From 867fae5f264a83f07c70d8cdcb623135352c8837 Mon Sep 17 00:00:00 2001
From: Samuel Hassine <samuel.hassine@filigran.io>
Date: Tue, 28 May 2024 21:49:25 +0100
Subject: [PATCH] Deployed 20d986d to 1.0.X with MkDocs 1.6.0 and mike
 2.2.0.dev0

---
 1.0.X/deployment/configuration/index.html |  14 +--
 1.0.X/search/search_index.json            |   2 +-
 1.0.X/sitemap.xml                         | 110 +++++++++++-----------
 1.0.X/sitemap.xml.gz                      | Bin 637 -> 637 bytes
 4 files changed, 63 insertions(+), 63 deletions(-)

diff --git a/1.0.X/deployment/configuration/index.html b/1.0.X/deployment/configuration/index.html
index aca4a96..a882437 100755
--- a/1.0.X/deployment/configuration/index.html
+++ b/1.0.X/deployment/configuration/index.html
@@ -3848,7 +3848,7 @@ <h5 id="smtp">SMTP</h5>
 <tr>
 <td style="text-align: left;">spring.mail.port</td>
 <td style="text-align: left;">SPRING_MAIL_PORT</td>
-<td style="text-align: left;">587</td>
+<td style="text-align: left;">465</td>
 <td style="text-align: left;">SMTP Server port</td>
 </tr>
 <tr>
@@ -3896,7 +3896,7 @@ <h5 id="smtp">SMTP</h5>
 <tr>
 <td style="text-align: left;">spring.mail.properties.mail.smtp.starttls.enable</td>
 <td style="text-align: left;">SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_ENABLE</td>
-<td style="text-align: left;"><code>true</code></td>
+<td style="text-align: left;"><code>false</code></td>
 <td style="text-align: left;">Turn on SMTP STARTTLS</td>
 </tr>
 </tbody>
@@ -4072,7 +4072,7 @@ <h4 id="ai-service">AI Service</h4>
     <span class="md-icon" title="Last update">
       <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1-2.1-2M12.5 7v5.2l4 2.4-1 1L11 13V7h1.5M11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2v1.8Z"/></svg>
     </span>
-    <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-timeago"><span class="timeago" datetime="2024-05-23T08:08:10+00:00" locale="en"></span></span><span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-iso_date">2024-05-23</span>
+    <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-timeago"><span class="timeago" datetime="2024-05-28T20:48:52+00:00" locale="en"></span></span><span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-iso_date">2024-05-28</span>
   </span>
 
     
@@ -4100,14 +4100,14 @@ <h4 id="ai-service">AI Service</h4>
     
     <nav>
       
-        <a href="https://github.com/guillaumejparis" class="md-author" title="@guillaumejparis">
+        <a href="https://github.com/SamuelHassine" class="md-author" title="@SamuelHassine">
           
-          <img src="https://avatars.githubusercontent.com/u/4204277?v=4&size=72" alt="guillaumejparis">
+          <img src="https://avatars.githubusercontent.com/u/1334279?v=4&size=72" alt="SamuelHassine">
         </a>
       
-        <a href="https://github.com/SamuelHassine" class="md-author" title="@SamuelHassine">
+        <a href="https://github.com/guillaumejparis" class="md-author" title="@guillaumejparis">
           
-          <img src="https://avatars.githubusercontent.com/u/1334279?v=4&size=72" alt="SamuelHassine">
+          <img src="https://avatars.githubusercontent.com/u/4204277?v=4&size=72" alt="guillaumejparis">
         </a>
       
         <a href="https://github.com/RomuDeuxfois" class="md-author" title="@RomuDeuxfois">
diff --git a/1.0.X/search/search_index.json b/1.0.X/search/search_index.json
index 72a27e3..08e7035 100755
--- a/1.0.X/search/search_index.json
+++ b/1.0.X/search/search_index.json
@@ -1 +1 @@
-{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"],"fields":{"title":{"boost":1000.0},"text":{"boost":1.0},"tags":{"boost":1000000.0}}},"docs":[{"location":"","title":"OpenBAS Documentation Space","text":"<p>Welcome to the OpenBAS Documentation space. Here you will be able to find all documents, meeting notes and presentations about the platform.</p> <p>Release notes</p> <p>Please, be sure to also take a look at the OpenBAS releases notes, they may contain important information about releases and deployments.</p>"},{"location":"#introduction","title":"Introduction","text":"<p>OpenBAS is an open source platform allowing organizations to plan, schedule and conduct crisis exercises as well as adversary and breach simulations. OpenBAS is an ISO 22398 compliant product and has been designed as a modern web application including a RESTFul API and an UX oriented frontend.</p>"},{"location":"#getting-started","title":"Getting started","text":"<ul> <li> <p> Deployment &amp; Setup</p> <p>Learn how to deploy and configure the platform as well as launch connectors to get the first data in OpenBAS.</p> <p> Deploy now</p> </li> <li> <p> User Guide</p> <p>Understand how to use the platform, create exercises and campaigns, use  media pressure simulation and integrate with other tools. </p> <p> Explore</p> </li> <li> <p> Administration</p> <p>Know how to administrate OpenBAS, create users and groups using RBAC / segregation, customize the overall experience.</p> <p> Customize</p> </li> </ul> <p>Need more help?</p> <p>We are doing our best to keep this documentation complete, accurate and up to date. </p> <p>If you still have questions or you find something which is not sufficiently explained, join the Filigran Community on Slack.</p>"},{"location":"#latest-blog-posts","title":"Latest blog posts","text":"<p>All tutorials are published directly on the Medium blog, this section provides a comprehensive list of the most important ones.</p> <ul> <li> <p>How we are disrupting tactical and strategical crisis management exercises with OpenBAS 3 <sub><sup>Oct 10, 2022</sup></sub></p> <p>It\u2019s been a while since we\u2019ve talked about OpenBAS and yet\u2026 In the trying times we live in, both in cyberspace and in real life, crisis preparedness has become...</p> <p> Read</p> </li> <li> <p>Plan, execute and conduct your crisis management exercises <sub><sup>Jan 25, 2021</sup></sub></p> <p>More than 3 years ago, we decided to build the OpenBAS application which allows organizations to facilitate the planning of crisis management...</p> <p> Read</p> </li> </ul>"},{"location":"#additional-resources","title":"Additional resources","text":"<p>Below, you will find external resources which may be useful along your OpenBAS journey.</p> <p> Training Courses Training courses for analysts and administrators in the Filigran training center.</p> <p></p>"},{"location":"administration/enterprise/","title":"Enterprise edition","text":"<p>Filigran</p> <p>Filigran is providing an Enterprise Edition of the platform, whether on-premise or in the SaaS.</p>"},{"location":"administration/enterprise/#what-is-openbas-ee","title":"What is OpenBAS EE?","text":"<p>OpenBAS Enterprise Edition is based on the open core concept. This means that the source code of OCTI EE remains open source and included in the main GitHub repository of the platform but is published under a specific license. As specified in the GitHub license file:</p> <ul> <li>The OpenBAS Community Edition is licensed under the Apache License, Version 2.0 (the \u201cApache License\u201d).</li> <li>The OpenBAS Enterprise Edition is licensed under the OpenBAS Enterprise Edition License (the \u201cEnterprise Edition Licensee\u201d).</li> </ul> <p>The source files in this repository have a header indicating which license they are under. If no such header is provided, this means that the file belongs to the Community Edition under the Apache License, Version 2.0.</p>"},{"location":"administration/enterprise/#ee-activation","title":"EE Activation","text":"<p>Enterprise edition is easy to activate. You need to go the platform settings and click on the Activate button.</p> <p></p> <p>Then you will need to agree to the Filigran EULA.</p> <p></p> <p>As a reminder:</p> <ul> <li>OpenBAS EE is free-to-use for development, testing and research purposes as well as for non-profit organizations.</li> <li>OpenBAS EE is included for all Filigran SaaS customers without additional fee.</li> <li>For all other usages, OpenBAS EE is reserved to organizations that have signed a Filigran Enterprise agreement.</li> </ul>"},{"location":"administration/enterprise/#available-features","title":"Available features","text":""},{"location":"administration/enterprise/#generative-ai","title":"Generative AI","text":"<p>Be able to use AI for content generation including emails, media pressure articles etc.</p>"},{"location":"administration/enterprise/#more-to-come","title":"More to come","text":"<p>More features will be available in OpenBAS in the future. Features like:</p> <ul> <li>Security posture automatic evalution.</li> <li>Premium mitigations and recommendation for configuration changes.</li> </ul>"},{"location":"administration/introduction/","title":"Introduction","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"administration/parameters/","title":"Parameters","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"administration/policies/","title":"Policies","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"administration/users/","title":"Users and RBAC","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"deployment/authentication/","title":"Authentication","text":""},{"location":"deployment/authentication/#introduction","title":"Introduction","text":"<p>Welcome to the authentication documentation for OpenBAS. This documentation provides details on setting up and utilizing the authentication system, which supports multiple authentication methods to cater to different user needs and security requirements.</p>"},{"location":"deployment/authentication/#supported-authentication-methods","title":"Supported authentication methods","text":""},{"location":"deployment/authentication/#local-users","title":"Local users","text":"<p>OpenBAS use this strategy as the default, but it's not the one we recommend for security reasons.</p> <ul> <li><code>OPENBAS.AUTH-LOCAL-ENABLE</code>: Set this to <code>true</code> to enable username/password authentication.</li> </ul> <p>Production deployment</p> <p>Please use the LDAP/Auth0/OpenID/SAML strategy for production deployment.</p>"},{"location":"deployment/authentication/#openid","title":"OpenID","text":"<p>This method allows to use the OpenID Connect Protocol to handle the authentication.</p> <ul> <li><code>OPENBAS.AUTH-OPENID-ENABLE</code>: Set this to <code>true</code> to enable OAuth (OpenID) authentication.</li> </ul> <p>Example for Auth0:</p> <pre><code>SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_{registrationId}_ISSUER-URI=https://auth.auth0.io\nSPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_{registrationId}_CLIENT-NAME=Login with auth0\nSPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_{registrationId}_CLIENT-ID=\nSPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_{registrationId}_CLIENT-SECRET=\nSPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_{registrationId}_REDIRECT-URI=${openbas.base-url}/login/oauth2/code/{registrationId}\nSPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_{registrationId}_SCOPE=openid,profile,email\n</code></pre> <p>Example for GitHub (or others pre-handled oauth2 providers):</p> <pre><code>SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_{registrationId}_CLIENT_NAME=Login with Github\nSPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_{registrationId}_CLIENT_ID=\nSPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_{registrationId}_CLIENT_SECRET=\n</code></pre> <p>Tips</p> <p>{registrationId} is an arbitrary identifier you choose.</p>"},{"location":"deployment/authentication/#saml2","title":"SAML2","text":"<p>This strategy can be used to authenticate your user with your company SAML.</p> <ul> <li><code>OPENBAS.AUTH-SAML2-ENABLE</code>: Set this to <code>true</code> to enable SAML2 authentication. </li> </ul> <p>Example for Microsoft : <pre><code>SPRING_SECURITY_SAML2_RELYINGPARTY_REGISTRATION_{registrationId}_ENTITY-ID=\nSPRING_SECURITY_SAML2_RELYINGPARTY_REGISTRATION_{registrationId}_ASSERTINGPARTY_METADATA-URI=\nOPENBAS_PROVIDER_{registrationId}_FIRSTNAME_ATTRIBUTE_KEY=\nOPENBAS_PROVIDER_{registrationId}_LASTNAME_ATTRIBUTE_KEY=\n</code></pre></p> <p>Tips</p> <p>{registrationId} is an arbitrary identifier you choose.   metadata-uri is the uri of the xml file given by your identity provider</p>"},{"location":"deployment/authentication/#single-sign-on-url","title":"Single Sign On URL","text":""},{"location":"deployment/authentication/#saml2_1","title":"SAML2","text":"<p>Url for the config of your sso provider <pre><code>${openbas.base-url}/login/saml2/sso/{registrationId}\n</code></pre></p>"},{"location":"deployment/authentication/#map-administrators-to-specific-roles-openid-and-saml-2","title":"Map administrators to specific roles (OpenID and SAML 2)","text":"<p>To grant administrative roles, you can utilize OAuth and SAML2 integration. If you opt for this approach, you'll need to include the following variables:</p> <pre><code>OPENBAS_PROVIDER_{registrationId}_ROLES_PATH=http://schemas.microsoft.com/ws/2008/06/identity/claims/role\nOPENBAS_PROVIDER_{registrationId}_ROLES_ADMIN=\n</code></pre> <p>However, if you intend to manage administrative roles within the OpenBAS platform itself, there's no need to provide these variables.</p>"},{"location":"deployment/authentication/#error-handling","title":"Error Handling","text":"<p>Under construction</p> <p>We are doing our best to complete this page.  If you want to participae, dont hesitate to join the Filigran Community on Slack  or submit your pull request on the Github doc repository.</p>"},{"location":"deployment/clustering/","title":"Clustering","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"deployment/collectors/","title":"Collectors","text":""},{"location":"deployment/collectors/#introduction","title":"Introduction","text":"<p>Collectors list</p> <p>You are looking for the available collectors? The list is in the OpenBAS Ecosystem.</p> <p>Collectors are one of the cornerstones of the OpenBAS platform, they are responsible for pulling data from various external services for two purposes:</p> <ul> <li>Collect all alerts, logs and traces related to attacks, incidents or crisis and match them to simulated injects to evaluate the security posture. </li> <li>Collect any data that may help to schedule breach and attack simulations such as list of assets, groups, identities, payloads, etc.</li> </ul>"},{"location":"deployment/collectors/#detection-siem-xdr-edr-ndr","title":"\ud83d\udee1\ufe0f Detection (SIEM, XDR, EDR, NDR)","text":"<p>Those collectors are the most import ones as they are used to evaluate the security posture (response to injects) from various detection and response systems and fulfill expectations for detection and prevention.</p>"},{"location":"deployment/collectors/#threat-intelligence","title":"\ud83e\uddec Threat Intelligence","text":"<p>Those collectors are used to collect threat intelligence data such as kill chains, scenarios, TTPs, payloads, etc.</p>"},{"location":"deployment/collectors/#endpoint-management","title":"\ud83d\udcfa Endpoint management","text":"<p>Those collectors are pulling alternative information about your endpoints and assets to complete the overview about your current posture in terms of vulnerabilities and compliance.</p>"},{"location":"deployment/collectors/#identities","title":"\ud83c\udfad Identities","text":"<p>Those collectors are pulling all information related to identities, including human assets, to be used in scenario or to complete the view overview about your current posture.</p>"},{"location":"deployment/collectors/#others","title":"\ud83d\udd2d Others","text":"<p>All other system OpenBAS can pull from, to add more meaningful and relevant information to the view of your security posture.</p>"},{"location":"deployment/collectors/#collectors-installation","title":"Collectors installation","text":""},{"location":"deployment/collectors/#built-in-collectors","title":"Built-in collectors","text":"<p>Some collectors such as Microsoft Sentinel are directly embedded into the application. To configure them, just add the proper configuration parameters in your platform configuration.</p>"},{"location":"deployment/collectors/#external-python-collectors","title":"External (Python) collectors","text":""},{"location":"deployment/collectors/#configuration","title":"Configuration","text":"<p>All external collectors have to be able to access the OpenBAS API. To allow this connection, they have 2 mandatory configuration parameters, the <code>OPENBAS_URL</code> and the <code>OPENBAS_TOKEN</code>. In addition to these 2 parameters, collectors have other mandatory parameters that need to be set in order to get them work.</p> <p>Collector tokens</p> <p>You can use your administrator token or create another administrator service account to put in your collectors. It is not necessary to have one dedicated user for each collector.</p> <p>Here is an example of a collector <code>docker-compose.yml</code> file: <pre><code>- OPENBAS_URL=http://localhost\n- OPENBAS_TOKEN=ChangeMe\n- COLLECTOR_ID=ChangeMe # Valid UUIDv4\n- \"COLLECTOR_NAME=MITRE ATT&amp;CK\"\n- COLLECTOR_LOG_LEVEL=error\n</code></pre></p> <p>Here is an example in a collector <code>config.yml</code> file:</p> <pre><code>openbas:\n  url: 'http://localhost:3001'\n  token: 'ChangeMe'\n\ncollector:\n  id: 'ChangeMe'\n  name: 'MITRE ATT&amp;CK'\n  log_level: 'info'\n</code></pre>"},{"location":"deployment/collectors/#docker-activation","title":"Docker activation","text":"<p>You can either directly run the Docker image of collectors or add them to your current <code>docker-compose.yml</code> file.</p>"},{"location":"deployment/collectors/#add-an-collector-to-your-deployment","title":"Add an collector to your deployment","text":"<p>For instance, to enable the MITRE ATT&amp;CK collector, you can add a new service to your <code>docker-compose.yml</code> file:</p> <pre><code>  collector-mitre-attack:\n    image: openbas/collector-mitre-attack:1.0.0\n    environment:\n      - OPENBAS_URL=http://localhost\n      - OPENBAS_TOKEN=ChangeMe\n      - COLLECTOR_ID=ChangeMe\n      - \"COLLECTOR_NAME=MITRE ATT&amp;CK\"\n      - COLLECTOR_LOG_LEVEL=error\n    restart: always\n</code></pre>"},{"location":"deployment/collectors/#launch-a-standalone-collector","title":"Launch a standalone collector","text":"<p>To launch standalone collector, you can use the <code>docker-compose.yml</code> file of the collector itself. Just download the latest release and start the collector:</p> <pre><code>$ wget https://github.com/OpenBAS-Platform/collectors/archive/{RELEASE_VERSION}.zip\n$ unzip {RELEASE_VERSION}.zip\n$ cd collectors-{RELEASE_VERSION}/mitre-attack/\n</code></pre> <p>Change the configuration in the <code>docker-compose.yml</code> according to the parameters of the platform and of the targeted service. Then launch the collector:</p> <pre><code>$ docker-compose up\n</code></pre>"},{"location":"deployment/collectors/#manual-activation","title":"Manual activation","text":"<p>If you want to manually launch collector, you just have to install Python 3 and pip3 for dependencies:</p> <pre><code>$ apt install python3 python3-pip\n</code></pre> <p>Download the release of the collectors:</p> <pre><code>$ wget &lt;https://github.com/OpenBAS-Platform/collectors/archive/{RELEASE_VERSION}.zip&gt;\n$ unzip {RELEASE_VERSION}.zip\n$ cd collectors-{RELEASE_VERSION}/mitre-attack/src/\n</code></pre> <p>Install dependencies and initialize the configuration:</p> <pre><code>$ pip3 install -r requirements.txt\n$ cp config.yml.sample config.yml\n</code></pre> <p>Change the <code>config.yml</code> content according to the parameters of the platform and of the targeted service and launch the collector:</p> <pre><code>$ python3 openbas_mitre.py\n</code></pre>"},{"location":"deployment/collectors/#collectors-status","title":"Collectors status","text":"<p>The collector status can be displayed in the dedicated section of the platform available in Integration &gt; collectors. You will be able to see the statistics of the RabbitMQ queue of the collector:</p> <p></p> <p>Problem</p> <p>If you encounter problems deploying OpenBAS or collectors, you can consult the troubleshooting page page.</p>"},{"location":"deployment/configuration/","title":"Configuration","text":"<p>The purpose of this section is to learn how to configure OpenBAS to have it tailored for your production and development needs. It is possible to check all default parameters implemented in the platform in the <code>application.properties</code> file.</p> <p>Here are the configuration keys, for both containers (environment variables) and manual deployment.</p> <p>Parameters equivalence</p> <p>The equivalent of a config variable in environment variables is the usage of an underscore (<code>_</code>) for a level of config.</p> <p>For example: <pre><code>spring.servlet.multipart.max-file-size=5GB\n</code></pre></p> <p>will become: <pre><code>SPRING_SERVLET_MULTIPART_MAX-FILE-SIZE=5GB\n</code></pre></p>"},{"location":"deployment/configuration/#platform","title":"Platform","text":""},{"location":"deployment/configuration/#api-frontend","title":"API &amp; Frontend","text":""},{"location":"deployment/configuration/#basic-parameters","title":"Basic parameters","text":"Parameter Environment variable Default value Description server.address SERVER_ADDRESS 0.0.0.0 Listen address of the application server.port SERVER_PORT 8080 Listen port of the application openbas.base-url OPENBAS_BASE-URL http://localhost:8080 Base URL of the application, will be used in some email links server.servlet.session.timeout SERVER_SERVLET_SESSION_TIMEOUT 60m Default duration of session (60 minutes) openbas.cookie-secure OPENBAS_COOKIE-SECURE <code>false</code> Turn on if the access is done in HTTPS openbas.cookie-duration OPENBAS_COOKIE-DURATION P1D Cookie duration (default 1 day) openbas.admin.email OPENBAS_ADMIN_EMAIL admin@openbas.io Default login email of the admin user openbas.admin.password OPENBAS_ADMIN_PASSWORD ChangeMe Default password of the admin user openbas.admin.token OPENBAS_ADMIN_TOKEN ChangeMe Default token (must be a valid UUIDv4)"},{"location":"deployment/configuration/#network-and-security","title":"Network and security","text":"Parameter Environment variable Default value Description server.ssl.enabled SERVER_SSL_ENABLED <code>false</code> Turn on to enable SSL on the local server server.ssl.key-store-type SERVER_SSL_KEY-STORE-TYPE PKCS12 Type of SSL keystore server.ssl.key-store SERVER_SSL_KEY-STORE classpath:localhost.p12 SSL keystore path server.ssl.key-store-password SERVER_SSL_KEY-STORE-PASSWORD admin SSL keystore password server.ssl.key-alias SERVER_SSL_KEY-ALIAS localhost SSL key alias"},{"location":"deployment/configuration/#logging","title":"Logging","text":"Parameter Environment variable Default value Description logging.level.root LOGGING_LEVEL_ROOT fatal Root log level logging.level.io.openbas LOGGING_LEVEL_IO_OPENBAS warn OpenBAS log level logging.file.name LOGGING_FILE_NAME ./logs/openbas.log Log file path (in addition to console output) logging.logback.rollingpolicy.max-file-size LOGGING_LOGBACK_ROLLINGPOLICY_MAX-FILE-SIZE 10MB Rolling max file size logging.logback.rollingpolicy.max-history LOGGING_LOGBACK_ROLLINGPOLICY_MAX-HISTORY 7 Rolling max days"},{"location":"deployment/configuration/#dependencies","title":"Dependencies","text":""},{"location":"deployment/configuration/#xtm-suite","title":"XTM Suite","text":"Parameter Environment variable Default value Description openbas.xtm.opencti.enable OPENBAS_XTM_OPENCTI_ENABLE false Enable integration with OpenCTI openbas.xtm.opencti.url OPENBAS_XTM_OPENCTI_URL OpenCTI URL openbas.xtm.opencti.token OPENBAS_XTM_OPENCTI_TOKEN OpenCTI token openbas.xtm.opencti.disable-display OPENBAS_XTM_OPENCTI_DISABLE-DISPLAY <code>false</code> Disable OpenCTI in the UI"},{"location":"deployment/configuration/#postgresql","title":"PostgreSQL","text":"Parameter Environment variable Default value Description spring.datasource.url SPRING_DATASOURCE_URL jdbc:postgresql://... URL of the database (ex jdbc:postgresql://postgresql.mydomain.com:5432/openbas) spring.datasource.username SPRING_DATASOURCE_USERNAME Login for the database spring.datasource.password SPRING_DATASOURCE_PASSWORD password Password for the database"},{"location":"deployment/configuration/#rabbitmq","title":"RabbitMQ","text":"Parameter Environment variable Default value Description openbas.rabbitmq.prefix OPENBAS_RABBITMQ_PREFIX openbas Prefix for the queue names openbas.rabbitmq.hostname OPENBAS_RABBITMQ_HOSTNAME localhost Hostname of the RabbitMQ server openbas.rabbitmq.vhost OPENBAS_RABBITMQ_VHOST / Vhost of the RabbitMQ server openbas.rabbitmq.port OPENBAS_RABBITMQ_PORT 5672 Port of the RabbitMQ Server openbas.rabbitmq.ssl OPENBAS_RABBITMQ_SSL <code>false</code> Use SSL openbas.rabbitmq.user OPENBAS_RABBITMQ_USER guest RabbitMQ user openbas.rabbitmq.pass OPENBAS_RABBITMQ_PASS guest RabbitMQ password openbas.rabbitmq.queue-type OPENBAS_RABBITMQ_QUEUE-TYPE classic RabbitMQ Queue Type (\"classic\" or \"quorum\")"},{"location":"deployment/configuration/#s3-bucket","title":"S3 bucket","text":"Parameter Environment variable Default value Description minio.endpoint MINIO_ENDPOINT localhost Hostname of the S3 Service. Example if you use AWS Bucket S3: s3.us-east-1.amazonaws.com (if <code>minio:bucket_region</code> value is us-east-1). This parameter value can be omitted if you use Minio as an S3 Bucket Service. minio.port MINIO_PORT 9000 Port of the S3 Service. For AWS Bucket S3 over HTTPS, this value can be changed (usually 443). minio.secure MINIO_SECURE <code>false</code> Indicates whether the S3 Service has TLS enabled. For AWS Bucket S3 over HTTPS, this value could be <code>true</code>. minio.access-key MINIO_ACCESS-KEY key Access key for the S3 Service. minio.access-secret MINIO_ACCESS-SECRET secret Secret key for the S3 Service. minio.bucket MINIO_BUCKET openbas S3 bucket name. Useful to change if you use AWS. minio.bucket-region MINIO_BUCKET-REGION us-east-1 Region of the S3 bucket if you are using AWS. This parameter value can be omitted if you use Minio as an S3 Bucket Service."