Honeypot allocation has emerged as a pivotal strategy in cyber deception. However, existing approaches often face scalability issues, limited coordination, and inadequate consideration of intrusion stages, which constrain their effectiveness in complex attack environments. To address these challenges, this study introduces Hawkeyes, a hierarchical multi-agent reinforcement learning (HMARL) framework for adaptive honeypot allocation. The framework combines a high-level policy, which selects strategies based on intrusion progression and asset criticality, with low-level agents that determine precise placements within grouped regions. Scalability is ensured through action-space reduction via grouping and multi-agent decomposition. Network states are modeled as enriched graphs that capture compromised nodes, topology, and host vulnerabilities, enabling stage-aware and context-rich decision making. Experimental results show that Hawkeyes outperforms baseline RL methods, achieving 15–18\% higher trapping efficiency and superior stage-aware defense (48.4\% vs. 30.6\% efficiency at False Negative Rate of 0.05). It also maintains stable performance under topology and vulnerability variations, while ensuring real-time deployment with sub-5s latency.
