Caldera

Caldera is an open-source adversary emulation platform. It is built on the MITRE ATT&CK framework and automates the execution of adversary behaviors to test and validate defensive controls. The platform includes a command-and-control server with a REST API and web interface, planners that decide the order in which abilities run, a default agent called Sandcat, and plugins that support autonomous operations, manual red-team exercises, and automated incident response. It originated at MITRE, where it remains an active research project, and is undergoing incubation at the Apache Software Foundation as Apache Caldera.

Run autonomous or operator-guided adversary emulation campaigns, validate EDR and SIEM coverage against ATT&CK techniques, and conduct purple-team exercises with repeatable scenarios.

• +ATT&CK-aligned atomic and adversary profiles for structured emulation.
• +Autonomous operation with a plugin architecture for custom workflows.
• +Open source, with documentation and a built-in capture-the-flag style training course.

• +Server deployment is limited to Linux and macOS.
• +Requires Python, Node.js, and Go toolchain for some features.
• +Custom adversary profiles and plugins require learning Caldera's ability, profile, and plugin structure.

Simulate known adversary techniques in a controlled manner to test detection logic, tune behavioral rules, and confirm that incident response playbooks trigger as expected.