},{"location":"deployment/configuration/#executors-neutral-agents","title":"Executors (neutral agents)","text":"<p>To be able to use the power of the OpenBAS platform on endpoints, you need at least one executor that will be in charge of spawing temporary processes (endpoint injectors) which will execute payloads.</p> <p>Supported executors</p> <p>We currently support only Caldera and Tanium but are actively working on our own agent as well as supporting more third-party.</p>"},{"location":"deployment/configuration/#caldera","title":"Caldera","text":"Parameter Environment variable Default value Description executor.caldera.enable EXECUTOR_CALDERA_ENABLE <code>true</code> Enable the Caldera executor executor.caldera.url EXECUTOR_CALDERA_URL Caldera URL executor.caldera.public-url EXECUTOR_CALDERA_PUBLIC-URL Caldera URL accessible from endpoints executor.caldera.api-key EXECUTOR_CALDERA_API-KEY Caldera API key"},{"location":"deployment/configuration/#tanium","title":"Tanium","text":"<p>Tanium Packages</p> <p>To use the Tanium executor, please install the OpenBAS packages on the Tanium platform and fill their IDs in the configuration below.</p> Parameter Environment variable Default value Description executor.tanium.enable EXECUTOR_TANIUM_ENABLE <code>false</code> Enable the Tanium executor executor.tanium.url EXECUTOR_TANIUM_URL Tanium URL executor.tanium.api-key EXECUTOR_TANIUM_API-KEY Tanium API key executor.tanium.computer-group-id EXECUTOR_TANIUM_COMPUTER_GROUP_ID Tanium Computer Group to be used in simulations executor.tanium.windows-package-id EXECUTOR_TANIUM_WINDOWS_PACKAGE_ID ID of the OpenBAS Tanium Windows package executor.tanium.unix-package-id EXECUTOR_TANIUM_UNIX_PACKAGE_ID ID of the OpenBAS Tanium Unix package"},{"location":"deployment/configuration/#mail-services","title":"Mail services","text":"<p>For the associated mailbox, for the moment the platform only relies on IMAP / SMTP protocols, we are actively developing integrations with APIs such as O365 and Google Apps.</p>"},{"location":"deployment/configuration/#smtp","title":"SMTP","text":"Parameter Environment variable Default value Description spring.mail.host SPRING_MAIL_HOST smtp.mail.com SMTP Server hostname spring.mail.port SPRING_MAIL_PORT 587 SMTP Server port spring.mail.username SPRING_MAIL_USERNAME username@mail.com SMTP Server username spring.mail.password SPRING_MAIL_PASSWORD password SMTP Server password Parameter Environment variable Default value Description spring.mail.properties.mail.smtp.ssl.enable SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_ENABLE <code>true</code> Turn on SMTP SSL mode spring.mail.properties.mail.smtp.ssl.trust SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_TRUST * Trust unverified certificates spring.mail.properties.mail.smtp.auth SPRING_MAIL_PROPERTIES_MAIL_SMTP_AUTH <code>true</code> Turn on SMTP authentication spring.mail.properties.mail.smtp.starttls.enable SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_ENABLE <code>true</code> Turn on SMTP STARTTLS"},{"location":"deployment/configuration/#imap","title":"IMAP","text":"Parameter Environment variable Default value Description openbas.mail.imap.enabled OPENBAS_MAIL_IMAP_ENABLED false Turn on to enable IMAP mail synchronization. Injector email must be well configured openbas.mail.imap.host OPENBAS_MAIL_IMAP_HOST imap.mail.com IMAP Server hostname openbas.mail.imap.port OPENBAS_MAIL_IMAP_PORT 993 IMAP Server port openbas.mail.imap.username OPENBAS_MAIL_IMAP_USERNAME username@mail.com IMAP Server username openbas.mail.imap.password OPENBAS_MAIL_IMAP_PASSWORD password IMAP Server password openbas.mail.imap.inbox OPENBAS_MAIL_IMAP_INBOX INBOX IMAP inbox directory to synchronize from openbas.mail.imap.sent OPENBAS_MAIL_IMAP_SENT Sent IMAP sent directory to synchronize from Parameter Environment variable Default value Description openbas.mail.imap.ssl.enable OPENBAS_MAIL_IMAP_SSL_ENABLE true Turn on IMAP SSL mode openbas.mail.imap.ssl.trust OPENBAS_MAIL_IMAP_SSL_TRUST * Trust unverified certificates openbas.mail.imap.auth OPENBAS_MAIL_IMAP_AUTH true Turn on IMAP authentication openbas.mail.imap.starttls.enable OPENBAS_MAIL_IMAP_STARTTLS_ENABLE true Turn on IMAP STARTTLS"},{"location":"deployment/configuration/#ai-service","title":"AI Service","text":"<p>AI deployment and cloud services</p> <p>There are several possibilities for Enterprise Edition customers to use OpenBAS AI endpoints:</p> <ul> <li>Use the Filigran AI Service leveraging our custom AI model using the token given by the support team.</li> <li>Use OpenAI or MistralAI cloud endpoints using your own tokens.</li> <li>Deploy or use local AI endpoints (Filigran can provide you with the custom model).</li> </ul> Parameter Environment variable Default value Description ai.enabled AI_ENABLED true Enable AI capabilities ai.type AI_TYPE mistralai AI type (<code>mistralai</code> or <code>openai</code>) ai.endpoint AI_ENDPOINT Endpoint URL (empty means default cloud service) ai.token AI_TOKEN Token for endpoint credentials ai.model AI_MODEL Model to be used for text generation (depending on type) ai.model_images AI_MODEL_IMAGES Model to be used for image generation (depending on type)"},{"location":"deployment/injectors/","title":"Injectors","text":""},{"location":"deployment/injectors/#introduction","title":"Introduction","text":"<p>Injectors list</p> <p>You are looking for the available injectors? The list is in the OpenBAS Ecosystem.</p> <p>Injectors are one of the cornerstones of the OpenBAS platform, they are responsible for pushing simulation actions to third party systems. According to their functionality and use case, they are categorized in the following classes.</p> <p></p>"},{"location":"deployment/injectors/#endpoint-payloads-execution","title":"\ud83d\udce1 Endpoint payloads execution","text":"<p>Those injectors are special as they required an executor (neutral agent) to be launched on endpoints. When they register to the platform, they inform available executors on how to spawn them on the 3 currently supported platforms: Windows, Linux and MacOS.</p>"},{"location":"deployment/injectors/#communication-social-medias","title":"\ud83c\udf10 Communication &amp; social medias","text":"<p>Those injectors are used to push information to human assets (aka players) such as emails, SMS, phone calls, instant messaging etc.</p>"},{"location":"deployment/injectors/#incident-response-case-management","title":"\ud83e\uddef Incident Response &amp; Case Management","text":"<p>Those injectors are used to inject real or fake information into case management, ticketing and incident response systems.</p>"},{"location":"deployment/injectors/#others","title":"\ud83d\udc89 Others","text":"<p>All other system OpenBAS can inject, as part of breach and attack simulation campaigns. </p>"},{"location":"deployment/injectors/#injectors-installation","title":"Injectors installation","text":""},{"location":"deployment/injectors/#built-in-injectors","title":"Built-in injectors","text":"<p>Some injectors such as email, SMS, media pressure, etc. are directly embedded into the application. To configure them, just add the proper configuration parameters in your platform configuration. </p>"},{"location":"deployment/injectors/#external-python-injectors","title":"External (Python) injectors","text":""},{"location":"deployment/injectors/#configuration","title":"Configuration","text":"<p>All external injectors have to be able to access the OpenBAS API. To allow this connection, they have 2 mandatory configuration parameters, the <code>OPENBAS_URL</code> and the <code>OPENBAS_TOKEN</code>. In addition to these 2 parameters, injectors have other mandatory parameters that need to be set in order to get them work.</p> <p>Injector tokens</p> <p>You can use your administrator token or create another administrator service account to put in your injectors. It is not necessary to have one dedicated user for each injector.</p> <p>Here is an example of a injector <code>docker-compose.yml</code> file: <pre><code>- OPENBAS_URL=http://localhost\n- OPENBAS_TOKEN=ChangeMe\n- INJECTOR_ID=ChangeMe # Valid UUIDv4\n- \"INJECTOR_NAME=HTTP query\"\n- INJECTOR_LOG_LEVEL=error\n</code></pre></p> <p>Here is an example in a injector <code>config.yml</code> file:</p> <pre><code>openbas:\n  url: 'http://localhost:3001'\n  token: 'ChangeMe'\n\ninjector:\n  id: 'ChangeMe'\n  name: 'HTTP query'\n  log_level: 'info'\n</code></pre>"},{"location":"deployment/injectors/#networking","title":"Networking","text":"<p>Be aware that all injectors are reaching RabbitMQ based the RabbitMQ configuration provided by the OpenBAS platform. The injector must be able to reach RabbitMQ on the specified hostname and port. If you have a specific Docker network configuration, please be sure to adapt your <code>docker-compose.yml</code> file in such way that the injector container gets attached to the OpenBAS Network, e.g.:</p> <pre><code>networks:\n  default:\n    external: true\n    name: openbas-docker_default\n</code></pre>"},{"location":"deployment/injectors/#docker-activation","title":"Docker activation","text":"<p>You can either directly run the Docker image of injectors or add them to your current <code>docker-compose.yml</code> file.</p>"},{"location":"deployment/injectors/#add-an-injector-to-your-deployment","title":"Add an injector to your deployment","text":"<p>For instance, to enable the HTTP query injector, you can add a new service to your <code>docker-compose.yml</code> file:</p> <pre><code>  injector-http-query:\n    image: openbas/injector-http-query:latest\n    environment:\n      - OPENBAS_URL=http://localhost\n      - OPENBAS_TOKEN=ChangeMe\n      - INJECTOR_ID=ChangeMe\n      - \"INJECTOR_NAME=HTTP query\"\n      - INJECTOR_LOG_LEVEL=error\n    restart: always\n</code></pre>"},{"location":"deployment/injectors/#launch-a-standalone-injector","title":"Launch a standalone injector","text":"<p>To launch standalone injector, you can use the <code>docker-compose.yml</code> file of the injector itself. Just download the latest release and start the injector:</p> <pre><code>$ wget https://github.com/OpenBAS-Platform/injectors/archive/{RELEASE_VERSION}.zip\n$ unzip {RELEASE_VERSION}.zip\n$ cd injectors-{RELEASE_VERSION}/http-query/\n</code></pre> <p>Change the configuration in the <code>docker-compose.yml</code> according to the parameters of the platform and of the targeted service. Then launch the injector:</p> <pre><code>$ docker-compose up\n</code></pre>"},{"location":"deployment/injectors/#manual-activation","title":"Manual activation","text":"<p>If you want to manually launch injector, you just have to install Python 3 and pip3 for dependencies:</p> <pre><code>$ apt install python3 python3-pip\n</code></pre> <p>Download the release of the injectors:</p> <pre><code>$ wget &lt;https://github.com/OpenBAS-Platform/injectors/archive/{RELEASE_VERSION}.zip&gt;\n$ unzip {RELEASE_VERSION}.zip\n$ cd injectors-{RELEASE_VERSION}/http-query/src/\n</code></pre> <p>Install dependencies and initialize the configuration:</p> <pre><code>$ pip3 install -r requirements.txt\n$ cp config.yml.sample config.yml\n</code></pre> <p>Change the <code>config.yml</code> content according to the parameters of the platform and of the targeted service and launch the injector:</p> <pre><code>$ python3 openbas_http.py\n</code></pre>"},{"location":"deployment/injectors/#injectors-status","title":"Injectors status","text":"<p>The injector status can be displayed in the dedicated section of the platform available in Integration &gt; injectors. You will be able to see the statistics of the RabbitMQ queue of the injector:</p> <p></p> <p>Problem</p> <p>If you encounter problems deploying OpenBAS or injectors, you can consult the troubleshooting page page.</p>"},{"location":"deployment/installation/","title":"Installation","text":"<p>All components of OpenBAS are shipped both as Docker images and manual installation packages.</p> <p>Production deployment</p> <p>For production deployment, we recommend to deploy all components in containers, including dependencies, using native cloud services or orchestration systems such as Kubernetes.</p> <ul> <li> <p> Use Docker</p> <p>Deploy OpenBAS using Docker and the default <code>docker-compose.yml</code> provided in the docker.</p> <p> Setup</p> </li> <li> <p> Manual installation</p> <p>Deploy dependencies and launch the platform manually using the packages released in the GitHub releases.</p> <p> Explore</p> </li> </ul>"},{"location":"deployment/installation/#using-docker","title":"Using Docker","text":""},{"location":"deployment/installation/#introduction","title":"Introduction","text":"<p>OpenBAS can be deployed using the docker-compose command.</p>"},{"location":"deployment/installation/#pre-requisites","title":"Pre-requisites","text":"<p> Linux</p> <pre><code>sudo apt install docker-compose\n</code></pre> <p> Windows and MacOS</p> <p>Just download the appropriate Docker for Desktop version for your operating system.</p>"},{"location":"deployment/installation/#clone-the-repository","title":"Clone the repository","text":"<p>Docker helpers are available in the Docker GitHub repository.</p> <pre><code>mkdir -p /path/to/your/app &amp;&amp; cd /path/to/your/app\ngit clone https://github.com/OpenBAS-Platform/docker.git\ncd docker\n</code></pre>"},{"location":"deployment/installation/#configure-the-environment","title":"Configure the environment","text":"<p>Before running the <code>docker-compose</code> command, the <code>caldera.yml</code> and <code>docker-compose.yml</code> file should be configured. By default, the <code>docker-compose.yml</code> file is using environment variables available in the file <code>.env.sample</code>.</p> <p>You can either rename the file <code>.env.sample</code> in <code>.env</code> and put the expected values or just fill directly the <code>docker-compose.yml</code> with the values corresponding to your environment.</p>"},{"location":"deployment/installation/#caldera","title":"Caldera","text":"<p>Unfortunately, Caldera does not support well environment variables, we have packaged it but the <code>caldera.yml</code> needs to be modified to change default API keys and passwords. Only change what is marked as Change this, listed below:</p> <p>Caldera application</p> <p>You will never be asked to go into Caldera directly because OpenBAS manages everything for you, so don't hesitate to put the same UUIDv4 in all parameters here.</p> <pre><code>users:\n  red:\n    red: ChangeMe                                                                     # Change this\n  blue:\n    blue: ChangeMe                                                                    # Change this\napi_key_red: ChangeMe                                                                 # Change this\napi_key_blue: ChangeMe                                                                # Change this\napi_key: ChangeMe                                                                     # Change this\ncrypt_salt: ChangeMe                                                                  # Change this\nencryption_key: ChangeMe                                                              # Change this\napp.contact.http: http://caldera.myopenbas.myorganization.com:8888                    # Change this\napp.contact.tunnel.ssh.user_password: ChangeMe                                        # Change this\n</code></pre>"},{"location":"deployment/installation/#docker-compose-env","title":"Docker compose env","text":"<p>Configuration static parameters</p> <p>The complete list of available static parameters is available in the configuration section.</p> <p>Whether you are using one method or the other, here are the mandatory parameters to fill:</p> <pre><code>POSTGRES_USER=ChangeMe\nPOSTGRES_PASSWORD=ChangeMe\nKEYSTORE_PASSWORD=ChangeMe\nMINIO_ROOT_USER=ChangeMeAccess\nMINIO_ROOT_PASSWORD=ChangeMeKey\nRABBITMQ_DEFAULT_USER=ChangeMe\nRABBITMQ_DEFAULT_PASS=ChangeMe\nSPRING_MAIL_HOST=smtp.changeme.com\nSPRING_MAIL_PORT=465\nSPRING_MAIL_USERNAME=ChangeMe@domain.com\nSPRING_MAIL_PASSWORD=ChangeMe\nOPENBAS_MAIL_IMAP_HOST=imap.changeme.com\nOPENBAS_MAIL_IMAP_PORT=993\nOPENBAS_ADMIN_EMAIL=ChangeMe\nOPENBAS_ADMIN_PASSWORD=ChangeMe\nOPENBAS_ADMIN_TOKEN=ChangeMe\nCALDERA_PUBLIC_URL=http://localhost:8888 # Change me for production deployment to something accessible from your endpoint(s)\nCALDERA_API_KEY=ChangeMe\nCOLLECTOR_MITRE_ATTACK_ID=3050d2a3-291d-44eb-8038-b4e7dd107436 # No need for change\n</code></pre> <p>Caldera public URL</p> <p>For production deployment, the Caldera public URL needs to be accessible from the machines where you would like to play breach and attack simulations scenarios.</p> <p>If your <code>docker-compose</code> deployment does not support <code>.env</code> files, just export all environment variables before launching the platform:</p> <pre><code>export $(cat .env | grep -v \"#\" | xargs)\n</code></pre>"},{"location":"deployment/installation/#persist-data","title":"Persist data","text":"<p>The default for OpenBAS data is to be persistent.</p> <p>In the <code>docker-compose.yml</code>, you will find at the end the list of necessary persistent volumes for the dependencies:</p> <pre><code>volumes:\n  esdata:     # ElasticSearch data\n  s3data:     # S3 bucket data\n  amqpdata:   # RabbitMQ data\n</code></pre>"},{"location":"deployment/installation/#run-openbas","title":"Run OpenBAS","text":""},{"location":"deployment/installation/#using-single-node-docker","title":"Using single node Docker","text":"<p>After changing your <code>.env</code> file run <code>docker-compose</code> in detached (-d) mode:</p> <pre><code>sudo systemctl start docker.service\n# Run docker-compose in detached \ndocker-compose up -d\n</code></pre>"},{"location":"deployment/installation/#using-docker-swarm","title":"Using Docker swarm","text":"<p>In order to have the best experience with Docker, we recommend using the Docker stack feature. In this mode you will have the capacity to easily scale your deployment.</p> <pre><code># If your virtual machine is not a part of a Swarm cluster, please use:\ndocker swarm init\n</code></pre> <p>Put your environment variables in <code>/etc/environment</code>:</p> <pre><code># If you already exported your variables to .env from above:\nsudo cat .env &gt;&gt; /etc/environment\nsudo bash -c 'cat .env &gt;&gt; /etc/environment\u2019\nsudo docker stack deploy --compose-file docker-compose.yml openbas\n</code></pre> <p>Installation done</p> <p>You can now go to http://localhost:8080 and log in with the credentials filled in your configuration.</p>"},{"location":"deployment/installation/#manual-installation","title":"Manual installation","text":""},{"location":"deployment/installation/#prepare-the-installation","title":"Prepare the installation","text":""},{"location":"deployment/installation/#installation-of-dependencies","title":"Installation of dependencies","text":"<p>You have to install all the needed dependencies for the main application including Caldera if you would like to play breach and attack simulation scenarios. The example below if for Ubuntu:</p> <pre><code>sudo apt install openjdk-22-jre \n</code></pre>"},{"location":"deployment/installation/#download-the-application-files","title":"Download the application files","text":"<p>First, you have to download and extract the latest release file.</p> <pre><code>mkdir /path/to/your/app &amp;&amp; cd /path/to/your/app\nwget &lt;https://github.com/OpenBAS-Platform/openbas/releases/download/{RELEASE_VERSION}/openbas-release-{RELEASE_VERSION}.tar.gz&gt;\ntar xvfz openbas-release-{RELEASE_VERSION}.tar.gz\n</code></pre>"},{"location":"deployment/installation/#install-the-main-platform","title":"Install the main platform","text":""},{"location":"deployment/installation/#configure-the-application","title":"Configure the application","text":"<p>The main application has just one environment configuration file to change.</p> <pre><code>cd openbas\n</code></pre> <p>Change the application.properties file according to your configuration of PostgreSQL, RabbitMQ, Minio and Caldera admin account and to your platform.</p>"},{"location":"deployment/installation/#start-the-application","title":"Start the application","text":"<p>Start the Application:</p> <pre><code>java -jar openbas-api.jar\n</code></pre> <p>Installation done</p> <p>You can now go to http://localhost:8080 and log in with the credentials configured in your <code>application.properties</code> file.</p>"},{"location":"deployment/installation/#deploy-behind-a-reverse-proxy","title":"Deploy behind a reverse proxy","text":"<p>If you want to use OpenBAS behind a reverse proxy with a context path, like <code>https://domain.com/openbas</code>, please change the <code>base_path</code> static parameter.</p> <ul> <li><code>APP__BASE_PATH=/openbas</code></li> </ul> <p>By default OpenBAS use websockets so don't forget to configure your proxy for this usage, an example with <code>Nginx</code>:</p> <pre><code>location / {\n    proxy_cache                 off;\n    proxy_buffering             off;\n    proxy_http_version          1.1;\n    proxy_set_header Upgrade    $http_upgrade;\n    proxy_set_header Connection \"upgrade\";\n    proxy_set_header Host       $host;\n    chunked_transfer_encoding   off;\n    proxy_pass                  http://YOUR_UPSTREAM_BACKEND;\n  }\n</code></pre>"},{"location":"deployment/installation/#additional-memory-information","title":"Additional memory information","text":"<p>OpenBAS platform is based on a JAVA runtime. The application needs at least 4GB of RAM to work properly.</p>"},{"location":"deployment/installation/#postgresql","title":"PostgreSQL","text":"<p>PostgreSQL is the main database of OpenBAS. You can find more information in the official PostgresQL documentation.</p>"},{"location":"deployment/installation/#minio","title":"MinIO","text":"<p>MinIO is a small process and does not require a high amount of memory. More information are available for Linux here on the Kernel tuning guide.