caldera: Automate Adversary Emulation and Red-Team Operations

Overview

Caldera helps security teams automate adversary emulation, support manual red-team exercises, and automate incident response. Built around the MITRE ATT&CK framework, its core provides an asynchronous command-and-control server, REST API, and web interface.

Plugins add capabilities such as endpoint agents, ATT&CK technique collections, payload building, reporting, and response workflows. This makes Caldera a platform to assemble for a team's testing needs, rather than a single-purpose scanner.

Key Features

• Model emulation activities around MITRE ATT&CK techniques.
• Coordinate operations through an asynchronous command-and-control server.
• Manage the platform through a REST API and web interface.
• Extend the core with plugins for agents, TTP collections, reporting, and incident response.
• Use supported plugins such as Sandcat, Stockpile, Atomic, and Response.
• Run locally from source or in Docker.

Use Cases

• Red teams can automate repeatable adversary-emulation exercises and use manual operations where needed.
• Security validation teams can test defenses against ATT&CK-aligned techniques in a controlled environment.
• Incident response teams can use the platform's response capabilities to support automated workflows.
• Training teams can use the included training plugin and its capture-the-flag-style course to introduce operators to Caldera.

Getting Started

The README recommends a Python virtual environment. For a concise setup, clone with submodules, install requirements, and start the server:

git clone https://github.com/apache/caldera.git --recursive
cd caldera
pip3 install -r requirements.txt
python3 server.py --insecure --build

See the README for full installation, Docker, plugin, and training instructions.

Alternatives

• openaev: OpenAEV focuses on planning and coordinating simulation campaigns, while Caldera emphasizes ATT&CK-based emulation through an extensible command-and-control platform.

Considerations

The project warns against exposing Caldera to the internet: its web interface has basic authentication and security features, and is not described as hardened or thoroughly penetration-tested. The quick-start command uses --insecure, so follow the project's security recommendations before deployment. The latest release is over a year old despite ongoing commits, and the core's capabilities depend on plugins. Running the UI build requires Node.js, and the README recommends at least Python 3.10; dynamically compiling Go-based agents additionally requires Go. Docker data is ephemeral by default, and the Builder plugin does not work in Docker.