Setting Up Your Organization

Understanding Organizations

In WebDecoy, an organization is the top-level container for all your resources. Everything you create (domains, decoys, detections, and integrations) belongs to an organization.

Organization Hierarchy

Organization
├── Properties
│   ├── Property A (e.g., "Production Website")
│   │   ├── Domains
│   │   ├── Decoys
│   │   └── Detection Scripts
│   └── Property B (e.g., "Staging Environment")
│       ├── Domains
│       ├── Decoys
│       └── Detection Scripts
├── Integrations (organization-wide)
├── API Keys
└── Subscription/Billing

Organizations as Billing Units

Your subscription and billing are tied to your organization:

• One subscription per organization
• Usage limits apply at the organization level
• Invoices are generated per organization
• Plan upgrades affect all properties within the organization

One Organization Per Account

WebDecoy is built around one organization per account. The API refuses to create a second organization for an account that already belongs to one. Separate websites, applications, or environments go in separate properties inside that organization.

---

Creating Your First Organization

If you’re a first-time user, organization creation happens automatically during onboarding. Here’s what happens:

Automatic Setup During Onboarding

1. You see the “Welcome to WebDecoy” screen after first login
2. Enter your website and, optionally, a Workspace name (it defaults to your site)
3. Click “Connect website”
4. WebDecoy automatically:
   • Creates your organization
   • Creates a “Default Property” within it, carrying your site URL
   • Places the organization on free monitoring; the one-time 14-day Pro trial starts only after an install verifies
   • Adds you as the organization owner
   • Provisions a working example decoy on the WebDecoy shared domain so you have a live honeypot URL the moment you land on the dashboard, with no DNS configuration required

Organization Settings

After creation, you can modify your organization:

1. Click your profile avatar (bottom-left)
2. Click Organization
3. Update the organization name if needed
4. Click Save

---

Navigating the Dashboard After Setup

Once your organization is created, you’ll have full access to the WebDecoy dashboard.

Sidebar Navigation

The left sidebar provides access to all features:

┌─────────────────────────┐
│  [Logo] Property ▾      │  ← Select active property
├─────────────────────────┤
│  Dashboard              │  ← Overview
├─ Bot traffic ───────────┤
│  Actors                 │  ← Cross-IP adversary identities
│  Detections             │  ← View threat detections
│  Analytics              │  ← Volume charts
├─ AI traffic ────────────┤
│  AI Crawlers            │  ← Verified and claimed AI agents
│  AI Traffic             │  ← Traffic referred by AI assistants
│  Crawled Pages          │  ← Pages AI crawlers fetched
│  Bot Directory          │  ← Known-bot reference
├─ Countermeasures ───────┤
│  Sensors                │  ← What is reporting, per site
│  Enforcement            │  ← Policy, WAF pipeline, response actions
│  Decoys                 │  ← Manage decoys
│  Detection Scripts      │  ← Client-side detection
├─ Configuration ─────────┤
│  Integrations           │  ← Connector catalog
│  Domains                │  ← Custom domain setup
│  API Keys               │  ← SDK authentication
├─────────────────────────┤
│  [Your Profile]         │  ← Profile, Properties, Organization,
│                         │    Team, Billing, Connected apps,
│                         │    Documentation, Contact Support, Logout
└─────────────────────────┘

Property, organization, team, and billing settings live under the profile avatar menu (bottom-left), not in the sidebar.

Property Selector

At the top of the sidebar, you’ll see a property dropdown:

• Shows the currently active property
• Click to switch between properties
• All data displayed is filtered by the selected property

Dashboard Overview

The main dashboard (/dashboard) shows:

Section	Description
Setup checklist	Shown until the required onboarding steps are done
Geographic Map	Detection locations plotted on a map
Protection status	Sensor coverage per site, with Coverage gaps linking to fixes
Needs review	Clients caught by decoys and tripwires, awaiting Approve denial or Dismiss
Adversaries	Identities that persist across IP rotation, ordered by what needs a decision
Enforcement outcomes	What your edge validator did over the last 14 days

Use the 7d / 14d / 30d picker (top-right) to change the window. The volume charts (Detection Signals, AI Scraper Detections, Signal Radar, and others) are on Analytics (/detections/analytics).

Key Actions from Dashboard

From the dashboard, you can quickly:

1. View recent detections - Click “Detections” in the sidebar
2. Create a decoy - Click “Decoys” then “New Decoy”
3. Set up a domain - Click “Domains” in the sidebar
4. Configure integrations - Click “Integrations”

Understanding the User Menu

Click your profile avatar (bottom-left) to access:

Option	Description
Profile	View your account details
Properties / Organization / Team / Billing	Open the matching settings panel
Connected apps	AI assistants connected over MCP
Documentation / Contact Support	Help
Logout	Sign out of WebDecoy

Your current plan is shown under your name on the profile button itself.

---

Quick Start Checklist

After setting up your organization, follow these steps to get protected:

Recommended Setup Order

• 1. Try the example decoy: a working honeypot URL on the WebDecoy shared domain is auto-provisioned during org creation

  • Hit the URL from your browser via the “Send a test detection” button in the dashboard setup checklist
  • Verify the detection appears in real-time

• 2. Create your own decoys (Decoy Links guide)

  • Add more honeypot links (they default to the shared domain too)
  • Deploy them on your website

• 3. Set up a detection script (Detection Scripts guide)

  • Create a scanner configuration
  • Install the JavaScript snippet

• 4. Configure integrations (Integrations guide)

  • Connect your WAF as an enforcement target
  • Set up Slack for notifications

• 5. (Optional) Add a custom domain (Domain Setup guide)

  • Host decoys under your own branded URL instead of the shared domain
  • Decoys keep working on the shared domain, so this is purely an upgrade

• 6. Monitor detections (Detections guide)

  • Review incoming threats
  • Analyze threat scores

Time to First Detection

The example decoy on the shared domain is live as soon as your organization exists, so the Send a test detection button produces a detection right away. A detection script or decoy link on your own site reports once you deploy it and a page loads. A custom domain additionally waits on your DNS change and SSL issuance.

---

Organization Limits

Property and stored-event limits belong to the organization and depend on its plan. The current headline limits are:

Plan	Properties	Stored events / month
Free	1	5,000
Starter	3	50,000
Pro	10	500,000
Agency	25 included	2,000,000 pooled

View the live catalog and current usage under Billing in the profile menu (bottom-left). See Plans and billing for retention and feature differences.

---

Next Steps

Your organization is ready, and an example decoy is already live on the WebDecoy shared domain. Common next steps:

• Create Decoy Links: add more honeypots (shared domain by default; no DNS setup required)
• Domain Setup (optional): host decoys under your own branded URL with DNS + SSL

After exploring decoys, you can:

• Team Management - Invite team members and manage roles
• Managing Properties - Organize resources with properties
• Subscriptions and Billing - Understand plans and limits