</p>"},{"location":"deployment/integrations/","title":"Integrations","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"deployment/overview/","title":"Overview","text":"<p>Before starting the installation, let's discover how OpenBAS is working, which dependencies are needed and what are the minimal requirements to deploy it in production.</p>"},{"location":"deployment/overview/#architecture","title":"Architecture","text":"<p>The OpenBAS platform relies on several external databases and services in order to work.</p> <p></p>"},{"location":"deployment/overview/#platform","title":"Platform","text":"<p>The platform is the central part of the OpenBAS platform, allowing users to configure scenarios, simulations, atomic testings and all other components used in the context of breach and attack simulations and security validations.</p>"},{"location":"deployment/overview/#neutral-agents-executors","title":"Neutral agents / executors","text":"<p>Executors are embedded into the platform but you should configure at least one. It is the system that will be used to execute local injectors on endpoints. Currently we support Caldera (default) and Tanium but multiple will be added in the near future including a home-made XTM agent (by Filigran). </p> <p>Required executor</p> <p>Executors are responsible of executing endpoint payload injectors. To use them, you have to have at least one executor / neutral agent enabled. Injectors that require executors are marked in red in the OpenBAS Ecosystem. </p>"},{"location":"deployment/overview/#injectors","title":"Injectors","text":"<p>Injects are used to interact with third-party applications or services (including execution on the endpoints through executors) in the context of a simulation or an atomic testing. A few injectors are built-in but most of them are standalone Python processes. </p> <p>List of injectors</p> <p>You can find all currently available injectors in the OpenBAS Ecosystem.</p>"},{"location":"deployment/overview/#collectors","title":"Collectors","text":"<p>Collectors are used to connect to all security systems such as SIEMs, XDRs, EDRs, firewalls, mail gateways etc. to check if an inject (execution, emails, etc.) has been detected or prevented and fill the security posture. </p> <p>List of collectors</p> <p>You can find all currently available collectors in the OpenBAS Ecosystem.</p>"},{"location":"deployment/overview/#infrastructure-requirements","title":"Infrastructure requirements","text":""},{"location":"deployment/overview/#dependencies","title":"Dependencies","text":"Component Version CPU RAM Disk type Disk space PostgreSQL \u2265 16.0 2 cores \u2265 8GB SSD \u2265 16GB RabbitMQ &gt;= 3.11 1 core \u2265 512MB Standard \u2265 2GB S3 / MinIO \u2265 RELEASE.2023-02 1 core \u2265 128MB SSD \u2265 16GB"},{"location":"deployment/overview/#platform_1","title":"Platform","text":"Component CPU RAM Disk type Disk space OpenBAS Core 2 cores \u2265 8GB None (stateless) - Injector(s) 1 core \u2265 128MB None (stateless) - Collector(s) 1 core \u2265 128MB None (stateless) -"},{"location":"deployment/resources/","title":"Resources","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"deployment/troubleshooting/","title":"Troubleshooting","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"deployment/upgrade/","title":"Upgrade","text":"<p>Depending on your installation mode, upgrade path may change.</p> <p>Migrations</p> <p>The platform is taking care of all necessary underlying migrations in the databases if any, you can upgrade OpenBAS from any version to the latest one, including skipping multiple major releases.</p>"},{"location":"deployment/upgrade/#using-docker","title":"Using Docker","text":"<p>Before applying this procedure, please update your <code>docker-compose.yml</code> file with the new version number of container images.</p>"},{"location":"deployment/upgrade/#for-single-node-docker","title":"For single node Docker","text":"<pre><code>$ sudo docker-compose stop\n$ sudo docker-compose pull\n$ sudo docker-compose up -d\n</code></pre>"},{"location":"deployment/upgrade/#for-docker-swarm","title":"For Docker swarm","text":"<p>For each of services, you have to run the following command:</p> <pre><code>$ sudo docker service update --force service_name\n</code></pre>"},{"location":"deployment/upgrade/#manual-installation","title":"Manual installation","text":"<p>When upgrading the platform, you have to replace all files and restart the platform, the database migrations will be done automatically:</p> <pre><code>$ java -jar openbas-api.jar\n</code></pre>"},{"location":"development/api-usage/","title":"REST API","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"development/environment_ubuntu/","title":"Prerequisites Ubuntu","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"development/environment_windows/","title":"Prerequisites Windows","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"development/injectors/","title":"Injector development","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"development/platform/","title":"Platform development","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/assets/","title":"Assets","text":"<p>The Assets section provides users with a centralized hub for managing and organizing the entities targeted for testing and simulation. </p> <p>When you click on \u201cAssets\u201d in the left-hand banner, you see all the \u201cAssets\u201d pages. When accessing the Assets section, users are directed by default to the Endpoints page, where they can start managing their assets.</p> <p>From the <code>Assets</code> section, users can access the following pages:</p> <ul> <li><code>Endpoints</code>: Individual entities, representing any object or terminal that can be connected to a network.</li> <li><code>Asset groups</code>: Group of asset allowing you to organize endpoints into logical groups based on various filters applied by the user.</li> </ul>"},{"location":"usage/assets/#endpoints","title":"Endpoints","text":"<p>Endpoints encompass devices and systems that connect to a network, serving as the foundation for interaction with OpenBAS. </p> <p>The list of endpoints continues to grow with the changing landscape of networked technologies and the increasing interconnectivity of digital ecosystems. Below is a non-exhaustive list of terminal categories:</p> <ul> <li>Computers: This category encompasses a wide range of computing devices, including desktops, laptops, and servers deployed within organizational networks.</li> <li>Mobile devices: Smartphones and tablets represent another prominent category of endpoints, providing users with mobile access to network resources and services.</li> <li>Workstations: Workstations refer to terminals or dedicated machines utilized by individuals or groups to perform specific tasks or access networked resources. These systems are typically tailored to meet specific operational requirements and may include specialized software or configurations.</li> <li>IoT devices: The Internet of Things (IoT) encompasses a diverse array of interconnected devices and sensors. IoT endpoints include smart thermostats, cameras, environmental sensors, smart watches, and health tracking devices, among others.</li> </ul> <p>When accessing the Endpoints pages, you see the list of all endpoints imported in your platform. Here, users can create and manage details specific to each endpoint.</p> <p>Assets can be imported with the help of specific Collectors, like Microsoft Entra.</p> <p></p>"},{"location":"usage/assets/#asset-groups","title":"Asset groups","text":"<p>Asset groups serve as a mechanism for organizing and grouping related Endpoints. These groups are constructed based on filters that define the criteria for inclusion, allowing administrators to segment and categorize Endpoints based on common characteristics or attributes.</p> <p>When creating a new asset group, administrators have the flexibility to specify the filters that will delineate the group's membership. Currently, the platform offers a range of filters such as platform type, hostname, and IP addresses. We plan to extend the possibilities by including additional filters in future updates.</p> <p></p>"},{"location":"usage/atomic/","title":"Atomic testing","text":"<p>Under construction</p> <p>We are doing our best to complete this page.  If you want to participae, dont hesitate to join the Filigran Community on Slack  or submit your pull request on the Github doc repository.</p> <p>When clicking on Atomic testing in the left menu, you access to the list of all atomic testings ever launched in the platform.</p> <p>Atomic testing is a great way to simulate a singular attack technique you are particulary interested in, and test immediately your capability to prevent and detect it.</p> <p>You can search for a specific one by name.</p> <p>The presented list allows you to easily see global scores of all your recent atomic testings.</p> <p></p>"},{"location":"usage/atomic/#create-an-atomic-testing","title":"Create an Atomic testing","text":"<p>An atomic testing is essentially the simulation of a single inject, against a selection of targets (Players, Teams, Assets, Assets Group) with assorted expectations.</p> <p>By clicking on the + button at the bottom right of the screen, you enter the atomic testing creation workflow.</p> <p>On the left of the creation screen is the list of all available Inject you can play for atomic testing. Logos on the left of each line indicates which Injector is associated with each inject.</p> <p>Depending on your integrations, this list can be long. You can filter the list by compatible platforms or by Mitre Att&amp;ck tactics.By clicking on the \"Att&amp;CK\" logo near the search bar, you can also filter by selecting a precise Mitre Att&amp;ck techniques.</p> <p>When selecting an inject on the left, the form on the right populates itself with a by-default title and propose you to define when the inject should be played after the launch of the atomic testing. You can keep it to 0.</p> <p>By clicking on Inject content, you can define now or later the targeted assets or players, needed configurations, and the assorted expectations.</p> <p>The \"available variables\" button helps you to use already defined variables into compatible fields.</p>"},{"location":"usage/atomic/#atomic-testing-screens","title":"Atomic testing screens","text":"<p>Details of an Atomic testing is composed of three parts: - a header allowing to launch the test, see its state and update/delete it. - an Overview screen to eaily see the results of the test. - an execution details screen to see expectations of the test and investigate on execution logs</p>"},{"location":"usage/atomic/#overview","title":"Overview","text":"<p>The first screen displayed when you click on a specific Atomic testing from the list is a breakdown of your security posture against this test. </p> <p>As for Simulation and Scenario, Results are broken down into: - Prevention: the ability of your security posture to prevent the inject - Detection: the ability of your security posture to detect the inject - Human response: the ability of your security teams to react as intented facing the inject</p> <p>Big metrics on top of the screen sum up the expectations' result of all targets. </p> <p>The list of targets on the left allows you to easily see the result per Target, and for example investigate further why a specific Asset have failed the test.</p> <p>For a selected target, you can on the right the timeline of the test against the target and the assorted results. The result logs are also displayed.</p> <p></p>"},{"location":"usage/atomic/#execution-details","title":"Execution details","text":"<p>On this screen, you can retrieve details about the atomic testing and its expectations.</p> <p>You can also see the raw execution logs of the Injector responsible for the test execution.</p> <p></p>"},{"location":"usage/challenges/","title":"Challenges","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/channels/","title":"Channels","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p> <p>In OpenBAS, Channels represent communication medias with a particular look. There are used to present web articles or other media contents to Players in a specific way.</p> <p>It helps give shape to your Scenario context and events.</p>"},{"location":"usage/channels/#create-a-channel","title":"Create a Channel","text":"<p>First step is to click on the + button at the bottom right and give your new Channel a type (Newspaper, Microblogging, TV Channel), a name and a subtitle.</p> <p>Once done, click on the Channel in the list to access its overview. Here you can define how media content associated to this Chennel will be displayed to Players.</p> <p>You can define primary and secondary colors, choose logos and define how the header is presented.</p> <p>On the right, a mock up of the overview is displayed to give you the look and fill of it.</p> <p></p>"},{"location":"usage/channels/#use-a-channel","title":"Use a Channel","text":"<p>A Channel will then be used in Scenario and in Simulation definition. When you create an Article, you have to choose the Channel that will give it an adequate shape.</p> <p>See Media pressure page to know how to create and add Articles to your Scenarios.</p> <p></p>"},{"location":"usage/collector-caldera/","title":"Caldera collector","text":"<p>The integration between an OpenBAS instance and a Caldera instance allows you to enrich assets data.</p>"},{"location":"usage/collector-caldera/#configuration-variables","title":"Configuration variables","text":"<p>Below are the properties you'll need to set for OpenBAS:</p> Property application.properties Docker environment variable Mandatory Description Enable Caldera collector collector.caldera.enable <code>COLLECTOR.CALDERA.ENABLE</code> Yes Enable the Caldera collector. Collector ID collector.caldera.id <code>COLLECTOR.CALDERA.ID</code> Yes The ID of the collector. Caldera URL collector.caldera.url <code>COLLECTOR.CALDERA.URL</code> Yes The URL of the Caldera instance. Caldera API Key collector.caldera.api-key <code>COLLECTOR.CALDERA.API-KEY</code> Yes The API Key for the rest API of the Caldera instance. Caldera polling interval collector.caldera.interval <code>COLLECTOR.CALDERA.INTERVAL</code> No The time interval in seconds where the collect is triggered. Default is 60 seconds."},{"location":"usage/collector-caldera/#behavior","title":"Behavior","text":"<p>Each interval, a job retrieves the deployed agents on Caldera and populates the OpenBAS database by creating Assets.</p> <p>Deduplication is done thanks to the caldera <code>paw</code> property :</p> <ul> <li>if there is no asset on OpenBAS based on this <code>paw</code>, a new asset is created</li> <li>if there is an asset on OpenBAS based on this <code>paw</code> and the source of creation is only Caldera, this asset is updated</li> </ul> <p>There is no automatic deletion of OpenBAS assets if Caldera agents no longer exist.</p>"},{"location":"usage/collector-caldera/#mapping","title":"Mapping","text":"Agent Property Asset Property paw externalId paw name host_ip_addrs ips platform platform last_seen lastSeen"},{"location":"usage/collectors/","title":"Collectors","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/components/","title":"Components","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/documents/","title":"Documents","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/expectations/","title":"Expectations","text":"<p>Expectations define what is expected from an Asset (endpoint) or a Players when facing an Inject in terms of security posture. Each expectation has a score representing how well it has been met by the target.</p>"},{"location":"usage/expectations/#expectation-types","title":"Expectation types","text":"<p>Expectations can be categorized as either Manual or Automatic, depending on how they are validated.</p>"},{"location":"usage/expectations/#manual-expectations","title":"Manual expectations","text":"<p>Manual expectations require manual validation by the animation team, with the validation process and scoring managed manually. They are simple, customizable expectations to be manually validated.</p>"},{"location":"usage/expectations/#automatic-expectations","title":"Automatic expectations","text":"<p>Automatic expectations are validated automatically under specific conditions. Currently available automatic expectations include:</p> <ul> <li><code>Automatic - Prevention: Triggered when inject is processed</code>: automatically validated by security integration with compatible Collectors if the inject's action generates a prevention alert, such as quarantine.</li> <li><code>Automatic - Detection: Triggered when inject is processed</code>: automatically validated by security integration with compatible Collectors if the inject's action generates a detection alert, such as an incident.</li> <li><code>Automatic - Triggered when team reads articles</code>: Automatically validated when the article of a Media pressure inject has been read by targets.</li> </ul> <p>For injects targeting asset groups, some expectations can be validated in two modes:</p> <ul> <li>All assets (per group) must validate the expectation.</li> <li>At least one asset (per group) must validate the expectation.</li> </ul> <p>Special case: Publish Challenges inject </p> <p>The \"Publish Challenges\" inject doesn't require an expectation, as results are computed directly from Challenges' scores.</p>"},{"location":"usage/expectations/#expectation-manipulation","title":"Expectation manipulation","text":""},{"location":"usage/expectations/#add-an-expectation-to-an-inject","title":"Add an expectation to an inject","text":"<p>To add expectations to an inject, navigate to the inject's content and click on \"Add expectations\". From there, select the type of expectation you want to add and set a score for it.</p> <p>You can add multiple expectations to a single inject.</p>"},{"location":"usage/expectations/#validate-a-manual-expectation","title":"Validate a manual expectation","text":"<p>If you have configured manual expectations in your scenario, you will have the opportunity to handle manual validations during each simulation. During a Simulation, navigate to the Animation tab, under the Validation screen. Here, you'll find a list of expectations that require manual validation.</p>"},{"location":"usage/exports/","title":"Exports","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/getting-started/","title":"Getting started","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p> <p>This guide aims to give you a full overview of the OpenBAS features and workflows. The platform can be used in various contexts to handle Breach and Attack simulations at technical or strategical levels. OpenBAS has been designed as a part of the Filigran XTM suite and can be integrated with OpenCTI to generate meaningful attack scenario based on real threat. OpenBAS is result-oriented with many dashboard helping you to evaluate you securoty posture given a defined context.</p> <p>Here are some examples of use cases: - Designing attack scenario based on real threat - Evaluate your security posture against technical simulations on endpoints - Enhance team skills by evaluating them during simulations along with your security systems - Organize Capture The Flag with multiple challenges - Conduct atomic testing</p>"},{"location":"usage/getting-started/#home-screen","title":"Home screen","text":"<p>The Home screen gives any visitor on the OpenBAS platform an outlook on the live of the platform as well as an overview of your global security posture.</p>"},{"location":"usage/getting-started/#your-first-breach-and-attack-simulation","title":"Your first Breach and Attack Simulation","text":""},{"location":"usage/getting-started/#importing-players-and-assets-to-play-with","title":"Importing players and assets to play with","text":"<p>First, you need to import Players and Assets that will participate to the simulation and be targeted by technical or strategical events. To do so, you need to ...</p>"},{"location":"usage/getting-started/#integrate-with-simulation-agent-to-simulate-technical-events","title":"Integrate with Simulation Agent to simulate technical events","text":"<p>If you want to simulate attack at a technical level, you will need to install a Simulation Agent that will play technical events on your imported assets. To do so, you can go to the dedicated panel from the top right button and follow installation instructions. By default, Caldera is part of the OpenBAS stack.</p> <p></p> <p>The Caldera agent will allow you to play various technical events, based on the Mitre ATT&amp;CK matrix.</p>"},{"location":"usage/getting-started/#building-your-scenario","title":"Building your Scenario","text":"<p>Once integrations is done, you are ready to create your first Scenario! </p> <p>Scenarios act as template for your Breach and Attack simulations. After establihing such a template, you will be able to schedule it as a one shot simulation, or as a recurring one. </p> <ul> <li>First, go to the Scenarios menu and create a new one with the + button.</li> <li>Once done, define Teams that will be playing in this Scenario by going to the Definition/Teams tab</li> <li>Now go to the Injects tab and add some to build the serie of events that will define the core of your Scenario. If you want to stay strategical, you can select inject like \"Send individual mails\". If you want to go technical, you can select injects linked to attack pattern (Caldera integration allows you to play hundreds of them).</li> <li>Then, define who or what will be targeted by those injects, customize them, and define what is expected to happen. For example, you expect the targeted team to perform a specific action and the animation team will validated this expectation manually. Or, you expect the technical event to be prevented and it will be automatically checked through your integrations with your security systems.</li> <li>Do not forget to define when the inject is played in the scenario chronology.</li> </ul> <p>Optionnaly, you can buff up your scenario by adding Documents, Media pressures, or even CTF Challenges to your injects.</p>"},{"location":"usage/getting-started/#play-the-simulation","title":"Play the simulation","text":"<p>You can now schedule your Simulation by hitting the blue \"Simulate now\" button. Choose your moment and hit start.</p> <p>On time, a Simulation based on your Scenario template is generated. it is listed in your Scenario overview and in the Simulations menu. Fron there, you can follow the course of the Simulation and interact with it, for example to validate manual expectations.</p> <p>During the course of the simulation, results are updated and can be consulted in the Simulation overview.</p>"},{"location":"usage/getting-started/#evaluate-your-security-posture","title":"Evaluate your security posture","text":"<p>Results in OpenBAS are based on expectations' results that are linked to injects played during Simulations. It is then important to manually validate expectations that need it.</p> <p>Results are broken down by \"Prevention\", \"Detection\" and \"Human response\" metrics. - Prevention displays your ability to prevent the scenario's technical events to be completed - Detection displays your ability to detect the scenario's technical events - HUman response displays how well players and teams react as expected facing the scenario's events.</p>"},{"location":"usage/inject-caldera/","title":"Caldera injects","text":"<p>The Caldera framework, developed by MITRE, is a powerful framework designed to simulate cyberattacks. It enables security teams to conduct realistic and controlled simulations of adversary behavior, reducing the amount of time and resources needed for routine cybersecurity testing.</p>"},{"location":"usage/inject-caldera/#injects","title":"Injects","text":"<p>In OpenBAS, the Caldera framework has been fully integrated, offering users access to a comprehensive library of injects for conducting simulation exercises. With this integration, users can leverage the extensive capabilities of Caldera within OpenBAS.