unified
UC-NET-10 — Deploy deception and dynamic detection capabilities
Deploy decoy components (honeypots or honeynets) and honeyclient capabilities to attract, detect, and analyze malicious activity and externally hosted malicious code without exposing production assets. Detonate suspicious files, URLs, and code in isolated sandbox environments before delivery to users, and relocate or reposition detection sensors as threat conditions change.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- domain
- Network & Communications Security
- type
- detective
- category
- technical
Details
- unified_id
- UC-NET-10
- title
- Deploy deception and dynamic detection capabilities
- statement
- Deploy decoy components (honeypots or honeynets) and honeyclient capabilities to attract, detect, and analyze malicious activity and externally hosted malicious code without exposing production assets. Detonate suspicious files, URLs, and code in isolated sandbox environments before delivery to users, and relocate or reposition detection sensors as threat conditions change.
- domain
- Network & Communications Security
- control_type
- detective
- control_category
- technical
- members
- framework
- nist-800-53
- control_id
- SC-26
- coverage
- full
- relationship
- superset_of
- framework
- nist-800-53
- control_id
- SC-35
- coverage
- full
- relationship
- superset_of
- framework
- nist-800-53
- control_id
- SC-44
- coverage
- full
- relationship
- superset_of
- framework
- nist-800-53
- control_id
- SC-48
- coverage
- full
- relationship
- superset_of
- guidance
Source
No record-specific source URL is provided.
Connections
- UC-NET-10 — Deploy deception and dynamic detection capabilities maps_to SC-35 — External Malicious Code Identification
- framework
- nist-800-53
- control_id
- SC-35
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- Rev. 5
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-NET-10 — Deploy deception and dynamic detection capabilities maps_to SC-44 — Detonation Chambers
- framework
- nist-800-53
- control_id
- SC-44
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- Rev. 5
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-NET-10 — Deploy deception and dynamic detection capabilities maps_to SC-48 — Sensor Relocation
- framework
- nist-800-53
- control_id
- SC-48
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- Rev. 5
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-NET-10 — Deploy deception and dynamic detection capabilities mitigates Malware delivery, insertion and compromise of systems
- strength
- primary
- rationale
- Detonating suspicious files/URLs/code in isolated sandboxes before delivery and honeyclient identification of malicious code block malware delivery.
- Deception, Honeytoken & OPSEC Concealment Operations operates UC-NET-10 — Deploy deception and dynamic detection capabilities
- Security Control Assessment & POA&M Remediation tests UC-NET-10 — Deploy deception and dynamic detection capabilities
- UC-NET-10 — Deploy deception and dynamic detection capabilities maps_to SC-26 — Decoys
- framework
- nist-800-53
- control_id
- SC-26
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- Rev. 5
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-NET-10 — Deploy deception and dynamic detection capabilities mitigates Adversary reconnaissance and information gathering
- strength
- related
- rationale
- Decoy components attract and detect scanning and probing, revealing reconnaissance activity.