diff --git a/documentation/idioms/deception-usage/decep_consumer.py b/documentation/idioms/deception-usage/decep_consumer.py
new file mode 100644
index 00000000..982b22b6
--- /dev/null
+++ b/documentation/idioms/deception-usage/decep_consumer.py
@@ -0,0 +1,26 @@
+#!/usr/bin/env python
+# Copyright (c) 2014, The MITRE Corporation. All rights reserved.
+# See LICENSE.txt for complete terms.
+
+import sys
+from stix.core import STIXPackage, STIXHeader
+
+def parse_stix( pkg ):
+ print "== INCIDENT =="
+ for inc in pkg.incidents:
+ for coa in inc.coa_requested:
+ requested = coa.course_of_action
+ print "COA: " + str(requested.title)
+ print "Stage: "+ str(requested.stage)
+ print "Type: "+ str(requested.type_)
+ print "Objective: "+ str(requested.objective.description)
+
+ return
+
+if __name__ == '__main__':
+ try: fname = sys.argv[1]
+ except: exit(1)
+ fd = open(fname)
+ stix_pkg = STIXPackage.from_xml(fd)
+
+ parse_stix(stix_pkg)
diff --git a/documentation/idioms/deception-usage/decep_producer.py b/documentation/idioms/deception-usage/decep_producer.py
new file mode 100644
index 00000000..8fca0aef
--- /dev/null
+++ b/documentation/idioms/deception-usage/decep_producer.py
@@ -0,0 +1,42 @@
+#!/usr/bin/env python
+# Copyright (c) 2014, The MITRE Corporation. All rights reserved.
+# See LICENSE.txt for complete terms.
+
+'''
+The following code requires python-stix v1.1.0.4 or greater installed.
+For installation instructions, please refer to https://github.com/STIXProject/python-stix.
+'''
+
+def main():
+ from stix.coa import CourseOfAction, Objective
+ from stix.common import Confidence
+ from stix.core import STIXPackage
+ from stix.incident import Incident
+ from cybox.core import Observables
+ from cybox.objects.address_object import Address
+
+ from stix.common.vocabs import VocabString
+
+ pkg = STIXPackage()
+
+ incident = Incident(title="Breach of Cyber Tech Dynamics")
+
+ coa = CourseOfAction()
+ coa.title = "Monitor activity related to known compromised accounts"
+ coa.stage = VocabString("Monitor")
+ coa.stage.xsi_type = "stixVocabs:DeceptionVocab-1.0"
+ coa.type_ = "Redirection (Honey Pot)"
+
+ obj = Objective()
+ obj.description = "This will further our investigation into the intruders who are re-using compromised accounts."
+
+ coa.objective = obj
+
+ incident.add_coa_requested(coa)
+
+ pkg.add_incident(incident)
+
+ print pkg.to_xml()
+
+if __name__ == '__main__':
+ main()
\ No newline at end of file
diff --git a/documentation/idioms/deception-usage/index.md b/documentation/idioms/deception-usage/index.md
new file mode 100644
index 00000000..95b4db69
--- /dev/null
+++ b/documentation/idioms/deception-usage/index.md
@@ -0,0 +1,85 @@
+---
+layout: flat
+title: Deception for Defense
+constructs:
+ - Incident
+ - Course of Action
+summary: Leverage deception to build shared awareness of threats
+---
+
+## Scenario
+Network defense teams can leverage deception to mitigate fraud and intrusions, while sharing lessons learned and effective strategies.
+
+One method of referencing these actions is the "Deception Kill Chain" [described by MITRE ](http://deceptionbook.com)
+
+An organization might send an Incident report describing their strategy :
+
+- The Purpose of their deception: prevent intruders from unauthorized access to customer accounts
+- Their Collected Intelligence on intruders
+- Creation of a Cover Story with false identity and associated accounts
+- Their Plan and Preparations to link that identity to the company
+- Monitoring of attempts to interact with the false identity
+
+## Data model
+To describe deception techniques, an [Incident can reference ](https://stixproject.github.io/data-model/{{site.current_version}}/indicator/IndicatorType/) one or more [Courses of Action that describe mitigation techniques](https://stixproject.github.io/data-model/{{site.current_version}}/coa/CourseOfActionType/)
+
+## Implementation
+
+{% include start_tabs.html tabs="XML|Python Producer|Python Consumer" name="indicator-w-kill-chain" %}{% highlight xml linenos %}
+
+
+
+ Breach of Cyber Tech Dynamics
+
+
+ Monitor activity related to known compromised accounts
+ Monitor
+ Redirection (Honey Pot)
+
+ Further investigation into intruders re-using compromised accounts
+
+
+
+
+
+
+
+{% endhighlight %}{% include tab_separator.html %}{% highlight python linenos %}
+pkg = STIXPackage()
+incident = Incident(title="Breach of Cyber Tech Dynamics")
+
+coa = CourseOfAction()
+coa.title = "Monitor activity related to known compromised accounts"
+coa.stage = VocabString("Monitor")
+coa.stage.xsi_type = "stixVocabs:DeceptionVocab-1.0"
+coa.type_ = "Redirection (Honey Pot)"
+
+obj = Objective()
+obj.description = "Further investigation into intruders re-using compromised accounts"
+
+coa.objective = obj
+
+incident.add_coa_requested(coa)
+
+pkg.add_incident(incident)
+
+print pkg.to_xml()
+
+{% endhighlight %}{% include tab_separator.html %}{% highlight python linenos %}
+
+print "== INCIDENT =="
+for inc in pkg.incidents:
+ for coa in inc.coa_requested:
+ requested = coa.course_of_action
+ print "COA: " + str(requested.title)
+ print "Stage: "+ str(requested.stage)
+ print "Type: "+ str(requested.type_)
+ print "Objective: "+ str(requested.objective.description)
+
+
+{% endhighlight %}{% include end_tabs.html %}
+
+[Full XML](sample.xml) | [Python Producer](indicator-w-kill-chain_producer.py) | [Python Consumer](indicator-w-kill-chain_consumer.py)
+## Further Reading
+
+* [Kill Chain Definition](/data-model/{{site.current_version}}/stixCommon/KillChainType/)
diff --git a/documentation/idioms/deception-usage/sample.xml b/documentation/idioms/deception-usage/sample.xml
new file mode 100644
index 00000000..c7ec1e33
--- /dev/null
+++ b/documentation/idioms/deception-usage/sample.xml
@@ -0,0 +1,28 @@
+
+
+
+ Breach of Cyber Tech Dynamics
+
+
+ Monitor activity related to known compromised accounts
+ Monitor
+ Redirection (Honey Pot)
+
+ Further investigation into intruders re-using compromised accounts
+
+
+
+
+
+
+