</p> <p>Caldera offers 1600+ abilities, covering the full range of ATT&amp;CK tactics and techniques. These capabilities equip security teams with an extensive toolkit to simulate various threats and assess defense mechanisms effectively.</p>"},{"location":"usage/inject-caldera/#behavior","title":"Behavior","text":"<p>Injects within the Caldera framework can be played on both individual Endpoints and Asset groups. Prior to playing injects, Caldera agents need to be installed on the target machines to enable interaction with the platform.</p> <p>Once the agents are deployed, simulations with Caldera injects can be executed. The platform will contact the agent to start the ability. Subsequently, the agents will report the results to OpenBAS. Below is the workflow illustrating the behavior of injects.</p> <p></p>"},{"location":"usage/inject-caldera/#configuration-variables","title":"Configuration variables","text":"<p>Below are the properties you'll need to set for OpenBAS:</p> Property application.properties Docker environment variable Mandatory Description Enable Caldera collector injector.caldera.enable <code>INJECTOR_CALDERA_ENABLE</code> Yes Enable the Caldera injector. Injector ID injector.caldera.id <code>INJECTOR_CALDERA_ID</code> Yes The ID of the injector. Collector IDs injector.caldera.collector-ids <code>INJECTOR_CALDERA_COLLECTOR_IDS</code> Yes The collector IDs compatible with the injection process. Caldera URL injector.caldera.url <code>INJECTOR_CALDERA_URL</code> Yes The URL of the Caldera instance. Caldera API Key injector.caldera.api-key <code>INJECTOR_CALDERA_API-KEY</code> Yes The API Key for the rest API of the Caldera instance."},{"location":"usage/injectors/","title":"Injectors","text":"<p>Injectors serve as the backbone of the platform, enabling essential integration and functionalities for conducting simulations and exercises effectively. These components empower administrators to orchestrate a diverse range of activities and responses during simulation scenarios. Some of them are built-in in the platform, and others are external integrations. </p> <p>Built-in injectors are seamlessly integrated into the platform, while external injectors require the deployment of additional systems alongside the platform to enable their functionality. Together, these injectors provide a comprehensive toolkit for administrators to design and execute simulations tailored to their specific objectives and requirements.</p>"},{"location":"usage/injectors/#injectors-list","title":"Injectors list","text":"<p>A multitude of injectors are available, each offering distinct capabilities and functionalities to enhance the simulation experience. Here is an overview of the existing injectors:</p> <ul> <li>Airbus CyberRange (Lade): Integration with the Airbus CyberRange platform, enabling seamless interaction and collaboration with CyberRange environments. For more information concerning CyberRange, please refer to the Airbus website.</li> <li>Caldera: Facilitates the use of the MITRE Caldera framework, empowering administrators to leverage advanced simulation capabilities. For more information concerning the Caldera injector, please refer to the dedicated documentation page.</li> <li>Challenges: Manages inject \"publish challenges\". To find more information more about this type of inject, please refer to the dedicated documentation section.</li> <li>Email: Manages the sending of injects' emails, enabling communication and dissemination of simulation-related information.</li> <li>HTTP query: Executes HTTP requests on external services, facilitating interactions with external systems. To find more information about the related inject, please refer to the dedicated documentation section.</li> <li>Manual: Platform functionality for creating manual action reminders, allowing administrators to prompt specific actions to be performed manually. To find more information about the related inject, please refer to the dedicated documentation section.</li> <li>Media pressure: Manages inject \"publish channel pressure\". To find more information about this type of inject, please refer to the dedicated documentation section.</li> <li>OVHCloud SMS Platform: Facilitates SMS messaging for injects, providing an additional communication channel for simulation participants.</li> <li>OpenCTI: Integration with an OpenCTI platform, enhancing simulation capabilities with access to threat intelligence and automatic scenario generation based on observed threat activities.</li> </ul> <p></p> <p></p>"},{"location":"usage/injectors/#agents","title":"Agents","text":"<p>For certain injectors, deploying an agent on the target machine is necessary to facilitate integration with OpenBAS. These agents are software programs that connect back to OpenBAS at certain intervals to get instructions.</p> <p>To access the agents and installation instructions, navigate to the dedicated page located in the top right-hand corner (button with the screen logo). </p> <p>Detailed guidance on installing the agents, along with downloadable packages, is provided on this page. Agents are available for various operating systems, including Windows, Linux, and MacOS, ensuring compatibility across different environments. </p> <p>As of now, only the Caldera injector requires the installation of an agent. This agent enables full integration with the MITRE Caldera framework, unlocking advanced simulation capabilities and enhancing the overall effectiveness of simulation exercises. Full details of the Caldera agent are available in the MITRE documentation.</p> <p></p>"},{"location":"usage/injects/","title":"Injects","text":"<p>Injects are fundamental elements of simulations within OpenBAS, each representing a discrete action to be executed during a Scenario. Managed and facilitated by various injectors, each inject type serves a distinct purpose, contributing to the comprehensive evaluation of defenses.</p> <p></p>"},{"location":"usage/injects/#create-an-inject","title":"Create an inject","text":"<p>Whether intended for Atomic testing or for a Simulation, the process for creating injects remains consistent within OpenBAS.</p> <p></p>"},{"location":"usage/injects/#for-atomic-testing","title":"For Atomic testing","text":"<p>To create an inject for atomic testing, navigate to the \"Atomic testing\" section located in the left-hand banner. Click on the \"+\" icon in the bottom right corner to initiate the inject creation process.</p>"},{"location":"usage/injects/#for-scenarios-and-simulations","title":"For Scenarios and Simulations","text":"<p>For injects intended for use within simulations, access the desired Scenario or Simulation and navigate to the \"Injects\" tab. Click on the \"+\" icon in the bottom right corner of the screen to open the inject creation panel.</p> <p>Note that an inject defined in a Scenario will be used in all the scenario's subsequent simulations. An Inject defined at the simulation level will not be replicated into the Scenario itself, thus it will not be replicated in future scenario's simulations.</p> <p></p>"},{"location":"usage/injects/#inject-creation-process","title":"Inject creation process","text":"<p>Once the inject creation panel is open, you can proceed to configure the inject according to your requirements. Key steps in the creation process include:</p>"},{"location":"usage/injects/#1-choose-the-type-of-inject","title":"1. Choose the type of inject","text":"<p>You first need to select an inject in the list of available ones (on the left of the creation screen). Logos on the left of each line indicates which Injector is associated with each inject. Depending on your integrations, this list can be long.</p> <p>To facilitate the selection into this possibly very long list, you can search injects by name and filter the list by selecting a precise MITRE ATT&amp;CK techniques for instance.</p>"},{"location":"usage/injects/#2-set-inject-parameters","title":"2. Set inject parameters","text":"<p>When selecting an inject on the left, the form on the right populates itself with a by-default title and propose you to define:</p> <ul> <li>Descriptive information: Fill in details such as the title, description, and relevant tags to categorize the inject effectively.</li> <li>Execution timing: If you are creating your inject in the context of a scenario or simulation, you have to set the timing for when the inject should be executed within the simulation timeline, ensuring it aligns with the overall scenario progression.</li> </ul> <p>By clicking on \"Inject content\", you can define now or later:</p> <ul> <li>Inject targets: Specify the targets for the inject, which may include players and teams or assets and assets groups depending on the inject chosen. </li> <li>Expectations: Define the expected outcomes or responses to the inject, outlining the desired actions or behaviors by players. </li> <li>Attachments: Attach any relevant documents or resources to provide additional context or information related to the inject. </li> <li>Additional fields: Depending on the type of Inject selected, you may have access to additional fields specific to that inject type. These fields may include the subject and body of an email, channel pressure settings for public communications, obfuscation options, and more.</li> </ul> <p>The \"available variables\" button helps you to use already defined variables into compatible fields.</p> <p></p> <p>By following these steps and providing the necessary information, you can create injects tailored to your specific testing or simulation objectives.</p>"},{"location":"usage/injects/#inject-types","title":"Inject types","text":"<p>There are different types of injector in OpenBAS.</p> <p></p>"},{"location":"usage/injects/#manual-action-reminders","title":"Manual action reminders","text":"<p>Manual action reminders are injects designed to prompt animation team to perform specific actions manually. It allows to place in the timeline a stimulus to be produced manually, outside the platform (e.g. simulated a call from a journalist on the switchboard telephone). These reminders ensure that critical tasks are completed as part of the simulation, enhancing the accuracy and realism of the exercise.</p> <p>The inject associated with this type is referred to as <code>Manual</code>.</p>"},{"location":"usage/injects/#direct-contact","title":"Direct contact","text":"<p>Injects for direct contact allow sending emails or SMS messages to players. These injects assess the organization's response to communication-based threats, such as phishing attempts, social engineering attacks, or emergency notifications. They can also assess crisis management, including responses to internal information requests or management pressure.</p> <p>Here's the list of injects linked to this category:</p> <ul> <li><code>Send a SMS</code>: enables sending SMS messages.</li> <li><code>Send individual mails</code>: enables sending emails to individuals separately.</li> <li><code>Send multi-recipients mail</code>: enables sending emails to a group of people (each recipient can see the other recipients).</li> </ul> <p></p>"},{"location":"usage/injects/#media-pressure","title":"Media pressure","text":"<p>Injects simulating public communications involve the publication of articles, social media posts, or other fake announcements. These injects replicate scenarios where public disclosure of information or events affects an organization's reputation or operational continuity.</p> <p>The inject associated with this type is referred to as <code>Publish channel pressure</code>.</p> <p></p>"},{"location":"usage/injects/#challenges","title":"Challenges","text":"<p>Challenge injects are set to test participants' skills and response capabilities by publishing challenges. These injects present scenarios or tasks that require active participation and problem-solving, allowing administrators to evaluate players.</p> <p>The inject associated with this type is referred to as <code>Publish challenges</code>.</p> <p></p>"},{"location":"usage/injects/#http-requests","title":"HTTP requests","text":"<p>HTTP request injects are used to forge HTTP requests to a third party services in order to perform actions outside the platform (e.g. API call to an EDR). These injects enable the platform to communicate with external services, gather information, or trigger specific actions via HTTP protocols.</p> <p>HTTP requests GET, POST, and PUT, can be sent. The corresponding injects are named <code>HTTP Request - \\&lt;request type&gt;</code>.</p> <p></p>"},{"location":"usage/injects/#integrations-with-agents-and-cyberranges","title":"Integrations with Agents and CyberRanges","text":"<p>Injects executed on remote systems are facilitated by Injectors like Caldera or Airbus CyberRange. These actions simulate real-world attack techniques, allowing administrators to gauge the effectiveness of their security posture in response to various technical actions attackers may take.</p> <p>There are over 1,700 such injects covering all the TTPs in the MITRE ATT&amp;CK matrix.</p>"},{"location":"usage/injects_and_expectations/","title":"Injects and Expectations","text":"<p>Evaluating security posture in OpenBAS is to confront events (aka Injects) with Expectations.</p>"},{"location":"usage/injects_and_expectations/#injects","title":"Injects","text":"<p>Threats are the results of actions by threat actors, and a combination of intent, capability and opportunity. In OpenBAS, simulating threats and their attack capabilities involves executing injects targeting players and assets.</p> <p>Injects can be technical, emulating action attackers might take on an endpoint, and non-technical, representing interactions with players or impactful contextual events during a crisis (such as media inquiries by phone following a data breach).</p> <p></p> <p></p>"},{"location":"usage/injects_and_expectations/#expectations","title":"Expectations","text":"<p>Each Inject is associated with Expectations. Expectations outline the anticipated outcomes from security systems and teams in response to attacker actions or contextual events.</p> <p>Expectations can be about:</p> <ul> <li>Prevention: ensuring that the security posture can prevent the attacker's actions.</li> <li>Detection: ensuring that the security posture can detect the attacker's actions.</li> <li>Human response: ensuring that teams react appropriately according to defined security processes.</li> </ul> <p>The collection and concatenation of expectations' results, broken down per type, allows to assess the security posture against a threat context. This provides insights to identify areas for improvement.</p>"},{"location":"usage/injects_builtin/","title":"Injects built-in","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/media_pressure/","title":"Media pressure","text":"<p>Under construction</p> <p>We are doing our best to complete this page.  If you want to participae, dont hesitate to join the Filigran Community on Slack  or submit your pull request on the Github doc repository.</p> <p>Media pressure are Articles or web contents you create to give more shape to your Scenario, or to simulate contextual pressure on your Teams and Players.</p> <p>For example, you can create an Article about the data leakage your organization is said to be affected by during the Scenario, and simulate its publishing by a large coverage media outlet with a \"Publish channel pressure\" inject.</p>"},{"location":"usage/media_pressure/#create-an-article","title":"Create an Article","text":"<p>To create an Article, go to the definition page of your Scenario or your Simulation and click on the + button near \"media pressure\". If you did not create Article yet, you can also click on the more visible \"Create an Article\" button.</p> <p>An media pressure Article is defined by: - Channel: the Channel template that will shape the article during the display to the Players. A Channel must have been defined in the platform. - Title - Author - Content: the content of your article. You can enrich the text and have a preview of the formatted result. You can also go fullscreen. - To simulate social network engagement, you can define number of comments, Shares and Likes of the Articles. - Documents: you can attach file to the Article. It can be useful if you want to simulate the publication of a large report you don't want to craft inside OpenBAS, like a pdf security report for example.</p> <p>Once created, Articles appears as cards in the definition screen of the Scenario or Simulation they have been created into. Note that if an article is not yet used in the Scenario or Simulation (probably because it does not have been used in a \"Publish channel pressure\" inject), it is mentioned into the Article's card.</p>"},{"location":"usage/media_pressure/#use-an-article-in-scenario-and-simulation","title":"Use an Article in Scenario and Simulation","text":"<p>To use an Article in a Scenario or Simulation, it must have been created in the context of the Scenario, the Simulation's parent Scenario or the Simulation itself.</p> <p>When you select an Inject, if it is compatible with media pressures, you can add a media pressure article to it.</p>"},{"location":"usage/mitigations/","title":"Mitigations","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/opencti_scenario/","title":"Scenario generation from OpenCTI","text":"<p>Creating a scenario can be a complex task, especially when aiming to build one that is meaningful and relevant to the specific threats facing your organization. To streamline this process and ensure that scenarios are closely aligned with your threat landscape, you can leverage the integration between OpenCTI and OpenBAS.</p> <p>When generating a scenario from OpenCTI, a scenario is created and can be accessed from the scenarios screen. The scenario name will include a reference to OpenCTI, indicating its origin. This scenario will automatically contain relevant sequences of injects based on the threat context identified in OpenCTI.</p> <p>However, it's important to review and potentially customize the scenario to ensure it meets your organization's specific requirements. Additionally, you'll need to select appropriate targets for the injects within the scenario.</p> <p>Once you've finalized the scenario, you can schedule your simulation as you would for any other scenario. The overall results of the simulation will also be available directly within OpenCTI, providing insights into the threat context upon which the scenario is based.</p>"},{"location":"usage/overview/","title":"Overview","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/payloads/","title":"Payloads","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/personas/","title":"Personas","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/playing/","title":"Playing","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/reports/","title":"Reports","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/scenario/","title":"Scenario","text":"<p>When clicking on Scenarios in the left menu, you access to the list of all Scenarios defined in the platform. Scenarios act as templates that translate threat contexts into meaningful events to simulate.</p> <p>Scenarios can be grouped by defining categories, main focus, severity and tags. It is then possible to filter the Scenarios list based on these attributes. Quick filters are available by default at the top of the screen to filter Scenario on most used categories.</p> <p>It is also possible to search Scenarios by their names using the search bar.</p>"},{"location":"usage/scenario/#create-a-scenario","title":"Create a scenario","text":"<p>To create a scenario, hit the + button on the bottom right of the screen and define general metadata that make sense for you. </p> <p>Once done, the scenario is accessible in the list. Click on it to see its details and define them.</p>"},{"location":"usage/scenario/#scenario-overview","title":"Scenario overview","text":"<p>The overview provides comprehensive information for evaluating your security posture against the threat context over time. It displays the scenario's context along with the results of the simulations played from it. Additionally, the list of these simulations is shown, allowing easy access to their specific details and results.</p> <p>If the scenario has never been simulated, the results' widget contains an example of how results will be displayed, and the list of simulations is replaced with an invitation to generate one.</p>"},{"location":"usage/scenario/#defining-a-scenario","title":"Defining a Scenario","text":"<p>To define the scenario, navigate to the \"Definition\" and \"Injects\" tabs.</p> <p>In the \"Definition\" tab, you can add various elements to construct events:</p> <ul> <li>Teams and Players involved in the scenario,</li> <li>Custom variables for simplifying injects' customization,</li> <li>Articles that you might use to simulate media pressure,</li> <li>Challenges designed for including Capture The Flag elements in your scenario.</li> </ul> <p>Once you have added all the elements you need, you can go to the \"Injects\" tab to begin to create the chain of events that will shape your scenario.</p> <p>By clicking on the + button at the bottom right of the screen, you enter the inject creation workflow.</p>"},{"location":"usage/scenario/#launching-a-simulation-of-the-scenario","title":"Launching a simulation of the scenario","text":"<p>Once you've finished defining your scenario, it's time to simulate it and evaluate your security posture!</p> <p>To do so, click the \"Simulate now\" button. You can choose to simulate this scenario as a one-time evaluation, scheduling it for a specific date and time. Additionally, you can set it to simulate recurrently to assess your posture over time. The results of each simulation will populate your scenario overview.</p> <p>A visual indication, located to the right of the scenario's title, provides a quick way to know if the scenario is currently being simulated.</p>"},{"location":"usage/scenario/#export-your-scenario","title":"Export your scenario","text":"<p>You can export your carefully crafted scenario as a JSON file by clicking the three-dots button at the top right of the scenario screen. This allows you to share it with others, or store it outside the platform.</p>"},{"location":"usage/scenarios_and_simulations/","title":"Scenarios and Simulations","text":"<p>In OpenBAS, the core concept to simulate attacks is based on the duo Scenario &amp; Simulation.</p>"},{"location":"usage/scenarios_and_simulations/#scenarios","title":"Scenarios","text":"<p>Scenario enable to translate a threat context, such as an attack or even a threat actor, into a meaningful sequence of events (referred to as injects), which can be technical or non-technical. This chronology of events can be enriched with associated documents or media articles to simulate the environment surrounding them.</p> <p>Within Scenarios, you also specify who participates, whether actual people (referred to as Players) or endpoints (referred to as Assets). They will be the targets of the events representing the threat.</p> <p>In order to translate real threats into Scenarios, it is possible to create them from OpenCTI data, such as Reports.</p>"},{"location":"usage/scenarios_and_simulations/#simulations","title":"Simulations","text":"<p>If a Scenario translates threat context into meaningful events, a Simulation serves as a means to evaluate your security posture against this threat context. </p> <p>By simulating a scenario with recurrence, you can evaluate your security posture over time in response to a threat context. Since simulations are always linked to their parent scenario, even if it evolves, you can: - assess your risk against evolving threats, - evaluate the effectiveness of your security governance in addressing your most relevant threats.</p>"},{"location":"usage/simulation/","title":"Simulation","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p> <p>When clicking on Simulations in the left menu, you access to the list of all Simulations ever launched in the platform. You can filter by tag (for example to only display simulation related to a specific threat actor) and sort them (chronologically, by status, etc.).