This process basically creates a second copy of the operating system that sits inside the protected shell of the cage. Within this cage, the file structures, data and processes look just like Solaris because in essence they are. In addition, the installation process attempts to create fake data and users that emulate what would appear on a real server. Most of the fake data is created randomly by ManTrap, but administrators can input five actual users and the company name and domain. Some of this information is used to create data that more closely mimics a corporation's real servers.
Administrators can further manipulate data in the cage to make it truly credible.
This is a good thing because the randomly created ManTrap data is a marginal start at making the server believable. For example, ManTrap created a couple hundred users and corresponding home directories in tests but didn't populate them with data. At minimum, some real, albeit nonsensitive, data should be copied over to the ManTrap system, and it would need to be done periodically to keep the bait fresh. Network Associates Inc.'s CyberCop Sting, which shipped in July, was the first commercial option, according to company officials. As with ManTrap, it's questionable whether a top-tier cracker would find Sting believable.