{
  "markdown": "# Caldera Attack Simulation Lab\n\nAdversary emulation playbook for three production-ready attack scenarios demonstrating Palo Alto Networks Cortex XDR and XSIAM detection capabilities.\n\n## For Your Colleague — Getting Started\n\nCopy and paste this prompt into Claude Code on your machine:\n\n```\nDownload the repo at https://github.com/bsookying/caldera-attack-sim to\nC:\\Users\\lab-user\\caldera-attack-sim using PowerShell (no git required —\ndownload as zip and extract). Then read the CLAUDE.md in the repo root and\nset up both Caldera instances (192.168.8.121:8888 and 192.168.3.21:8888)\nusing admin/admin by doing the following in order:\n\n1. On caldera-1 (192.168.8.121): create all three adversary profiles via\n   POST /api/v2/adversaries using the JSON files in setup/ prefixed 04_, 05_, 06_.\n   Verify every ability ID exists and report anything missing.\n2. On caldera-1: create the three fact sources by SSHing to 192.168.8.121\n   as lab-user using the key at C:\\Users\\lab-user\\.ssh\\id_rsa, finding the\n   Caldera PID (pgrep -f server.py), and writing each YAML file from setup/\n   (prefixed 01_, 02_, 03_ ending in .yml) to:\n   /proc/[PID]/root/usr/src/app/data/sources/\n3. Enable the human and gameboard plugins on caldera-1 by sending:\n     PATCH http://192.168.8.121:8888/api/v2/config/main\n     {\"prop\": \"plugin\", \"value\": \"human\"}   (then repeat for \"gameboard\")\n   Then restart the caldera-1 container:\n     ssh lab-user@192.168.8.121 sudo docker restart $(sudo docker ps --format '{{.Names}}' | head -1)\n4. Enable the human and gameboard plugins on caldera-2 the same way,\n   targeting http://192.168.3.21:8888, then restart its container via SSH.\n5. Wait 20 seconds after each restart, then verify fact sources and plugins\n   loaded correctly on both instances.\n6. Report a full summary: adversaries created, abilities verified, fact\n   sources loaded, plugins enabled on both instances, anything failed.\n```\n\nThat's it. Claude will handle the rest.\n\n## What Gets Configured\n\n| Item | Details |\n|---|---|\n| Adversaries | Silent Fog (APT29), Crimson Tide (Wizard Spider), Dark Pivot (APT10) |\n| Fact Sources | Lab target IPs and credentials seeded for all three operations |\n| Plugins | human + gameboard enabled on caldera-1 and caldera-2 |\n| Verification | Ability IDs, fact sources, and plugin status all checked |\n\n## Operations\n\n| Operation | Threat | Story |\n|---|---|---|\n| Silent Fog | APT29 — nation-state espionage | Low-and-slow spearphish → domain compromise → NTDS exfil |\n| Crimson Tide | Wizard Spider — ransomware | Stolen creds → 43-minute domain-wide encryption |\n| Dark Pivot | APT10 — supply chain | Build package → developer station → DNS exfil |\n\n## Repo Structure\n\n```\nCLAUDE.md               Auto-loaded by Claude Code — full lab context\nREADME.md               This file\nsetup/                  API payloads — run these against a fresh Caldera instance\ncaldera-okf/            Full knowledge bundle\n  operations/           Attack designs with kill chains and Caldera configs\n  video/                NotebookLM prompts for 3-minute customer-facing videos\n  api/                  Caldera REST API reference\n  concepts/             Core Caldera building blocks\n  lab/                  Host inventory and network topology\n  adversaries/          Threat actor profiles\n  plugins/              Enabled plugin documentation\n```\n",
  "bytes": 3356,
  "sha": "6f2572061c17d5b60c969e1564a9889e319266880cc7e2b36a13a05ea40734a7",
  "repo_slug": "bsookying/caldera-attack-sim",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/okf_bsookying_caldera_attack_sim_caldera_okf_43506cb1/readme"
}