</p> <p>From this screen, you can easily see last global scores and access ongoing Simulations at platform level.</p>"},{"location":"usage/simulation/#creating-a-simulation","title":"Creating a Simulation","text":"<p>The best practice to create a Simulation is to do it from a Scenario in order to evaluate your security posture over time against a specific threat context.</p> <p>But you can create directly a Simulation if you want, by hitting the + button on the bottom right of the screen. You will have similar definition options as in Scenario creation.</p>"},{"location":"usage/simulation/#simulation-overview","title":"Simulation overview","text":"<p>The Overview regroups everything you need to know to follow your Simulation by its Results. Results are broken down into 3 main metrics:</p> <ul> <li>Prevention: the ability of your security posture to prevent the simulated scenario's events to happen</li> <li>Detection: the ability of your security posture to detect the simulated scenario's events</li> <li>Human response: the ability of your security teams to react as intended facing the simulated scenario</li> </ul> <p>The top of the Simulation screen give you the ability to Start, stop and Reset the Simulation, delay the launch time.</p>"},{"location":"usage/simulation/#overriding-the-scenario-definition","title":"Overriding the Scenario definition","text":"<p>In a Simulation, you can see and modify all elements defining it: Teams and Players, Variables, Media pressure, Challenges, Injects. Modifying the Simulation definition allows you to customize it to adapt a singular play to some temporary changes. For example, change an email address into Variables to be used in email-related injects, change a playing team, etc.</p>"},{"location":"usage/simulation/#animating-a-simulation","title":"Animating a Simulation","text":"<p>The Animation screen of a Simulation is the place to follow the Simulation execution, especially if you are conducting simulation at strategical level (heavily relying on interactions with Teams and Players, manual validations of expectations) for training your organization on all aspects of a cyber crisis.</p> <p>The Timeline screen is the overview of the Animation tab, to see ongoing injects.</p> <p>The Mails screen is a way to manage email interaction with Players into the OpenBAS platform.</p> <p>The Validation screen is the place to manually validate expectations of the Simulation to consolidate Results.</p> <p>The Simulation logs is an interface for the animation team to collaborate during the Simulation.</p>"},{"location":"usage/simulation/#lessons-learned","title":"Lessons learned","text":"<p>In the Lesson Learned tab of a Simulation, you can manage the collection and concatenation of customizable surveys. It helps you in conducting the most underestimated part of a Breach and Attack simulation involving real people, by automating it and complete your Simulation's Results with qualitative feedback.</p>"},{"location":"usage/skills/","title":"Skills","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/systems/","title":"Systems","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/targets/","title":"Targets","text":"<p>When you are using an Inject, whether for Atomic testing, Scenario or Simulation, it's necessary to define the recipients, known as \"targets\", which could include Players, Teams, Assets (endpoints) or/and Asset groups it will be sent to. They are called \"targets\" of the inject.</p> <p>Note that certain injects can't target assets, while others can't target players. For instance, the \"Send individual mails\" inject can only target players and teams, not assets. </p> <p>Target selection is performed during inject creation or update.</p>"},{"location":"usage/targets/#selecting-players-and-teams","title":"Selecting Players and Teams","text":"<p>Directly targeting a player isn't yet possible. Instead, you must target a team. In scenarios or simulations, the team must be included in the scenario or simulation to be selectable. However, when creating atomic testing, all teams in the platform are selectable.</p> <p>Note that visibility of teams and players is limited by the organization's segregation.</p> <p>When selecting a team as the target, all players within that team will be targeted by the inject. Each player will have to complete expectations.</p>"},{"location":"usage/targets/#selecting-assets-endpoints-and-asset-groups","title":"Selecting Assets (endpoints) and Asset groups","text":"<p>You can target assets (endpoints) directly or asset groups. In the dedicated dialog, only assets compatible with the inject are listed by default.</p> <p>When selecting an asset group to target, all assets (endpoints) within the group will be targeted by the inject. Each one will have to complete expectations.</p>"},{"location":"usage/teams_and_players_and_organizations/","title":"Players, Teams and Organizations","text":"<p>Breach and Attack Simulation involves testing your security posture, and people are an essential part of it!</p> <p>Players, teams, and organizations are where you organize the human aspect of your security posture within OpenBAS (in the \"People\" section). These entities are the targets for injects during your simulations and atomic testings.</p> <p></p>"},{"location":"usage/teams_and_players_and_organizations/#players","title":"Players","text":"<p>Players are the users that may take part into your scenarios, to be tested against attack or contextual events (i.e. injects).</p> <p>Players can be created manually with the + button at the bottom right, but we encourage you to activate an integration allowing to import them from your IT environment, like with Microsoft Entra integration.</p> <p>Players are defined by:</p> <ul> <li>Email address,</li> <li>First name,</li> <li>Last name,</li> <li>Organization: to link a player to an organization (see below),</li> <li>Country,</li> <li>Phone number: necessary if you want to play SMS injects,</li> <li>PGP public key: necessary if you want to play encrypted email injects,</li> <li>Tags: if you want to sort them by custom categories.</li> </ul> <p>This list of players can be exported by clicking on the export button, at the top right of the players screen.</p>"},{"location":"usage/teams_and_players_and_organizations/#teams","title":"Teams","text":"<p>Teams group players into units that can be targeted by injects during simulations or atomic testing. They serve as a way to represent different security teams (e.g., CSIRT, SOC, VOC) and other relevant teams that might be involved into your scenario (e.g., legal department, communication department).</p> <p>Teams are defined by:</p> <ul> <li>Name,</li> <li>Description,</li> <li>Organization: to link a team to an organization (see below),</li> <li>Tags: if you want to sort them by custom categories.</li> </ul> <p>From the teams list, you can manage players by clicking on the three-dots inline button on the right and selecting \"Manage players.\" From there, you can view, update, or delete all the team's players and see their communication channels' state.</p> <p></p>"},{"location":"usage/teams_and_players_and_organizations/#organizations","title":"Organizations","text":"<p>Organization provides a straightforward method to segregate players and teams within the platform. A player associated with an organization, even with the required rights to animate and planned scenarios and simulations, will never see players and teams from other organizations.</p> <p>This feature can be particularly useful if you are using OpenBAS to plan and execute simulations for various companies or subsidiaries.</p>"},{"location":"usage/testing/","title":"Testing","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/variables/","title":"Variables","text":""},{"location":"usage/variables/#built-in-variables","title":"Built-In Variables","text":"<p>Within certain injects, users can leverage a set of predefined built-in variables to dynamically customize content. These variables are designed to streamline the process of personalizing messages. Examples of built-in variables include but not limited to :</p> <ul> <li>${user.email}: Represents the email of the target user</li> <li>${exercise.name}: Represents the name of the current exercise</li> <li>${player_uri}: Represents the player interface platform link</li> </ul>"},{"location":"usage/variables/#custom-variables","title":"Custom Variables","text":"<p>In addition to the built-in variables, users can define their own variables within an exercise.</p> <p>To define custom variables :</p> <ol> <li>Select an exercise</li> <li>Navigate to the Definition tab</li> <li>Navigate to the Variables section</li> </ol> <p>In this section, users can create, update or delete custom variables. </p>"},{"location":"usage/variables/#limitation","title":"Limitation","text":"<p>To create custom variables, consider the following limitation:</p> <ul> <li>Only lowercase characters and <code>_</code> are authorized for the key value</li> <li>Variable value can only be string</li> </ul>"},{"location":"usage/variables/#use-variables","title":"Use Variables","text":"<p>These variables can be used to enhance personalization of certain stimuli within an exercise. Here is a non-exhaustive list of concerned stimuli : - Email sending - Sms sending</p> <p></p>"}]}
\ No newline at end of file
+{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"],"fields":{"title":{"boost":1000.0},"text":{"boost":1.0},"tags":{"boost":1000000.0}}},"docs":[{"location":"","title":"OpenBAS Documentation Space","text":"<p>Welcome to the OpenBAS Documentation space. Here you will be able to find all documents, meeting notes and presentations about the platform.</p> <p>Release notes</p> <p>Please, be sure to also take a look at the OpenBAS releases notes, they may contain important information about releases and deployments.</p>"},{"location":"#introduction","title":"Introduction","text":"<p>OpenBAS is an open source platform allowing organizations to plan, schedule and conduct crisis exercises as well as adversary and breach simulations. OpenBAS is an ISO 22398 compliant product and has been designed as a modern web application including a RESTFul API and an UX oriented frontend.</p>"},{"location":"#getting-started","title":"Getting started","text":"<ul> <li> <p> Deployment &amp; Setup</p> <p>Learn how to deploy and configure the platform as well as launch connectors to get the first data in OpenBAS.</p> <p> Deploy now</p> </li> <li> <p> User Guide</p> <p>Understand how to use the platform, create exercises and campaigns, use  media pressure simulation and integrate with other tools. </p> <p> Explore</p> </li> <li> <p> Administration</p> <p>Know how to administrate OpenBAS, create users and groups using RBAC / segregation, customize the overall experience.</p> <p> Customize</p> </li> </ul> <p>Need more help?</p> <p>We are doing our best to keep this documentation complete, accurate and up to date. </p> <p>If you still have questions or you find something which is not sufficiently explained, join the Filigran Community on Slack.</p>"},{"location":"#latest-blog-posts","title":"Latest blog posts","text":"<p>All tutorials are published directly on the Medium blog, this section provides a comprehensive list of the most important ones.</p> <ul> <li> <p>How we are disrupting tactical and strategical crisis management exercises with OpenBAS 3 <sub><sup>Oct 10, 2022</sup></sub></p> <p>It\u2019s been a while since we\u2019ve talked about OpenBAS and yet\u2026 In the trying times we live in, both in cyberspace and in real life, crisis preparedness has become...</p> <p> Read</p> </li> <li> <p>Plan, execute and conduct your crisis management exercises <sub><sup>Jan 25, 2021</sup></sub></p> <p>More than 3 years ago, we decided to build the OpenBAS application which allows organizations to facilitate the planning of crisis management...</p> <p> Read</p> </li> </ul>"},{"location":"#additional-resources","title":"Additional resources","text":"<p>Below, you will find external resources which may be useful along your OpenBAS journey.</p> <p> Training Courses Training courses for analysts and administrators in the Filigran training center.</p> <p></p>"},{"location":"administration/enterprise/","title":"Enterprise edition","text":"<p>Filigran</p> <p>Filigran is providing an Enterprise Edition of the platform, whether on-premise or in the SaaS.</p>"},{"location":"administration/enterprise/#what-is-openbas-ee","title":"What is OpenBAS EE?","text":"<p>OpenBAS Enterprise Edition is based on the open core concept. This means that the source code of OCTI EE remains open source and included in the main GitHub repository of the platform but is published under a specific license. As specified in the GitHub license file:</p> <ul> <li>The OpenBAS Community Edition is licensed under the Apache License, Version 2.0 (the \u201cApache License\u201d).</li> <li>The OpenBAS Enterprise Edition is licensed under the OpenBAS Enterprise Edition License (the \u201cEnterprise Edition Licensee\u201d).</li> </ul> <p>The source files in this repository have a header indicating which license they are under. If no such header is provided, this means that the file belongs to the Community Edition under the Apache License, Version 2.0.</p>"},{"location":"administration/enterprise/#ee-activation","title":"EE Activation","text":"<p>Enterprise edition is easy to activate. You need to go the platform settings and click on the Activate button.</p> <p></p> <p>Then you will need to agree to the Filigran EULA.</p> <p></p> <p>As a reminder:</p> <ul> <li>OpenBAS EE is free-to-use for development, testing and research purposes as well as for non-profit organizations.</li> <li>OpenBAS EE is included for all Filigran SaaS customers without additional fee.</li> <li>For all other usages, OpenBAS EE is reserved to organizations that have signed a Filigran Enterprise agreement.</li> </ul>"},{"location":"administration/enterprise/#available-features","title":"Available features","text":""},{"location":"administration/enterprise/#generative-ai","title":"Generative AI","text":"<p>Be able to use AI for content generation including emails, media pressure articles etc.</p>"},{"location":"administration/enterprise/#more-to-come","title":"More to come","text":"<p>More features will be available in OpenBAS in the future. Features like:</p> <ul> <li>Security posture automatic evalution.</li> <li>Premium mitigations and recommendation for configuration changes.</li> </ul>"},{"location":"administration/introduction/","title":"Introduction","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"administration/parameters/","title":"Parameters","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"administration/policies/","title":"Policies","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"administration/users/","title":"Users and RBAC","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"deployment/authentication/","title":"Authentication","text":""},{"location":"deployment/authentication/#introduction","title":"Introduction","text":"<p>Welcome to the authentication documentation for OpenBAS. This documentation provides details on setting up and utilizing the authentication system, which supports multiple authentication methods to cater to different user needs and security requirements.</p>"},{"location":"deployment/authentication/#supported-authentication-methods","title":"Supported authentication methods","text":""},{"location":"deployment/authentication/#local-users","title":"Local users","text":"<p>OpenBAS use this strategy as the default, but it's not the one we recommend for security reasons.</p> <ul> <li><code>OPENBAS.AUTH-LOCAL-ENABLE</code>: Set this to <code>true</code> to enable username/password authentication.</li> </ul> <p>Production deployment</p> <p>Please use the LDAP/Auth0/OpenID/SAML strategy for production deployment.</p>"},{"location":"deployment/authentication/#openid","title":"OpenID","text":"<p>This method allows to use the OpenID Connect Protocol to handle the authentication.</p> <ul> <li><code>OPENBAS.AUTH-OPENID-ENABLE</code>: Set this to <code>true</code> to enable OAuth (OpenID) authentication.</li> </ul> <p>Example for Auth0:</p> <pre><code>SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_{registrationId}_ISSUER-URI=https://auth.auth0.io\nSPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_{registrationId}_CLIENT-NAME=Login with auth0\nSPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_{registrationId}_CLIENT-ID=\nSPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_{registrationId}_CLIENT-SECRET=\nSPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_{registrationId}_REDIRECT-URI=${openbas.base-url}/login/oauth2/code/{registrationId}\nSPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_{registrationId}_SCOPE=openid,profile,email\n</code></pre> <p>Example for GitHub (or others pre-handled oauth2 providers):</p> <pre><code>SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_{registrationId}_CLIENT_NAME=Login with Github\nSPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_{registrationId}_CLIENT_ID=\nSPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_{registrationId}_CLIENT_SECRET=\n</code></pre> <p>Tips</p> <p>{registrationId} is an arbitrary identifier you choose.</p>"},{"location":"deployment/authentication/#saml2","title":"SAML2","text":"<p>This strategy can be used to authenticate your user with your company SAML.</p> <ul> <li><code>OPENBAS.AUTH-SAML2-ENABLE</code>: Set this to <code>true</code> to enable SAML2 authentication. </li> </ul> <p>Example for Microsoft : <pre><code>SPRING_SECURITY_SAML2_RELYINGPARTY_REGISTRATION_{registrationId}_ENTITY-ID=\nSPRING_SECURITY_SAML2_RELYINGPARTY_REGISTRATION_{registrationId}_ASSERTINGPARTY_METADATA-URI=\nOPENBAS_PROVIDER_{registrationId}_FIRSTNAME_ATTRIBUTE_KEY=\nOPENBAS_PROVIDER_{registrationId}_LASTNAME_ATTRIBUTE_KEY=\n</code></pre></p> <p>Tips</p> <p>{registrationId} is an arbitrary identifier you choose.   metadata-uri is the uri of the xml file given by your identity provider</p>"},{"location":"deployment/authentication/#single-sign-on-url","title":"Single Sign On URL","text":""},{"location":"deployment/authentication/#saml2_1","title":"SAML2","text":"<p>Url for the config of your sso provider <pre><code>${openbas.base-url}/login/saml2/sso/{registrationId}\n</code></pre></p>"},{"location":"deployment/authentication/#map-administrators-to-specific-roles-openid-and-saml-2","title":"Map administrators to specific roles (OpenID and SAML 2)","text":"<p>To grant administrative roles, you can utilize OAuth and SAML2 integration. If you opt for this approach, you'll need to include the following variables:</p> <pre><code>OPENBAS_PROVIDER_{registrationId}_ROLES_PATH=http://schemas.microsoft.com/ws/2008/06/identity/claims/role\nOPENBAS_PROVIDER_{registrationId}_ROLES_ADMIN=\n</code></pre> <p>However, if you intend to manage administrative roles within the OpenBAS platform itself, there's no need to provide these variables.</p>"},{"location":"deployment/authentication/#error-handling","title":"Error Handling","text":"<p>Under construction</p> <p>We are doing our best to complete this page.  If you want to participae, dont hesitate to join the Filigran Community on Slack  or submit your pull request on the Github doc repository.</p>"},{"location":"deployment/clustering/","title":"Clustering","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"deployment/collectors/","title":"Collectors","text":""},{"location":"deployment/collectors/#introduction","title":"Introduction","text":"<p>Collectors list</p> <p>You are looking for the available collectors? The list is in the OpenBAS Ecosystem.</p> <p>Collectors are one of the cornerstones of the OpenBAS platform, they are responsible for pulling data from various external services for two purposes:</p> <ul> <li>Collect all alerts, logs and traces related to attacks, incidents or crisis and match them to simulated injects to evaluate the security posture. </li> <li>Collect any data that may help to schedule breach and attack simulations such as list of assets, groups, identities, payloads, etc.</li> </ul>"},{"location":"deployment/collectors/#detection-siem-xdr-edr-ndr","title":"\ud83d\udee1\ufe0f Detection (SIEM, XDR, EDR, NDR)","text":"<p>Those collectors are the most import ones as they are used to evaluate the security posture (response to injects) from various detection and response systems and fulfill expectations for detection and prevention.</p>"},{"location":"deployment/collectors/#threat-intelligence","title":"\ud83e\uddec Threat Intelligence","text":"<p>Those collectors are used to collect threat intelligence data such as kill chains, scenarios, TTPs, payloads, etc.</p>"},{"location":"deployment/collectors/#endpoint-management","title":"\ud83d\udcfa Endpoint management","text":"<p>Those collectors are pulling alternative information about your endpoints and assets to complete the overview about your current posture in terms of vulnerabilities and compliance.</p>"},{"location":"deployment/collectors/#identities","title":"\ud83c\udfad Identities","text":"<p>Those collectors are pulling all information related to identities, including human assets, to be used in scenario or to complete the view overview about your current posture.</p>"},{"location":"deployment/collectors/#others","title":"\ud83d\udd2d Others","text":"<p>All other system OpenBAS can pull from, to add more meaningful and relevant information to the view of your security posture.</p>"},{"location":"deployment/collectors/#collectors-installation","title":"Collectors installation","text":""},{"location":"deployment/collectors/#built-in-collectors","title":"Built-in collectors","text":"<p>Some collectors such as Microsoft Sentinel are directly embedded into the application. To configure them, just add the proper configuration parameters in your platform configuration.</p>"},{"location":"deployment/collectors/#external-python-collectors","title":"External (Python) collectors","text":""},{"location":"deployment/collectors/#configuration","title":"Configuration","text":"<p>All external collectors have to be able to access the OpenBAS API. To allow this connection, they have 2 mandatory configuration parameters, the <code>OPENBAS_URL</code> and the <code>OPENBAS_TOKEN</code>. In addition to these 2 parameters, collectors have other mandatory parameters that need to be set in order to get them work.</p> <p>Collector tokens</p> <p>You can use your administrator token or create another administrator service account to put in your collectors. It is not necessary to have one dedicated user for each collector.</p> <p>Here is an example of a collector <code>docker-compose.yml</code> file: <pre><code>- OPENBAS_URL=http://localhost\n- OPENBAS_TOKEN=ChangeMe\n- COLLECTOR_ID=ChangeMe # Valid UUIDv4\n- \"COLLECTOR_NAME=MITRE ATT&amp;CK\"\n- COLLECTOR_LOG_LEVEL=error\n</code></pre></p> <p>Here is an example in a collector <code>config.yml</code> file:</p> <pre><code>openbas:\n  url: 'http://localhost:3001'\n  token: 'ChangeMe'\n\ncollector:\n  id: 'ChangeMe'\n  name: 'MITRE ATT&amp;CK'\n  log_level: 'info'\n</code></pre>"},{"location":"deployment/collectors/#docker-activation","title":"Docker activation","text":"<p>You can either directly run the Docker image of collectors or add them to your current <code>docker-compose.yml</code> file.