diff --git a/extensions/deception/deception.xsd b/extensions/deception/deception.xsd
new file mode 100644
index 0000000..9214afe
--- /dev/null
+++ b/extensions/deception/deception.xsd
@@ -0,0 +1,77 @@
+
+
+
+
+
+ Capture the ways that defenders can use deception
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Sneaky methods that defenders can use to detect intrusions
+
+ 1.0
+
+
+
+
+
+ Deciding why you are taking the deceptive action
+
+
+
+
+
+ Understanding what the intruders are doing
+
+
+
+
+
+ Writing a plausible story for your deception
+
+
+
+
+
+ Implementing cover story via technical methods
+
+
+
+
+
+ Seeding the environment with false information
+
+
+
+
+
+ Placing the environment in an intruder-visible spot
+
+
+
+
+
+ Watching for intruders to fall for it
+
+
+
+
+
+ Building a plausible reason for the deception
+
+
+
+
+
+
+
diff --git a/extensions/deception/sample.xml b/extensions/deception/sample.xml
new file mode 100644
index 0000000..d3f427e
--- /dev/null
+++ b/extensions/deception/sample.xml
@@ -0,0 +1,90 @@
+
+
+
+
+
+
+ Breach of Cyber Tech Dynamics
+
+
+
+
+ Monitor activity related to known compromised accounts
+
+ Monitor
+
+ Redirection (Honey Pot)
+
+ Allow login with credentials at this domain, with intensified monitoring and dis-allowing any destructive actions.
+
+
+ This will further our investigation into the intruders who are re-using compromised accounts.
+
+
+
+
+
+
+ cybertech.biz
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+