Automated Adversary Emulation Platform
Caldera™ is a cyber security platform designed to easily automate adversary emulation, assist manual red-teams, and automate incident response.
It is built on the MITRE ATT&CK™ framework and is an active research project at MITRE.
The framework consists of two components:
⭐ Create your own plugin! Plugin generator: Skeleton ⭐
These plugins are supported and maintained by the Caldera team.
These plugins are ready to use but are not included by default and are not maintained by the Caldera team.
These requirements are for the computer running the core framework:
Note: we HIGHLY recommend installing Caldera in a Python virtual environment to avoid issues with pip packages. You can use an existing environment if you wish or create a new one from scratch:
python3 -m venv .calderavenv
source .calderavenv/bin/activate
Concise installation steps:
git clone https://github.com/apache/caldera.git --recursive
cd caldera
pip3 install -r requirements.txt
python3 server.py --insecure --build
Full steps: Start by cloning this repository recursively, passing the desired version/release in x.x.x format. This will pull in all available plugins.
git clone https://github.com/apache/caldera.git --recursive --tag x.x.x
Next, install the PIP requirements:
pip3 install -r requirements.txt
Finally, start the server.
python3 server.py --insecure --build
The --build flag automatically installs any VueJS UI dependencies, bundles the UI into a dist directory and is served by the Caldera server. You will only have to use the --build flag again if you add any plugins or make any changes to the UI. Once started, log into http://localhost:8888 using the default credentials red/admin. Then go into Plugins -> Training and complete the capture-the-flag style training course to learn how to use Caldera.
If you prefer to not use the new VueJS UI, revert to Caldera v4.2.0. Correspondingly, do not use the --build flag for earlier versions as not required.
Additionally, please note security recommendations for deploying Caldera.
Local build:
git clone https://github.com/apache/caldera.git --recursive
cd caldera
docker build --build-arg VARIANT=full -t caldera .
docker run -it -p 8888:8888 caldera
Adjust the port forwarding (-p) and build args (--build-arg) as desired to make ports accessible or change the Caldera variant. The ports that you expose depend on which contacts you plan on using (see Dockerfile and docker-compose.yml for reference).
Pre-Built Image (from GitHub Container Registry):
docker run -p 8888:8888 ghcr.io/apache/caldera:latest
This container may be slightly outdated, we recommend building the container yourself.
To gracefully terminate your docker container, do the following:
# Find the container ID for your docker container running Caldera
docker ps
# Stop the container
docker stop <container ID>
There are two variants available, full and slim. The slim variant doesn't include files necessary for the emu and atomic plugins, which will be downloaded on-demand if the plugins are ever enabled. The full variant is suitable for operation in environments without an internet connection. Slim images on GHCR are prefixed with "slim".