</p>"},{"location":"deployment/collectors/#add-an-collector-to-your-deployment","title":"Add an collector to your deployment","text":"<p>For instance, to enable the MITRE ATT&amp;CK collector, you can add a new service to your <code>docker-compose.yml</code> file:</p> <pre><code>  collector-mitre-attack:\n    image: openbas/collector-mitre-attack:1.0.0\n    environment:\n      - OPENBAS_URL=http://localhost\n      - OPENBAS_TOKEN=ChangeMe\n      - COLLECTOR_ID=ChangeMe\n      - \"COLLECTOR_NAME=MITRE ATT&amp;CK\"\n      - COLLECTOR_LOG_LEVEL=error\n    restart: always\n</code></pre>"},{"location":"deployment/collectors/#launch-a-standalone-collector","title":"Launch a standalone collector","text":"<p>To launch standalone collector, you can use the <code>docker-compose.yml</code> file of the collector itself. Just download the latest release and start the collector:</p> <pre><code>$ wget https://github.com/OpenBAS-Platform/collectors/archive/{RELEASE_VERSION}.zip\n$ unzip {RELEASE_VERSION}.zip\n$ cd collectors-{RELEASE_VERSION}/mitre-attack/\n</code></pre> <p>Change the configuration in the <code>docker-compose.yml</code> according to the parameters of the platform and of the targeted service. Then launch the collector:</p> <pre><code>$ docker-compose up\n</code></pre>"},{"location":"deployment/collectors/#manual-activation","title":"Manual activation","text":"<p>If you want to manually launch collector, you just have to install Python 3 and pip3 for dependencies:</p> <pre><code>$ apt install python3 python3-pip\n</code></pre> <p>Download the release of the collectors:</p> <pre><code>$ wget &lt;https://github.com/OpenBAS-Platform/collectors/archive/{RELEASE_VERSION}.zip&gt;\n$ unzip {RELEASE_VERSION}.zip\n$ cd collectors-{RELEASE_VERSION}/mitre-attack/src/\n</code></pre> <p>Install dependencies and initialize the configuration:</p> <pre><code>$ pip3 install -r requirements.txt\n$ cp config.yml.sample config.yml\n</code></pre> <p>Change the <code>config.yml</code> content according to the parameters of the platform and of the targeted service and launch the collector:</p> <pre><code>$ python3 openbas_mitre.py\n</code></pre>"},{"location":"deployment/collectors/#collectors-status","title":"Collectors status","text":"<p>The collector status can be displayed in the dedicated section of the platform available in Integration &gt; collectors. You will be able to see the statistics of the RabbitMQ queue of the collector:</p> <p></p> <p>Problem</p> <p>If you encounter problems deploying OpenBAS or collectors, you can consult the troubleshooting page page.</p>"},{"location":"deployment/configuration/","title":"Configuration","text":"<p>The purpose of this section is to learn how to configure OpenBAS to have it tailored for your production and development needs. It is possible to check all default parameters implemented in the platform in the <code>application.properties</code> file.</p> <p>Here are the configuration keys, for both containers (environment variables) and manual deployment.</p> <p>Parameters equivalence</p> <p>The equivalent of a config variable in environment variables is the usage of an underscore (<code>_</code>) for a level of config.</p> <p>For example: <pre><code>spring.servlet.multipart.max-file-size=5GB\n</code></pre></p> <p>will become: <pre><code>SPRING_SERVLET_MULTIPART_MAX-FILE-SIZE=5GB\n</code></pre></p>"},{"location":"deployment/configuration/#platform","title":"Platform","text":""},{"location":"deployment/configuration/#api-frontend","title":"API &amp; Frontend","text":""},{"location":"deployment/configuration/#basic-parameters","title":"Basic parameters","text":"Parameter Environment variable Default value Description server.address SERVER_ADDRESS 0.0.0.0 Listen address of the application server.port SERVER_PORT 8080 Listen port of the application openbas.base-url OPENBAS_BASE-URL http://localhost:8080 Base URL of the application, will be used in some email links server.servlet.session.timeout SERVER_SERVLET_SESSION_TIMEOUT 60m Default duration of session (60 minutes) openbas.cookie-secure OPENBAS_COOKIE-SECURE <code>false</code> Turn on if the access is done in HTTPS openbas.cookie-duration OPENBAS_COOKIE-DURATION P1D Cookie duration (default 1 day) openbas.admin.email OPENBAS_ADMIN_EMAIL admin@openbas.io Default login email of the admin user openbas.admin.password OPENBAS_ADMIN_PASSWORD ChangeMe Default password of the admin user openbas.admin.token OPENBAS_ADMIN_TOKEN ChangeMe Default token (must be a valid UUIDv4)"},{"location":"deployment/configuration/#network-and-security","title":"Network and security","text":"Parameter Environment variable Default value Description server.ssl.enabled SERVER_SSL_ENABLED <code>false</code> Turn on to enable SSL on the local server server.ssl.key-store-type SERVER_SSL_KEY-STORE-TYPE PKCS12 Type of SSL keystore server.ssl.key-store SERVER_SSL_KEY-STORE classpath:localhost.p12 SSL keystore path server.ssl.key-store-password SERVER_SSL_KEY-STORE-PASSWORD admin SSL keystore password server.ssl.key-alias SERVER_SSL_KEY-ALIAS localhost SSL key alias"},{"location":"deployment/configuration/#logging","title":"Logging","text":"Parameter Environment variable Default value Description logging.level.root LOGGING_LEVEL_ROOT fatal Root log level logging.level.io.openbas LOGGING_LEVEL_IO_OPENBAS warn OpenBAS log level logging.file.name LOGGING_FILE_NAME ./logs/openbas.log Log file path (in addition to console output) logging.logback.rollingpolicy.max-file-size LOGGING_LOGBACK_ROLLINGPOLICY_MAX-FILE-SIZE 10MB Rolling max file size logging.logback.rollingpolicy.max-history LOGGING_LOGBACK_ROLLINGPOLICY_MAX-HISTORY 7 Rolling max days"},{"location":"deployment/configuration/#dependencies","title":"Dependencies","text":""},{"location":"deployment/configuration/#xtm-suite","title":"XTM Suite","text":"Parameter Environment variable Default value Description openbas.xtm.opencti.enable OPENBAS_XTM_OPENCTI_ENABLE false Enable integration with OpenCTI openbas.xtm.opencti.url OPENBAS_XTM_OPENCTI_URL OpenCTI URL openbas.xtm.opencti.token OPENBAS_XTM_OPENCTI_TOKEN OpenCTI token openbas.xtm.opencti.disable-display OPENBAS_XTM_OPENCTI_DISABLE-DISPLAY <code>false</code> Disable OpenCTI in the UI"},{"location":"deployment/configuration/#postgresql","title":"PostgreSQL","text":"Parameter Environment variable Default value Description spring.datasource.url SPRING_DATASOURCE_URL jdbc:postgresql://... URL of the database (ex jdbc:postgresql://postgresql.mydomain.com:5432/openbas) spring.datasource.username SPRING_DATASOURCE_USERNAME Login for the database spring.datasource.password SPRING_DATASOURCE_PASSWORD password Password for the database"},{"location":"deployment/configuration/#rabbitmq","title":"RabbitMQ","text":"Parameter Environment variable Default value Description openbas.rabbitmq.prefix OPENBAS_RABBITMQ_PREFIX openbas Prefix for the queue names openbas.rabbitmq.hostname OPENBAS_RABBITMQ_HOSTNAME localhost Hostname of the RabbitMQ server openbas.rabbitmq.vhost OPENBAS_RABBITMQ_VHOST / Vhost of the RabbitMQ server openbas.rabbitmq.port OPENBAS_RABBITMQ_PORT 5672 Port of the RabbitMQ Server openbas.rabbitmq.ssl OPENBAS_RABBITMQ_SSL <code>false</code> Use SSL openbas.rabbitmq.user OPENBAS_RABBITMQ_USER guest RabbitMQ user openbas.rabbitmq.pass OPENBAS_RABBITMQ_PASS guest RabbitMQ password openbas.rabbitmq.queue-type OPENBAS_RABBITMQ_QUEUE-TYPE classic RabbitMQ Queue Type (\"classic\" or \"quorum\")"},{"location":"deployment/configuration/#s3-bucket","title":"S3 bucket","text":"Parameter Environment variable Default value Description minio.endpoint MINIO_ENDPOINT localhost Hostname of the S3 Service. Example if you use AWS Bucket S3: s3.us-east-1.amazonaws.com (if <code>minio:bucket_region</code> value is us-east-1). This parameter value can be omitted if you use Minio as an S3 Bucket Service. minio.port MINIO_PORT 9000 Port of the S3 Service. For AWS Bucket S3 over HTTPS, this value can be changed (usually 443). minio.secure MINIO_SECURE <code>false</code> Indicates whether the S3 Service has TLS enabled. For AWS Bucket S3 over HTTPS, this value could be <code>true</code>. minio.access-key MINIO_ACCESS-KEY key Access key for the S3 Service. minio.access-secret MINIO_ACCESS-SECRET secret Secret key for the S3 Service. minio.bucket MINIO_BUCKET openbas S3 bucket name. Useful to change if you use AWS. minio.bucket-region MINIO_BUCKET-REGION us-east-1 Region of the S3 bucket if you are using AWS. This parameter value can be omitted if you use Minio as an S3 Bucket Service."},{"location":"deployment/configuration/#executors-neutral-agents","title":"Executors (neutral agents)","text":"<p>To be able to use the power of the OpenBAS platform on endpoints, you need at least one executor that will be in charge of spawing temporary processes (endpoint injectors) which will execute payloads.</p> <p>Supported executors</p> <p>We currently support only Caldera and Tanium but are actively working on our own agent as well as supporting more third-party.</p>"},{"location":"deployment/configuration/#caldera","title":"Caldera","text":"Parameter Environment variable Default value Description executor.caldera.enable EXECUTOR_CALDERA_ENABLE <code>true</code> Enable the Caldera executor executor.caldera.url EXECUTOR_CALDERA_URL Caldera URL executor.caldera.public-url EXECUTOR_CALDERA_PUBLIC-URL Caldera URL accessible from endpoints executor.caldera.api-key EXECUTOR_CALDERA_API-KEY Caldera API key"},{"location":"deployment/configuration/#tanium","title":"Tanium","text":"<p>Tanium Packages</p> <p>To use the Tanium executor, please install the OpenBAS packages on the Tanium platform and fill their IDs in the configuration below.</p> Parameter Environment variable Default value Description executor.tanium.enable EXECUTOR_TANIUM_ENABLE <code>false</code> Enable the Tanium executor executor.tanium.url EXECUTOR_TANIUM_URL Tanium URL executor.tanium.api-key EXECUTOR_TANIUM_API-KEY Tanium API key executor.tanium.computer-group-id EXECUTOR_TANIUM_COMPUTER_GROUP_ID Tanium Computer Group to be used in simulations executor.tanium.windows-package-id EXECUTOR_TANIUM_WINDOWS_PACKAGE_ID ID of the OpenBAS Tanium Windows package executor.tanium.unix-package-id EXECUTOR_TANIUM_UNIX_PACKAGE_ID ID of the OpenBAS Tanium Unix package"},{"location":"deployment/configuration/#mail-services","title":"Mail services","text":"<p>For the associated mailbox, for the moment the platform only relies on IMAP / SMTP protocols, we are actively developing integrations with APIs such as O365 and Google Apps.</p>"},{"location":"deployment/configuration/#smtp","title":"SMTP","text":"Parameter Environment variable Default value Description spring.mail.host SPRING_MAIL_HOST smtp.mail.com SMTP Server hostname spring.mail.port SPRING_MAIL_PORT 465 SMTP Server port spring.mail.username SPRING_MAIL_USERNAME username@mail.com SMTP Server username spring.mail.password SPRING_MAIL_PASSWORD password SMTP Server password Parameter Environment variable Default value Description spring.mail.properties.mail.smtp.ssl.enable SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_ENABLE <code>true</code> Turn on SMTP SSL mode spring.mail.properties.mail.smtp.ssl.trust SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_TRUST * Trust unverified certificates spring.mail.properties.mail.smtp.auth SPRING_MAIL_PROPERTIES_MAIL_SMTP_AUTH <code>true</code> Turn on SMTP authentication spring.mail.properties.mail.smtp.starttls.enable SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_ENABLE <code>false</code> Turn on SMTP STARTTLS"},{"location":"deployment/configuration/#imap","title":"IMAP","text":"Parameter Environment variable Default value Description openbas.mail.imap.enabled OPENBAS_MAIL_IMAP_ENABLED false Turn on to enable IMAP mail synchronization. Injector email must be well configured openbas.mail.imap.host OPENBAS_MAIL_IMAP_HOST imap.mail.com IMAP Server hostname openbas.mail.imap.port OPENBAS_MAIL_IMAP_PORT 993 IMAP Server port openbas.mail.imap.username OPENBAS_MAIL_IMAP_USERNAME username@mail.com IMAP Server username openbas.mail.imap.password OPENBAS_MAIL_IMAP_PASSWORD password IMAP Server password openbas.mail.imap.inbox OPENBAS_MAIL_IMAP_INBOX INBOX IMAP inbox directory to synchronize from openbas.mail.imap.sent OPENBAS_MAIL_IMAP_SENT Sent IMAP sent directory to synchronize from Parameter Environment variable Default value Description openbas.mail.imap.ssl.enable OPENBAS_MAIL_IMAP_SSL_ENABLE true Turn on IMAP SSL mode openbas.mail.imap.ssl.trust OPENBAS_MAIL_IMAP_SSL_TRUST * Trust unverified certificates openbas.mail.imap.auth OPENBAS_MAIL_IMAP_AUTH true Turn on IMAP authentication openbas.mail.imap.starttls.enable OPENBAS_MAIL_IMAP_STARTTLS_ENABLE true Turn on IMAP STARTTLS"},{"location":"deployment/configuration/#ai-service","title":"AI Service","text":"<p>AI deployment and cloud services</p> <p>There are several possibilities for Enterprise Edition customers to use OpenBAS AI endpoints:</p> <ul> <li>Use the Filigran AI Service leveraging our custom AI model using the token given by the support team.</li> <li>Use OpenAI or MistralAI cloud endpoints using your own tokens.</li> <li>Deploy or use local AI endpoints (Filigran can provide you with the custom model).</li> </ul> Parameter Environment variable Default value Description ai.enabled AI_ENABLED true Enable AI capabilities ai.type AI_TYPE mistralai AI type (<code>mistralai</code> or <code>openai</code>) ai.endpoint AI_ENDPOINT Endpoint URL (empty means default cloud service) ai.token AI_TOKEN Token for endpoint credentials ai.model AI_MODEL Model to be used for text generation (depending on type) ai.model_images AI_MODEL_IMAGES Model to be used for image generation (depending on type)"},{"location":"deployment/injectors/","title":"Injectors","text":""},{"location":"deployment/injectors/#introduction","title":"Introduction","text":"<p>Injectors list</p> <p>You are looking for the available injectors? The list is in the OpenBAS Ecosystem.</p> <p>Injectors are one of the cornerstones of the OpenBAS platform, they are responsible for pushing simulation actions to third party systems. According to their functionality and use case, they are categorized in the following classes.</p> <p></p>"},{"location":"deployment/injectors/#endpoint-payloads-execution","title":"\ud83d\udce1 Endpoint payloads execution","text":"<p>Those injectors are special as they required an executor (neutral agent) to be launched on endpoints. When they register to the platform, they inform available executors on how to spawn them on the 3 currently supported platforms: Windows, Linux and MacOS.</p>"},{"location":"deployment/injectors/#communication-social-medias","title":"\ud83c\udf10 Communication &amp; social medias","text":"<p>Those injectors are used to push information to human assets (aka players) such as emails, SMS, phone calls, instant messaging etc.</p>"},{"location":"deployment/injectors/#incident-response-case-management","title":"\ud83e\uddef Incident Response &amp; Case Management","text":"<p>Those injectors are used to inject real or fake information into case management, ticketing and incident response systems.</p>"},{"location":"deployment/injectors/#others","title":"\ud83d\udc89 Others","text":"<p>All other system OpenBAS can inject, as part of breach and attack simulation campaigns. </p>"},{"location":"deployment/injectors/#injectors-installation","title":"Injectors installation","text":""},{"location":"deployment/injectors/#built-in-injectors","title":"Built-in injectors","text":"<p>Some injectors such as email, SMS, media pressure, etc. are directly embedded into the application. To configure them, just add the proper configuration parameters in your platform configuration. </p>"},{"location":"deployment/injectors/#external-python-injectors","title":"External (Python) injectors","text":""},{"location":"deployment/injectors/#configuration","title":"Configuration","text":"<p>All external injectors have to be able to access the OpenBAS API. To allow this connection, they have 2 mandatory configuration parameters, the <code>OPENBAS_URL</code> and the <code>OPENBAS_TOKEN</code>. In addition to these 2 parameters, injectors have other mandatory parameters that need to be set in order to get them work.</p> <p>Injector tokens</p> <p>You can use your administrator token or create another administrator service account to put in your injectors. It is not necessary to have one dedicated user for each injector.</p> <p>Here is an example of a injector <code>docker-compose.yml</code> file: <pre><code>- OPENBAS_URL=http://localhost\n- OPENBAS_TOKEN=ChangeMe\n- INJECTOR_ID=ChangeMe # Valid UUIDv4\n- \"INJECTOR_NAME=HTTP query\"\n- INJECTOR_LOG_LEVEL=error\n</code></pre></p> <p>Here is an example in a injector <code>config.yml</code> file:</p> <pre><code>openbas:\n  url: 'http://localhost:3001'\n  token: 'ChangeMe'\n\ninjector:\n  id: 'ChangeMe'\n  name: 'HTTP query'\n  log_level: 'info'\n</code></pre>"},{"location":"deployment/injectors/#networking","title":"Networking","text":"<p>Be aware that all injectors are reaching RabbitMQ based the RabbitMQ configuration provided by the OpenBAS platform. The injector must be able to reach RabbitMQ on the specified hostname and port. If you have a specific Docker network configuration, please be sure to adapt your <code>docker-compose.yml</code> file in such way that the injector container gets attached to the OpenBAS Network, e.g.:</p> <pre><code>networks:\n  default:\n    external: true\n    name: openbas-docker_default\n</code></pre>"},{"location":"deployment/injectors/#docker-activation","title":"Docker activation","text":"<p>You can either directly run the Docker image of injectors or add them to your current <code>docker-compose.yml</code> file.</p>"},{"location":"deployment/injectors/#add-an-injector-to-your-deployment","title":"Add an injector to your deployment","text":"<p>For instance, to enable the HTTP query injector, you can add a new service to your <code>docker-compose.yml</code> file:</p> <pre><code>  injector-http-query:\n    image: openbas/injector-http-query:latest\n    environment:\n      - OPENBAS_URL=http://localhost\n      - OPENBAS_TOKEN=ChangeMe\n      - INJECTOR_ID=ChangeMe\n      - \"INJECTOR_NAME=HTTP query\"\n      - INJECTOR_LOG_LEVEL=error\n    restart: always\n</code></pre>"},{"location":"deployment/injectors/#launch-a-standalone-injector","title":"Launch a standalone injector","text":"<p>To launch standalone injector, you can use the <code>docker-compose.yml</code> file of the injector itself. Just download the latest release and start the injector:</p> <pre><code>$ wget https://github.com/OpenBAS-Platform/injectors/archive/{RELEASE_VERSION}.zip\n$ unzip {RELEASE_VERSION}.zip\n$ cd injectors-{RELEASE_VERSION}/http-query/\n</code></pre> <p>Change the configuration in the <code>docker-compose.yml</code> according to the parameters of the platform and of the targeted service. Then launch the injector:</p> <pre><code>$ docker-compose up\n</code></pre>"},{"location":"deployment/injectors/#manual-activation","title":"Manual activation","text":"<p>If you want to manually launch injector, you just have to install Python 3 and pip3 for dependencies:</p> <pre><code>$ apt install python3 python3-pip\n</code></pre> <p>Download the release of the injectors:</p> <pre><code>$ wget &lt;https://github.com/OpenBAS-Platform/injectors/archive/{RELEASE_VERSION}.zip&gt;\n$ unzip {RELEASE_VERSION}.zip\n$ cd injectors-{RELEASE_VERSION}/http-query/src/\n</code></pre> <p>Install dependencies and initialize the configuration:</p> <pre><code>$ pip3 install -r requirements.txt\n$ cp config.yml.sample config.yml\n</code></pre> <p>Change the <code>config.yml</code> content according to the parameters of the platform and of the targeted service and launch the injector:</p> <pre><code>$ python3 openbas_http.py\n</code></pre>"},{"location":"deployment/injectors/#injectors-status","title":"Injectors status","text":"<p>The injector status can be displayed in the dedicated section of the platform available in Integration &gt; injectors. You will be able to see the statistics of the RabbitMQ queue of the injector:</p> <p></p> <p>Problem</p> <p>If you encounter problems deploying OpenBAS or injectors, you can consult the troubleshooting page page.</p>"},{"location":"deployment/installation/","title":"Installation","text":"<p>All components of OpenBAS are shipped both as Docker images and manual installation packages.</p> <p>Production deployment</p> <p>For production deployment, we recommend to deploy all components in containers, including dependencies, using native cloud services or orchestration systems such as Kubernetes.</p> <ul> <li> <p> Use Docker</p> <p>Deploy OpenBAS using Docker and the default <code>docker-compose.yml</code> provided in the docker.</p> <p> Setup</p> </li> <li> <p> Manual installation</p> <p>Deploy dependencies and launch the platform manually using the packages released in the GitHub releases.</p> <p> Explore</p> </li> </ul>"},{"location":"deployment/installation/#using-docker","title":"Using Docker","text":""},{"location":"deployment/installation/#introduction","title":"Introduction","text":"<p>OpenBAS can be deployed using the docker-compose command.</p>"},{"location":"deployment/installation/#pre-requisites","title":"Pre-requisites","text":"<p> Linux</p> <pre><code>sudo apt install docker-compose\n</code></pre> <p> Windows and MacOS</p> <p>Just download the appropriate Docker for Desktop version for your operating system.</p>"},{"location":"deployment/installation/#clone-the-repository","title":"Clone the repository","text":"<p>Docker helpers are available in the Docker GitHub repository.</p> <pre><code>mkdir -p /path/to/your/app &amp;&amp; cd /path/to/your/app\ngit clone https://github.com/OpenBAS-Platform/docker.git\ncd docker\n</code></pre>"},{"location":"deployment/installation/#configure-the-environment","title":"Configure the environment","text":"<p>Before running the <code>docker-compose</code> command, the <code>caldera.yml</code> and <code>docker-compose.yml</code> file should be configured. By default, the <code>docker-compose.yml</code> file is using environment variables available in the file <code>.env.sample</code>.</p> <p>You can either rename the file <code>.env.sample</code> in <code>.env</code> and put the expected values or just fill directly the <code>docker-compose.yml</code> with the values corresponding to your environment.</p>"},{"location":"deployment/installation/#caldera","title":"Caldera","text":"<p>Unfortunately, Caldera does not support well environment variables, we have packaged it but the <code>caldera.yml</code> needs to be modified to change default API keys and passwords. Only change what is marked as Change this, listed below:</p> <p>Caldera application</p> <p>You will never be asked to go into Caldera directly because OpenBAS manages everything for you, so don't hesitate to put the same UUIDv4 in all parameters here.</p> <pre><code>users:\n  red:\n    red: ChangeMe                                                                     # Change this\n  blue:\n    blue: ChangeMe                                                                    # Change this\napi_key_red: ChangeMe                                                                 # Change this\napi_key_blue: ChangeMe                                                                # Change this\napi_key: ChangeMe                                                                     # Change this\ncrypt_salt: ChangeMe                                                                  # Change this\nencryption_key: ChangeMe                                                              # Change this\napp.contact.http: http://caldera.myopenbas.myorganization.com:8888                    # Change this\napp.contact.tunnel.ssh.user_password: ChangeMe                                        # Change this\n</code></pre>"},{"location":"deployment/installation/#docker-compose-env","title":"Docker compose env","text":"<p>Configuration static parameters</p> <p>The complete list of available static parameters is available in the configuration section.</p> <p>Whether you are using one method or the other, here are the mandatory parameters to fill:</p> <pre><code>POSTGRES_USER=ChangeMe\nPOSTGRES_PASSWORD=ChangeMe\nKEYSTORE_PASSWORD=ChangeMe\nMINIO_ROOT_USER=ChangeMeAccess\nMINIO_ROOT_PASSWORD=ChangeMeKey\nRABBITMQ_DEFAULT_USER=ChangeMe\nRABBITMQ_DEFAULT_PASS=ChangeMe\nSPRING_MAIL_HOST=smtp.changeme.com\nSPRING_MAIL_PORT=465\nSPRING_MAIL_USERNAME=ChangeMe@domain.com\nSPRING_MAIL_PASSWORD=ChangeMe\nOPENBAS_MAIL_IMAP_HOST=imap.changeme.com\nOPENBAS_MAIL_IMAP_PORT=993\nOPENBAS_ADMIN_EMAIL=ChangeMe\nOPENBAS_ADMIN_PASSWORD=ChangeMe\nOPENBAS_ADMIN_TOKEN=ChangeMe\nCALDERA_PUBLIC_URL=http://localhost:8888 # Change me for production deployment to something accessible from your endpoint(s)\nCALDERA_API_KEY=ChangeMe\nCOLLECTOR_MITRE_ATTACK_ID=3050d2a3-291d-44eb-8038-b4e7dd107436 # No need for change\n</code></pre> <p>Caldera public URL</p> <p>For production deployment, the Caldera public URL needs to be accessible from the machines where you would like to play breach and attack simulations scenarios.