now have a decoy-based detection.
Intelligence output: new indicators, detections or adversary behaviours delivered to other teams per operation.
Gating discipline: number of gating criteria triggered and the time taken to act on each.
Decoy hygiene: percentage of decoys inventoried, owned and reviewed in the last 90 days.

Framework mapping

Framework	Reference	Relevance
NIST SP 800-53 Rev. 5	SC-26 Decoys; SC-30 Concealment and Misdirection	The control families that directly describe deception
NIST SP 800-53 Rev. 5	SC-44 Detonation Chambers; SC-35 External Malicious Code Identification	Malware Detonation and isolated engagement environments
NIST SP 800-53 Rev. 5	IR-4 Incident Handling; RA-10 Threat Hunting	Response to decoy alerts and use of findings in hunts
NIST CSF 2.0	DE.CM-01, DE.AE-02	Monitoring for and analysing potentially adverse events
NIST CSF 2.0	ID.RA-05, ID.IM-02	Threat-informed risk prioritisation; improvement from tests and exercises
MITRE ATT&CK v20	Techniques such as T1078, T1552, T1105	Engage's mapping from adversary behaviour to engagement opportunity
NIST SP 800-160 Vol. 2 Rev. 1	Cyber resiliency techniques	Systems engineering context for designing deception and diversity into systems

Common failure patterns

Deploying decoys without an objective: lures are placed because a platform makes it easy, nobody owns the alerts and the programme is judged by decoy count. Start every operation at step 2.
No gating criteria: an operation runs for months, an adversary is observed but not evicted, and nobody can say who decided to wait. Write the stop conditions and owners first.
Decoys that are obviously fake: new accounts with no history, folders named "passwords", timestamps all from the same day. Use Burn-In and local naming.
Real credentials or data in decoys: a "decoy" key that actually works, or test data copied from production. This turns a detection control into an exposure.
No feedback loop: decoy hits close as incidents but never become detections, hunts or intelligence. Steps 8 to 10 are the point of the exercise.
Confusing emulation with engagement: running an emulation tool against decoys proves the alert fires, but it is not an engagement operation and does not produce adversary intelligence.

Practitioner checklist

Read the Engage handbook and 10-step process sheet, and keep the matrix IDs in your planning templates.
Write one measurable operational objective and name the target adversary before choosing any activity.
Select activities from the ATT&CK mapping for your priority techniques, and re-verify each technique against current ATT&CK.
Agree rules of engagement, gating criteria and response actions with sponsor, legal, privacy and SOC leads in writing.
Keep every activity inside your own estate; no interaction with adversary infrastructure.
Baseline every system you alter and keep a full inventory of lures, decoy accounts and pocket litter.
Test each lure end to end before the operation starts, then route decoy alerts to a high-priority queue.
Run an after-action review and feed detections and intelligence back to the SOC and threat intelligence team.
Track true positive rate, time to triage and detection gain, and retire decoys that no longer serve an objective.

MITRE Engage Guide: Planning Adversary Engagement and Deception