The Attack Range solves two main challenges in development of detections. First, it allows the user to quickly build a small lab infrastructure as close as possible to your production environment. This lab infrastructure contains a Windows Domain Controller, Windows Server, Windows Workstation and a Kali Machine, which comes pre-configured with multiple security tools and logging configuration. The infrastructure comes with a Splunk server collecting multiple log sources from the different servers.
Second, this framework allows the user to perform attack simulation using different engines. Therefore, the user can repeatedly replicate and generate data as close to "ground truth" as possible, in a format that allows the creation of detections, investigations, knowledge objects, and playbooks in Splunk.
Attack Range can be built in three different ways:
- local using vagrant and virtualbox
- in the cloud using terraform and AWS
- cloud optimized using terraform, packer and AWS
Attack Range consists of Windows Domain Controller, Windows Server, Windows Workstation and a Kali Machine, which can be added/removed/configured using attack_range.conf. More machines such as Phantom, Linux Server, Linux Client are currently under development.
- local Vagrant and Virtualbox
- cloud Terraform and AWS
- cloud optimized Packer + Terraform and AWS
Attack Range supports different actions:
- Build Attack Range
- Perform Attack Simulation
- Search with Attack Range
- Destroy Attack Range
- Stop Attack Range
- Resume Attack Range
- Build Attack Range
python attack_range.py -m terraform/vagrant/packer -a build
- Perform Attack Simulation
python attack_range.py -m terraform/vagrant/packer -a simulate -st T1117,T1003 -t attack-range-windows-domain-controller
- Run a savedsearch and return the results
python attack_range.py -m terraform/vagrant/packer -a search -sn search_name
- Destroy Attack Range
python attack_range.py -m terraform/vagrant/packer -a destroy
- Stop Attack Range
python attack_range.py -m terraform/vagrant/packer -a stop
- Resume Attack Range
python attack_range.py -m terraform/vagrant/packer -a resume
Please use the GitHub issue tracker to submit bugs or request features.
If you have questions or need support, you can:
- Post a question to Splunk Answers
- Join the #security-research room in the Splunk Slack channel
- If you are a Splunk Enterprise customer with a valid support entitlement contract and have a Splunk-related question, you can also open a support case on the https://www.splunk.com/ support portal
- Patrick Bareiß
- Bhavin Patel
- Rod Soto
- Russ Nolen
- Phil Royer
- Joseph Zadeh
We welcome feedback and contributions from the community! Please see our contribution guidelines for more information on how to get involved.