</p> <p>If your <code>docker-compose</code> deployment does not support <code>.env</code> files, just export all environment variables before launching the platform:</p> <pre><code>export $(cat .env | grep -v \"#\" | xargs)\n</code></pre>"},{"location":"deployment/installation/#persist-data","title":"Persist data","text":"<p>The default for OpenBAS data is to be persistent.</p> <p>In the <code>docker-compose.yml</code>, you will find at the end the list of necessary persistent volumes for the dependencies:</p> <pre><code>volumes:\n  esdata:     # ElasticSearch data\n  s3data:     # S3 bucket data\n  amqpdata:   # RabbitMQ data\n</code></pre>"},{"location":"deployment/installation/#run-openbas","title":"Run OpenBAS","text":""},{"location":"deployment/installation/#using-single-node-docker","title":"Using single node Docker","text":"<p>After changing your <code>.env</code> file run <code>docker-compose</code> in detached (-d) mode:</p> <pre><code>sudo systemctl start docker.service\n# Run docker-compose in detached \ndocker-compose up -d\n</code></pre>"},{"location":"deployment/installation/#using-docker-swarm","title":"Using Docker swarm","text":"<p>In order to have the best experience with Docker, we recommend using the Docker stack feature. In this mode you will have the capacity to easily scale your deployment.</p> <pre><code># If your virtual machine is not a part of a Swarm cluster, please use:\ndocker swarm init\n</code></pre> <p>Put your environment variables in <code>/etc/environment</code>:</p> <pre><code># If you already exported your variables to .env from above:\nsudo cat .env &gt;&gt; /etc/environment\nsudo bash -c 'cat .env &gt;&gt; /etc/environment\u2019\nsudo docker stack deploy --compose-file docker-compose.yml openbas\n</code></pre> <p>Installation done</p> <p>You can now go to http://localhost:8080 and log in with the credentials filled in your configuration.</p>"},{"location":"deployment/installation/#manual-installation","title":"Manual installation","text":""},{"location":"deployment/installation/#prepare-the-installation","title":"Prepare the installation","text":""},{"location":"deployment/installation/#installation-of-dependencies","title":"Installation of dependencies","text":"<p>You have to install all the needed dependencies for the main application including Caldera if you would like to play breach and attack simulation scenarios. The example below if for Ubuntu:</p> <pre><code>sudo apt install openjdk-22-jre \n</code></pre>"},{"location":"deployment/installation/#download-the-application-files","title":"Download the application files","text":"<p>First, you have to download and extract the latest release file.</p> <pre><code>mkdir /path/to/your/app &amp;&amp; cd /path/to/your/app\nwget &lt;https://github.com/OpenBAS-Platform/openbas/releases/download/{RELEASE_VERSION}/openbas-release-{RELEASE_VERSION}.tar.gz&gt;\ntar xvfz openbas-release-{RELEASE_VERSION}.tar.gz\n</code></pre>"},{"location":"deployment/installation/#install-the-main-platform","title":"Install the main platform","text":""},{"location":"deployment/installation/#configure-the-application","title":"Configure the application","text":"<p>The main application has just one environment configuration file to change.</p> <pre><code>cd openbas\n</code></pre> <p>Change the application.properties file according to your configuration of PostgreSQL, RabbitMQ, Minio and Caldera admin account and to your platform.</p>"},{"location":"deployment/installation/#start-the-application","title":"Start the application","text":"<p>Start the Application:</p> <pre><code>java -jar openbas-api.jar\n</code></pre> <p>Installation done</p> <p>You can now go to http://localhost:8080 and log in with the credentials configured in your <code>application.properties</code> file.</p>"},{"location":"deployment/installation/#deploy-behind-a-reverse-proxy","title":"Deploy behind a reverse proxy","text":"<p>If you want to use OpenBAS behind a reverse proxy with a context path, like <code>https://domain.com/openbas</code>, please change the <code>base_path</code> static parameter.</p> <ul> <li><code>APP__BASE_PATH=/openbas</code></li> </ul> <p>By default OpenBAS use websockets so don't forget to configure your proxy for this usage, an example with <code>Nginx</code>:</p> <pre><code>location / {\n    proxy_cache                 off;\n    proxy_buffering             off;\n    proxy_http_version          1.1;\n    proxy_set_header Upgrade    $http_upgrade;\n    proxy_set_header Connection \"upgrade\";\n    proxy_set_header Host       $host;\n    chunked_transfer_encoding   off;\n    proxy_pass                  http://YOUR_UPSTREAM_BACKEND;\n  }\n</code></pre>"},{"location":"deployment/installation/#additional-memory-information","title":"Additional memory information","text":"<p>OpenBAS platform is based on a JAVA runtime. The application needs at least 4GB of RAM to work properly.</p>"},{"location":"deployment/installation/#postgresql","title":"PostgreSQL","text":"<p>PostgreSQL is the main database of OpenBAS. You can find more information in the official PostgresQL documentation.</p>"},{"location":"deployment/installation/#minio","title":"MinIO","text":"<p>MinIO is a small process and does not require a high amount of memory. More information are available for Linux here on the Kernel tuning guide.</p>"},{"location":"deployment/integrations/","title":"Integrations","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"deployment/overview/","title":"Overview","text":"<p>Before starting the installation, let's discover how OpenBAS is working, which dependencies are needed and what are the minimal requirements to deploy it in production.</p>"},{"location":"deployment/overview/#architecture","title":"Architecture","text":"<p>The OpenBAS platform relies on several external databases and services in order to work.</p> <p></p>"},{"location":"deployment/overview/#platform","title":"Platform","text":"<p>The platform is the central part of the OpenBAS platform, allowing users to configure scenarios, simulations, atomic testings and all other components used in the context of breach and attack simulations and security validations.</p>"},{"location":"deployment/overview/#neutral-agents-executors","title":"Neutral agents / executors","text":"<p>Executors are embedded into the platform but you should configure at least one. It is the system that will be used to execute local injectors on endpoints. Currently we support Caldera (default) and Tanium but multiple will be added in the near future including a home-made XTM agent (by Filigran). </p> <p>Required executor</p> <p>Executors are responsible of executing endpoint payload injectors. To use them, you have to have at least one executor / neutral agent enabled. Injectors that require executors are marked in red in the OpenBAS Ecosystem. </p>"},{"location":"deployment/overview/#injectors","title":"Injectors","text":"<p>Injects are used to interact with third-party applications or services (including execution on the endpoints through executors) in the context of a simulation or an atomic testing. A few injectors are built-in but most of them are standalone Python processes. </p> <p>List of injectors</p> <p>You can find all currently available injectors in the OpenBAS Ecosystem.</p>"},{"location":"deployment/overview/#collectors","title":"Collectors","text":"<p>Collectors are used to connect to all security systems such as SIEMs, XDRs, EDRs, firewalls, mail gateways etc. to check if an inject (execution, emails, etc.) has been detected or prevented and fill the security posture. </p> <p>List of collectors</p> <p>You can find all currently available collectors in the OpenBAS Ecosystem.</p>"},{"location":"deployment/overview/#infrastructure-requirements","title":"Infrastructure requirements","text":""},{"location":"deployment/overview/#dependencies","title":"Dependencies","text":"Component Version CPU RAM Disk type Disk space PostgreSQL \u2265 16.0 2 cores \u2265 8GB SSD \u2265 16GB RabbitMQ &gt;= 3.11 1 core \u2265 512MB Standard \u2265 2GB S3 / MinIO \u2265 RELEASE.2023-02 1 core \u2265 128MB SSD \u2265 16GB"},{"location":"deployment/overview/#platform_1","title":"Platform","text":"Component CPU RAM Disk type Disk space OpenBAS Core 2 cores \u2265 8GB None (stateless) - Injector(s) 1 core \u2265 128MB None (stateless) - Collector(s) 1 core \u2265 128MB None (stateless) -"},{"location":"deployment/resources/","title":"Resources","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"deployment/troubleshooting/","title":"Troubleshooting","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"deployment/upgrade/","title":"Upgrade","text":"<p>Depending on your installation mode, upgrade path may change.</p> <p>Migrations</p> <p>The platform is taking care of all necessary underlying migrations in the databases if any, you can upgrade OpenBAS from any version to the latest one, including skipping multiple major releases.</p>"},{"location":"deployment/upgrade/#using-docker","title":"Using Docker","text":"<p>Before applying this procedure, please update your <code>docker-compose.yml</code> file with the new version number of container images.</p>"},{"location":"deployment/upgrade/#for-single-node-docker","title":"For single node Docker","text":"<pre><code>$ sudo docker-compose stop\n$ sudo docker-compose pull\n$ sudo docker-compose up -d\n</code></pre>"},{"location":"deployment/upgrade/#for-docker-swarm","title":"For Docker swarm","text":"<p>For each of services, you have to run the following command:</p> <pre><code>$ sudo docker service update --force service_name\n</code></pre>"},{"location":"deployment/upgrade/#manual-installation","title":"Manual installation","text":"<p>When upgrading the platform, you have to replace all files and restart the platform, the database migrations will be done automatically:</p> <pre><code>$ java -jar openbas-api.jar\n</code></pre>"},{"location":"development/api-usage/","title":"REST API","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"development/environment_ubuntu/","title":"Prerequisites Ubuntu","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"development/environment_windows/","title":"Prerequisites Windows","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"development/injectors/","title":"Injector development","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"development/platform/","title":"Platform development","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/assets/","title":"Assets","text":"<p>The Assets section provides users with a centralized hub for managing and organizing the entities targeted for testing and simulation. </p> <p>When you click on \u201cAssets\u201d in the left-hand banner, you see all the \u201cAssets\u201d pages. When accessing the Assets section, users are directed by default to the Endpoints page, where they can start managing their assets.</p> <p>From the <code>Assets</code> section, users can access the following pages:</p> <ul> <li><code>Endpoints</code>: Individual entities, representing any object or terminal that can be connected to a network.</li> <li><code>Asset groups</code>: Group of asset allowing you to organize endpoints into logical groups based on various filters applied by the user.</li> </ul>"},{"location":"usage/assets/#endpoints","title":"Endpoints","text":"<p>Endpoints encompass devices and systems that connect to a network, serving as the foundation for interaction with OpenBAS. </p> <p>The list of endpoints continues to grow with the changing landscape of networked technologies and the increasing interconnectivity of digital ecosystems. Below is a non-exhaustive list of terminal categories:</p> <ul> <li>Computers: This category encompasses a wide range of computing devices, including desktops, laptops, and servers deployed within organizational networks.</li> <li>Mobile devices: Smartphones and tablets represent another prominent category of endpoints, providing users with mobile access to network resources and services.</li> <li>Workstations: Workstations refer to terminals or dedicated machines utilized by individuals or groups to perform specific tasks or access networked resources. These systems are typically tailored to meet specific operational requirements and may include specialized software or configurations.</li> <li>IoT devices: The Internet of Things (IoT) encompasses a diverse array of interconnected devices and sensors. IoT endpoints include smart thermostats, cameras, environmental sensors, smart watches, and health tracking devices, among others.</li> </ul> <p>When accessing the Endpoints pages, you see the list of all endpoints imported in your platform. Here, users can create and manage details specific to each endpoint.</p> <p>Assets can be imported with the help of specific Collectors, like Microsoft Entra.</p> <p></p>"},{"location":"usage/assets/#asset-groups","title":"Asset groups","text":"<p>Asset groups serve as a mechanism for organizing and grouping related Endpoints. These groups are constructed based on filters that define the criteria for inclusion, allowing administrators to segment and categorize Endpoints based on common characteristics or attributes.</p> <p>When creating a new asset group, administrators have the flexibility to specify the filters that will delineate the group's membership. Currently, the platform offers a range of filters such as platform type, hostname, and IP addresses. We plan to extend the possibilities by including additional filters in future updates.</p> <p></p>"},{"location":"usage/atomic/","title":"Atomic testing","text":"<p>Under construction</p> <p>We are doing our best to complete this page.  If you want to participae, dont hesitate to join the Filigran Community on Slack  or submit your pull request on the Github doc repository.</p> <p>When clicking on Atomic testing in the left menu, you access to the list of all atomic testings ever launched in the platform.</p> <p>Atomic testing is a great way to simulate a singular attack technique you are particulary interested in, and test immediately your capability to prevent and detect it.</p> <p>You can search for a specific one by name.</p> <p>The presented list allows you to easily see global scores of all your recent atomic testings.</p> <p></p>"},{"location":"usage/atomic/#create-an-atomic-testing","title":"Create an Atomic testing","text":"<p>An atomic testing is essentially the simulation of a single inject, against a selection of targets (Players, Teams, Assets, Assets Group) with assorted expectations.</p> <p>By clicking on the + button at the bottom right of the screen, you enter the atomic testing creation workflow.</p> <p>On the left of the creation screen is the list of all available Inject you can play for atomic testing. Logos on the left of each line indicates which Injector is associated with each inject.</p> <p>Depending on your integrations, this list can be long. You can filter the list by compatible platforms or by Mitre Att&amp;ck tactics.By clicking on the \"Att&amp;CK\" logo near the search bar, you can also filter by selecting a precise Mitre Att&amp;ck techniques.</p> <p>When selecting an inject on the left, the form on the right populates itself with a by-default title and propose you to define when the inject should be played after the launch of the atomic testing. You can keep it to 0.</p> <p>By clicking on Inject content, you can define now or later the targeted assets or players, needed configurations, and the assorted expectations.</p> <p>The \"available variables\" button helps you to use already defined variables into compatible fields.</p>"},{"location":"usage/atomic/#atomic-testing-screens","title":"Atomic testing screens","text":"<p>Details of an Atomic testing is composed of three parts: - a header allowing to launch the test, see its state and update/delete it. - an Overview screen to eaily see the results of the test. - an execution details screen to see expectations of the test and investigate on execution logs</p>"},{"location":"usage/atomic/#overview","title":"Overview","text":"<p>The first screen displayed when you click on a specific Atomic testing from the list is a breakdown of your security posture against this test. </p> <p>As for Simulation and Scenario, Results are broken down into: - Prevention: the ability of your security posture to prevent the inject - Detection: the ability of your security posture to detect the inject - Human response: the ability of your security teams to react as intented facing the inject</p> <p>Big metrics on top of the screen sum up the expectations' result of all targets. </p> <p>The list of targets on the left allows you to easily see the result per Target, and for example investigate further why a specific Asset have failed the test.</p> <p>For a selected target, you can on the right the timeline of the test against the target and the assorted results. The result logs are also displayed.</p> <p></p>"},{"location":"usage/atomic/#execution-details","title":"Execution details","text":"<p>On this screen, you can retrieve details about the atomic testing and its expectations.</p> <p>You can also see the raw execution logs of the Injector responsible for the test execution.</p> <p></p>"},{"location":"usage/challenges/","title":"Challenges","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/channels/","title":"Channels","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p> <p>In OpenBAS, Channels represent communication medias with a particular look. There are used to present web articles or other media contents to Players in a specific way.</p> <p>It helps give shape to your Scenario context and events.</p>"},{"location":"usage/channels/#create-a-channel","title":"Create a Channel","text":"<p>First step is to click on the + button at the bottom right and give your new Channel a type (Newspaper, Microblogging, TV Channel), a name and a subtitle.</p> <p>Once done, click on the Channel in the list to access its overview. Here you can define how media content associated to this Chennel will be displayed to Players.</p> <p>You can define primary and secondary colors, choose logos and define how the header is presented.</p> <p>On the right, a mock up of the overview is displayed to give you the look and fill of it.</p> <p></p>"},{"location":"usage/channels/#use-a-channel","title":"Use a Channel","text":"<p>A Channel will then be used in Scenario and in Simulation definition. When you create an Article, you have to choose the Channel that will give it an adequate shape.</p> <p>See Media pressure page to know how to create and add Articles to your Scenarios.</p> <p></p>"},{"location":"usage/collector-caldera/","title":"Caldera collector","text":"<p>The integration between an OpenBAS instance and a Caldera instance allows you to enrich assets data.</p>"},{"location":"usage/collector-caldera/#configuration-variables","title":"Configuration variables","text":"<p>Below are the properties you'll need to set for OpenBAS:</p> Property application.properties Docker environment variable Mandatory Description Enable Caldera collector collector.caldera.enable <code>COLLECTOR.CALDERA.ENABLE</code> Yes Enable the Caldera collector. Collector ID collector.caldera.id <code>COLLECTOR.CALDERA.ID</code> Yes The ID of the collector. Caldera URL collector.caldera.url <code>COLLECTOR.CALDERA.URL</code> Yes The URL of the Caldera instance. Caldera API Key collector.caldera.api-key <code>COLLECTOR.CALDERA.API-KEY</code> Yes The API Key for the rest API of the Caldera instance. Caldera polling interval collector.caldera.interval <code>COLLECTOR.CALDERA.INTERVAL</code> No The time interval in seconds where the collect is triggered. Default is 60 seconds."},{"location":"usage/collector-caldera/#behavior","title":"Behavior","text":"<p>Each interval, a job retrieves the deployed agents on Caldera and populates the OpenBAS database by creating Assets.</p> <p>Deduplication is done thanks to the caldera <code>paw</code> property :</p> <ul> <li>if there is no asset on OpenBAS based on this <code>paw</code>, a new asset is created</li> <li>if there is an asset on OpenBAS based on this <code>paw</code> and the source of creation is only Caldera, this asset is updated</li> </ul> <p>There is no automatic deletion of OpenBAS assets if Caldera agents no longer exist.</p>"},{"location":"usage/collector-caldera/#mapping","title":"Mapping","text":"Agent Property Asset Property paw externalId paw name host_ip_addrs ips platform platform last_seen lastSeen"},{"location":"usage/collectors/","title":"Collectors","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/components/","title":"Components","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/documents/","title":"Documents","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/expectations/","title":"Expectations","text":"<p>Expectations define what is expected from an Asset (endpoint) or a Players when facing an Inject in terms of security posture. Each expectation has a score representing how well it has been met by the target.</p>"},{"location":"usage/expectations/#expectation-types","title":"Expectation types","text":"<p>Expectations can be categorized as either Manual or Automatic, depending on how they are validated.</p>"},{"location":"usage/expectations/#manual-expectations","title":"Manual expectations","text":"<p>Manual expectations require manual validation by the animation team, with the validation process and scoring managed manually. They are simple, customizable expectations to be manually validated.</p>"},{"location":"usage/expectations/#automatic-expectations","title":"Automatic expectations","text":"<p>Automatic expectations are validated automatically under specific conditions. Currently available automatic expectations include:</p> <ul> <li><code>Automatic - Prevention: Triggered when inject is processed</code>: automatically validated by security integration with compatible Collectors if the inject's action generates a prevention alert, such as quarantine.</li> <li><code>Automatic - Detection: Triggered when inject is processed</code>: automatically validated by security integration with compatible Collectors if the inject's action generates a detection alert, such as an incident.</li> <li><code>Automatic - Triggered when team reads articles</code>: Automatically validated when the article of a Media pressure inject has been read by targets.</li> </ul> <p>For injects targeting asset groups, some expectations can be validated in two modes:</p> <ul> <li>All assets (per group) must validate the expectation.</li> <li>At least one asset (per group) must validate the expectation.</li> </ul> <p>Special case: Publish Challenges inject </p> <p>The \"Publish Challenges\" inject doesn't require an expectation, as results are computed directly from Challenges' scores.</p>"},{"location":"usage/expectations/#expectation-manipulation","title":"Expectation manipulation","text":""},{"location":"usage/expectations/#add-an-expectation-to-an-inject","title":"Add an expectation to an inject","text":"<p>To add expectations to an inject, navigate to the inject's content and click on \"Add expectations\". From there, select the type of expectation you want to add and set a score for it.</p> <p>You can add multiple expectations to a single inject.</p>"},{"location":"usage/expectations/#validate-a-manual-expectation","title":"Validate a manual expectation","text":"<p>If you have configured manual expectations in your scenario, you will have the opportunity to handle manual validations during each simulation. During a Simulation, navigate to the Animation tab, under the Validation screen. Here, you'll find a list of expectations that require manual validation.