A data storage system filter operates through a filter framework in a file system to detect and provide customized responses to unauthorized access attempts. A security event definition determines when file system access events are classified as unauthorized access attempts. A trap manager manages the security events, and causes traps to be installed to capture file system responses. The trapped responses can be replaced with customized data, such as static artificial data, or artificial data generated based on a context of the request and/or response. The security filter can be loaded or unloaded in the filter framework and operates on a callback mechanism to avoid significant disruption of I/O activity.