MitreCaldera

Mitre Caldera can be used to test endpoint security solutions and assess a network's security posture against the common post-compromise adversarial techniques contained in the ATT&CK model. CALDERA leverages the ATT&CK model to identify and replicate adversary behaviors as if a real intrusion is occurring.

Category

IT Services

Pack

MitreCaldera

Configuration parameters

• url — Server URL (e.g. https://www.example.com:8888) (required)
• api_key — API Key (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• isFetch — Fetch incidents
• incidentFetchInterval — Incidents Fetch Interval
• incidentType — Incident type
• client_name — Filter name
• first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
• max_fetch — Maximum number of incidents per fetch

Commands (53)

• caldera-create-ability — Creates a new ability.
• caldera-create-adversary — Create a new adversary.
• caldera-create-agent — Create a new agent.
• caldera-create-fact — Create a Fact.
• caldera-create-fact-source — Create a Fact Source.
• caldera-create-objective — Create a new objective.
• caldera-create-operation — Create a new CALDERA operation record.
• caldera-create-potential-link — Creates a potential Link.
• caldera-create-relationship — Create a Relationship.
• caldera-create-schedule — Create Schedule.
• caldera-delete-ability — Deletes an ability.
• caldera-delete-adversary — Deletes an adversary.
• caldera-delete-agent — Delete an Agent.
• caldera-delete-fact-source — Delete an existing Fact Source.
• caldera-delete-facts — Delete One or More Facts.
• caldera-delete-operation — Delete an operation by operation id.
• caldera-delete-relationships — Delete One or More Relationships.
• caldera-delete-schedule — Delete Schedule.
• caldera-get-abilities — Get all Abilities with optional ability ID.
• caldera-get-adversaries — Get all Adversaries with optional Adversary ID.
• caldera-get-agents — Retrieves all agents with optional Agent PAW.
• caldera-get-config — Retrieve Config.
• caldera-get-contacts — Retrieve a List of all available Contact reports.
• caldera-get-deploy-commands — Retrieve deploy commands with optional Ability ID.
• caldera-get-facts — Retrieve Facts with optional Operation ID.
• caldera-get-health — Health endpoints returns the status of CALDERA.
• caldera-get-obfuscators — Retrieve obfuscators with optional name.
• caldera-get-objectives — Retrieve objectives with optional Objective ID.
• caldera-get-operation-event-logs — Get Operation Event Logs.
• caldera-get-operation-links — Get Links from Operation with optional Link ID.
• caldera-get-operation-links-result — Retrieve the result of a link.
• caldera-get-operation-report — Get Operation Report.
• caldera-get-operations — Retrieve operations.
• caldera-get-operations-potential-links — Retrieve potential links for an operation with optional PAW.
• caldera-get-planners — Retrieve planners with optional Planner ID.
• caldera-get-plugins — Retrieve plugins with optional Name.
• caldera-get-relationships — Retrieve Relationships with optional Operation ID.
• caldera-get-schedules — Retrieve Schedules with optional Schedule ID.
• caldera-get-sources — Retrieve all Fact Sources with optional Fact Source ID.
• caldera-replace-ability — Replaces an existing ability.
• caldera-replace-schedule — Replace Schedule.
• caldera-update-ability — Updates an existing ability.
• caldera-update-adversary — Update an adversary.
• caldera-update-agent — Update an Agent.
• caldera-update-agent-config — Update Agent Config.
• caldera-update-fact-source — Update an existing Fact Source.
• caldera-update-facts — Update One or More Facts.
• caldera-update-main-config — Update Main Config.
• caldera-update-objective — Update an objective.
• caldera-update-operation-fields — Update fields within an operation.
• caldera-update-operation-link — Update the specified link within an operation.
• caldera-update-relationships — Update One or More Relationships.
• caldera-update-schedule — Update Schedule.