: Moving beyond simple detection to identify who is attacking and what their specific tactics are. This often involves using "beacons" or "honeytokens" that alert defenders when an attacker interacts with specific files.
Instead of just trying to block the attacker (passive defense), you use to make your network a hostile environment for them .