splunk/attack_range

Features

• Cybersecurity Breach Simulators - Orchestrates the lifecycle of security labs and executes controlled attack scenarios to validate defensive capabilities.
• Breach Simulation Frameworks - Orchestrates the lifecycle of security labs and executes controlled attack scenarios to measure defensive effectiveness.
• Cloud Security Lab Provisioning - Provisions isolated cloud or local environments pre-configured with known security weaknesses to serve as targets for cyberattack exercises.
• Execution Simulation - Executes automated attack sequences against provisioned infrastructure to test detection capabilities and generate realistic security telemetry.
• Infrastructure as Code - Uses declarative templates to automate the provisioning and teardown of cloud-based virtual environments and network configurations.
• Infrastructure Orchestration - Orchestrates the creation and destruction of cloud-based lab environments using templates to generate security telemetry for analysis.
• Preconfigured Lab Environments - Provisions repeatable and vulnerable testing environments to validate detection capabilities against automated attack sequences.
• Remote Session Recorders - Captures desktop activity and keystrokes during simulated cyberattacks to generate security telemetry for analysis.
• Cloud Infrastructure Orchestration - Automates the deployment and teardown of isolated, vulnerable lab environments in the cloud for repeatable security research and testing.
• Configuration-Driven Deployments - Executes predefined sequences of security tasks and system settings by parsing structured configuration files during the deployment lifecycle.
• Testing Environment Templates - Stores and retrieves configuration definitions to ensure that testing environments remain consistent and repeatable across every deployment.
• VPN - Automates the deployment of secure network tunnels to provide isolated access to simulated infrastructure during the build process.
• Attack Simulations - Enables the management, monitoring, and termination of active infrastructure deployments with real-time status updates on security operation progress.
• Secure Remote Access - Configures secure virtual private network tunnels to provide team members with controlled access to simulated lab environments.
• Cybersecurity Training Labs - Provisions and manages secure, temporary environments for teams to practice incident response and threat hunting in a controlled setting.
• Asynchronous Task Execution - Manages long-running infrastructure builds and simulation sequences through a background process model with real-time status tracking.
• Modular Plugin Frameworks - Applies isolated automation roles to target environments to trigger specific security events without affecting the underlying infrastructure management layer.
• Remote Access Tunnels - Establishes secure, isolated communication channels between the management interface and remote lab environments for controlled access.
• Endpoint Auditing Configurations - Enables advanced system auditing and process monitoring on target machines to track attacker behavior.
• Lab Lifecycle Management - Provides a unified interface for building, destroying, and managing the lifecycle of security simulation environments via command line or programming interfaces.
• Detection Rule Testing - Builds and tests security detection rules by simulating real-world cyberattacks against instrumented infrastructure to verify alert effectiveness.
• Attack-Driven Telemetry Generators - Creates realistic logs and system audit data by executing automated attack sequences against target servers to populate security analysis platforms.
• Agent-Based Collectors - Deploys monitoring agents onto target systems to capture and forward granular security events for analysis.
• Security Event Simulators - Applies custom automation roles against running infrastructure to trigger specific security events and test detection capabilities.

Star history