</p>"},{"location":"usage/exports/","title":"Exports","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/getting-started/","title":"Getting started","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p> <p>This guide aims to give you a full overview of the OpenBAS features and workflows. The platform can be used in various contexts to handle Breach and Attack simulations at technical or strategical levels. OpenBAS has been designed as a part of the Filigran XTM suite and can be integrated with OpenCTI to generate meaningful attack scenario based on real threat. OpenBAS is result-oriented with many dashboard helping you to evaluate you securoty posture given a defined context.</p> <p>Here are some examples of use cases: - Designing attack scenario based on real threat - Evaluate your security posture against technical simulations on endpoints - Enhance team skills by evaluating them during simulations along with your security systems - Organize Capture The Flag with multiple challenges - Conduct atomic testing</p>"},{"location":"usage/getting-started/#home-screen","title":"Home screen","text":"<p>The Home screen gives any visitor on the OpenBAS platform an outlook on the live of the platform as well as an overview of your global security posture.</p>"},{"location":"usage/getting-started/#your-first-breach-and-attack-simulation","title":"Your first Breach and Attack Simulation","text":""},{"location":"usage/getting-started/#importing-players-and-assets-to-play-with","title":"Importing players and assets to play with","text":"<p>First, you need to import Players and Assets that will participate to the simulation and be targeted by technical or strategical events. To do so, you need to ...</p>"},{"location":"usage/getting-started/#integrate-with-simulation-agent-to-simulate-technical-events","title":"Integrate with Simulation Agent to simulate technical events","text":"<p>If you want to simulate attack at a technical level, you will need to install a Simulation Agent that will play technical events on your imported assets. To do so, you can go to the dedicated panel from the top right button and follow installation instructions. By default, Caldera is part of the OpenBAS stack.</p> <p></p> <p>The Caldera agent will allow you to play various technical events, based on the Mitre ATT&amp;CK matrix.</p>"},{"location":"usage/getting-started/#building-your-scenario","title":"Building your Scenario","text":"<p>Once integrations is done, you are ready to create your first Scenario! </p> <p>Scenarios act as template for your Breach and Attack simulations. After establihing such a template, you will be able to schedule it as a one shot simulation, or as a recurring one. </p> <ul> <li>First, go to the Scenarios menu and create a new one with the + button.</li> <li>Once done, define Teams that will be playing in this Scenario by going to the Definition/Teams tab</li> <li>Now go to the Injects tab and add some to build the serie of events that will define the core of your Scenario. If you want to stay strategical, you can select inject like \"Send individual mails\". If you want to go technical, you can select injects linked to attack pattern (Caldera integration allows you to play hundreds of them).</li> <li>Then, define who or what will be targeted by those injects, customize them, and define what is expected to happen. For example, you expect the targeted team to perform a specific action and the animation team will validated this expectation manually. Or, you expect the technical event to be prevented and it will be automatically checked through your integrations with your security systems.</li> <li>Do not forget to define when the inject is played in the scenario chronology.</li> </ul> <p>Optionnaly, you can buff up your scenario by adding Documents, Media pressures, or even CTF Challenges to your injects.</p>"},{"location":"usage/getting-started/#play-the-simulation","title":"Play the simulation","text":"<p>You can now schedule your Simulation by hitting the blue \"Simulate now\" button. Choose your moment and hit start.</p> <p>On time, a Simulation based on your Scenario template is generated. it is listed in your Scenario overview and in the Simulations menu. Fron there, you can follow the course of the Simulation and interact with it, for example to validate manual expectations.</p> <p>During the course of the simulation, results are updated and can be consulted in the Simulation overview.</p>"},{"location":"usage/getting-started/#evaluate-your-security-posture","title":"Evaluate your security posture","text":"<p>Results in OpenBAS are based on expectations' results that are linked to injects played during Simulations. It is then important to manually validate expectations that need it.</p> <p>Results are broken down by \"Prevention\", \"Detection\" and \"Human response\" metrics. - Prevention displays your ability to prevent the scenario's technical events to be completed - Detection displays your ability to detect the scenario's technical events - HUman response displays how well players and teams react as expected facing the scenario's events.</p>"},{"location":"usage/inject-caldera/","title":"Caldera injects","text":"<p>The Caldera framework, developed by MITRE, is a powerful framework designed to simulate cyberattacks. It enables security teams to conduct realistic and controlled simulations of adversary behavior, reducing the amount of time and resources needed for routine cybersecurity testing.</p>"},{"location":"usage/inject-caldera/#injects","title":"Injects","text":"<p>In OpenBAS, the Caldera framework has been fully integrated, offering users access to a comprehensive library of injects for conducting simulation exercises. With this integration, users can leverage the extensive capabilities of Caldera within OpenBAS.</p> <p>Caldera offers 1600+ abilities, covering the full range of ATT&amp;CK tactics and techniques. These capabilities equip security teams with an extensive toolkit to simulate various threats and assess defense mechanisms effectively.</p>"},{"location":"usage/inject-caldera/#behavior","title":"Behavior","text":"<p>Injects within the Caldera framework can be played on both individual Endpoints and Asset groups. Prior to playing injects, Caldera agents need to be installed on the target machines to enable interaction with the platform.</p> <p>Once the agents are deployed, simulations with Caldera injects can be executed. The platform will contact the agent to start the ability. Subsequently, the agents will report the results to OpenBAS. Below is the workflow illustrating the behavior of injects.</p> <p></p>"},{"location":"usage/inject-caldera/#configuration-variables","title":"Configuration variables","text":"<p>Below are the properties you'll need to set for OpenBAS:</p> Property application.properties Docker environment variable Mandatory Description Enable Caldera collector injector.caldera.enable <code>INJECTOR_CALDERA_ENABLE</code> Yes Enable the Caldera injector. Injector ID injector.caldera.id <code>INJECTOR_CALDERA_ID</code> Yes The ID of the injector. Collector IDs injector.caldera.collector-ids <code>INJECTOR_CALDERA_COLLECTOR_IDS</code> Yes The collector IDs compatible with the injection process. Caldera URL injector.caldera.url <code>INJECTOR_CALDERA_URL</code> Yes The URL of the Caldera instance. Caldera API Key injector.caldera.api-key <code>INJECTOR_CALDERA_API-KEY</code> Yes The API Key for the rest API of the Caldera instance."},{"location":"usage/injectors/","title":"Injectors","text":"<p>Injectors serve as the backbone of the platform, enabling essential integration and functionalities for conducting simulations and exercises effectively. These components empower administrators to orchestrate a diverse range of activities and responses during simulation scenarios. Some of them are built-in in the platform, and others are external integrations. </p> <p>Built-in injectors are seamlessly integrated into the platform, while external injectors require the deployment of additional systems alongside the platform to enable their functionality. Together, these injectors provide a comprehensive toolkit for administrators to design and execute simulations tailored to their specific objectives and requirements.</p>"},{"location":"usage/injectors/#injectors-list","title":"Injectors list","text":"<p>A multitude of injectors are available, each offering distinct capabilities and functionalities to enhance the simulation experience. Here is an overview of the existing injectors:</p> <ul> <li>Airbus CyberRange (Lade): Integration with the Airbus CyberRange platform, enabling seamless interaction and collaboration with CyberRange environments. For more information concerning CyberRange, please refer to the Airbus website.</li> <li>Caldera: Facilitates the use of the MITRE Caldera framework, empowering administrators to leverage advanced simulation capabilities. For more information concerning the Caldera injector, please refer to the dedicated documentation page.</li> <li>Challenges: Manages inject \"publish challenges\". To find more information more about this type of inject, please refer to the dedicated documentation section.</li> <li>Email: Manages the sending of injects' emails, enabling communication and dissemination of simulation-related information.</li> <li>HTTP query: Executes HTTP requests on external services, facilitating interactions with external systems. To find more information about the related inject, please refer to the dedicated documentation section.</li> <li>Manual: Platform functionality for creating manual action reminders, allowing administrators to prompt specific actions to be performed manually. To find more information about the related inject, please refer to the dedicated documentation section.</li> <li>Media pressure: Manages inject \"publish channel pressure\". To find more information about this type of inject, please refer to the dedicated documentation section.</li> <li>OVHCloud SMS Platform: Facilitates SMS messaging for injects, providing an additional communication channel for simulation participants.</li> <li>OpenCTI: Integration with an OpenCTI platform, enhancing simulation capabilities with access to threat intelligence and automatic scenario generation based on observed threat activities.</li> </ul> <p></p> <p></p>"},{"location":"usage/injectors/#agents","title":"Agents","text":"<p>For certain injectors, deploying an agent on the target machine is necessary to facilitate integration with OpenBAS. These agents are software programs that connect back to OpenBAS at certain intervals to get instructions.</p> <p>To access the agents and installation instructions, navigate to the dedicated page located in the top right-hand corner (button with the screen logo). </p> <p>Detailed guidance on installing the agents, along with downloadable packages, is provided on this page. Agents are available for various operating systems, including Windows, Linux, and MacOS, ensuring compatibility across different environments. </p> <p>As of now, only the Caldera injector requires the installation of an agent. This agent enables full integration with the MITRE Caldera framework, unlocking advanced simulation capabilities and enhancing the overall effectiveness of simulation exercises. Full details of the Caldera agent are available in the MITRE documentation.</p> <p></p>"},{"location":"usage/injects/","title":"Injects","text":"<p>Injects are fundamental elements of simulations within OpenBAS, each representing a discrete action to be executed during a Scenario. Managed and facilitated by various injectors, each inject type serves a distinct purpose, contributing to the comprehensive evaluation of defenses.</p> <p></p>"},{"location":"usage/injects/#create-an-inject","title":"Create an inject","text":"<p>Whether intended for Atomic testing or for a Simulation, the process for creating injects remains consistent within OpenBAS.</p> <p></p>"},{"location":"usage/injects/#for-atomic-testing","title":"For Atomic testing","text":"<p>To create an inject for atomic testing, navigate to the \"Atomic testing\" section located in the left-hand banner. Click on the \"+\" icon in the bottom right corner to initiate the inject creation process.</p>"},{"location":"usage/injects/#for-scenarios-and-simulations","title":"For Scenarios and Simulations","text":"<p>For injects intended for use within simulations, access the desired Scenario or Simulation and navigate to the \"Injects\" tab. Click on the \"+\" icon in the bottom right corner of the screen to open the inject creation panel.</p> <p>Note that an inject defined in a Scenario will be used in all the scenario's subsequent simulations. An Inject defined at the simulation level will not be replicated into the Scenario itself, thus it will not be replicated in future scenario's simulations.</p> <p></p>"},{"location":"usage/injects/#inject-creation-process","title":"Inject creation process","text":"<p>Once the inject creation panel is open, you can proceed to configure the inject according to your requirements. Key steps in the creation process include:</p>"},{"location":"usage/injects/#1-choose-the-type-of-inject","title":"1. Choose the type of inject","text":"<p>You first need to select an inject in the list of available ones (on the left of the creation screen). Logos on the left of each line indicates which Injector is associated with each inject. Depending on your integrations, this list can be long.</p> <p>To facilitate the selection into this possibly very long list, you can search injects by name and filter the list by selecting a precise MITRE ATT&amp;CK techniques for instance.</p>"},{"location":"usage/injects/#2-set-inject-parameters","title":"2. Set inject parameters","text":"<p>When selecting an inject on the left, the form on the right populates itself with a by-default title and propose you to define:</p> <ul> <li>Descriptive information: Fill in details such as the title, description, and relevant tags to categorize the inject effectively.</li> <li>Execution timing: If you are creating your inject in the context of a scenario or simulation, you have to set the timing for when the inject should be executed within the simulation timeline, ensuring it aligns with the overall scenario progression.</li> </ul> <p>By clicking on \"Inject content\", you can define now or later:</p> <ul> <li>Inject targets: Specify the targets for the inject, which may include players and teams or assets and assets groups depending on the inject chosen. </li> <li>Expectations: Define the expected outcomes or responses to the inject, outlining the desired actions or behaviors by players. </li> <li>Attachments: Attach any relevant documents or resources to provide additional context or information related to the inject. </li> <li>Additional fields: Depending on the type of Inject selected, you may have access to additional fields specific to that inject type. These fields may include the subject and body of an email, channel pressure settings for public communications, obfuscation options, and more.</li> </ul> <p>The \"available variables\" button helps you to use already defined variables into compatible fields.</p> <p></p> <p>By following these steps and providing the necessary information, you can create injects tailored to your specific testing or simulation objectives.</p>"},{"location":"usage/injects/#inject-types","title":"Inject types","text":"<p>There are different types of injector in OpenBAS.</p> <p></p>"},{"location":"usage/injects/#manual-action-reminders","title":"Manual action reminders","text":"<p>Manual action reminders are injects designed to prompt animation team to perform specific actions manually. It allows to place in the timeline a stimulus to be produced manually, outside the platform (e.g. simulated a call from a journalist on the switchboard telephone). These reminders ensure that critical tasks are completed as part of the simulation, enhancing the accuracy and realism of the exercise.</p> <p>The inject associated with this type is referred to as <code>Manual</code>.</p>"},{"location":"usage/injects/#direct-contact","title":"Direct contact","text":"<p>Injects for direct contact allow sending emails or SMS messages to players. These injects assess the organization's response to communication-based threats, such as phishing attempts, social engineering attacks, or emergency notifications. They can also assess crisis management, including responses to internal information requests or management pressure.</p> <p>Here's the list of injects linked to this category:</p> <ul> <li><code>Send a SMS</code>: enables sending SMS messages.</li> <li><code>Send individual mails</code>: enables sending emails to individuals separately.</li> <li><code>Send multi-recipients mail</code>: enables sending emails to a group of people (each recipient can see the other recipients).</li> </ul> <p></p>"},{"location":"usage/injects/#media-pressure","title":"Media pressure","text":"<p>Injects simulating public communications involve the publication of articles, social media posts, or other fake announcements. These injects replicate scenarios where public disclosure of information or events affects an organization's reputation or operational continuity.</p> <p>The inject associated with this type is referred to as <code>Publish channel pressure</code>.</p> <p></p>"},{"location":"usage/injects/#challenges","title":"Challenges","text":"<p>Challenge injects are set to test participants' skills and response capabilities by publishing challenges. These injects present scenarios or tasks that require active participation and problem-solving, allowing administrators to evaluate players.</p> <p>The inject associated with this type is referred to as <code>Publish challenges</code>.</p> <p></p>"},{"location":"usage/injects/#http-requests","title":"HTTP requests","text":"<p>HTTP request injects are used to forge HTTP requests to a third party services in order to perform actions outside the platform (e.g. API call to an EDR). These injects enable the platform to communicate with external services, gather information, or trigger specific actions via HTTP protocols.</p> <p>HTTP requests GET, POST, and PUT, can be sent. The corresponding injects are named <code>HTTP Request - \\&lt;request type&gt;</code>.</p> <p></p>"},{"location":"usage/injects/#integrations-with-agents-and-cyberranges","title":"Integrations with Agents and CyberRanges","text":"<p>Injects executed on remote systems are facilitated by Injectors like Caldera or Airbus CyberRange. These actions simulate real-world attack techniques, allowing administrators to gauge the effectiveness of their security posture in response to various technical actions attackers may take.</p> <p>There are over 1,700 such injects covering all the TTPs in the MITRE ATT&amp;CK matrix.</p>"},{"location":"usage/injects_and_expectations/","title":"Injects and Expectations","text":"<p>Evaluating security posture in OpenBAS is to confront events (aka Injects) with Expectations.</p>"},{"location":"usage/injects_and_expectations/#injects","title":"Injects","text":"<p>Threats are the results of actions by threat actors, and a combination of intent, capability and opportunity. In OpenBAS, simulating threats and their attack capabilities involves executing injects targeting players and assets.</p> <p>Injects can be technical, emulating action attackers might take on an endpoint, and non-technical, representing interactions with players or impactful contextual events during a crisis (such as media inquiries by phone following a data breach).</p> <p></p> <p></p>"},{"location":"usage/injects_and_expectations/#expectations","title":"Expectations","text":"<p>Each Inject is associated with Expectations. Expectations outline the anticipated outcomes from security systems and teams in response to attacker actions or contextual events.</p> <p>Expectations can be about:</p> <ul> <li>Prevention: ensuring that the security posture can prevent the attacker's actions.</li> <li>Detection: ensuring that the security posture can detect the attacker's actions.</li> <li>Human response: ensuring that teams react appropriately according to defined security processes.</li> </ul> <p>The collection and concatenation of expectations' results, broken down per type, allows to assess the security posture against a threat context. This provides insights to identify areas for improvement.</p>"},{"location":"usage/injects_builtin/","title":"Injects built-in","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/media_pressure/","title":"Media pressure","text":"<p>Under construction</p> <p>We are doing our best to complete this page.  If you want to participae, dont hesitate to join the Filigran Community on Slack  or submit your pull request on the Github doc repository.</p> <p>Media pressure are Articles or web contents you create to give more shape to your Scenario, or to simulate contextual pressure on your Teams and Players.</p> <p>For example, you can create an Article about the data leakage your organization is said to be affected by during the Scenario, and simulate its publishing by a large coverage media outlet with a \"Publish channel pressure\" inject.</p>"},{"location":"usage/media_pressure/#create-an-article","title":"Create an Article","text":"<p>To create an Article, go to the definition page of your Scenario or your Simulation and click on the + button near \"media pressure\". If you did not create Article yet, you can also click on the more visible \"Create an Article\" button.</p> <p>An media pressure Article is defined by: - Channel: the Channel template that will shape the article during the display to the Players. A Channel must have been defined in the platform. - Title - Author - Content: the content of your article. You can enrich the text and have a preview of the formatted result. You can also go fullscreen. - To simulate social network engagement, you can define number of comments, Shares and Likes of the Articles. - Documents: you can attach file to the Article. It can be useful if you want to simulate the publication of a large report you don't want to craft inside OpenBAS, like a pdf security report for example.</p> <p>Once created, Articles appears as cards in the definition screen of the Scenario or Simulation they have been created into. Note that if an article is not yet used in the Scenario or Simulation (probably because it does not have been used in a \"Publish channel pressure\" inject), it is mentioned into the Article's card.</p>"},{"location":"usage/media_pressure/#use-an-article-in-scenario-and-simulation","title":"Use an Article in Scenario and Simulation","text":"<p>To use an Article in a Scenario or Simulation, it must have been created in the context of the Scenario, the Simulation's parent Scenario or the Simulation itself.</p> <p>When you select an Inject, if it is compatible with media pressures, you can add a media pressure article to it.</p>"},{"location":"usage/mitigations/","title":"Mitigations","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/opencti_scenario/","title":"Scenario generation from OpenCTI","text":"<p>Creating a scenario can be a complex task, especially when aiming to build one that is meaningful and relevant to the specific threats facing your organization. To streamline this process and ensure that scenarios are closely aligned with your threat landscape, you can leverage the integration between OpenCTI and OpenBAS.</p> <p>When generating a scenario from OpenCTI, a scenario is created and can be accessed from the scenarios screen. The scenario name will include a reference to OpenCTI, indicating its origin. This scenario will automatically contain relevant sequences of injects based on the threat context identified in OpenCTI.</p> <p>However, it's important to review and potentially customize the scenario to ensure it meets your organization's specific requirements. Additionally, you'll need to select appropriate targets for the injects within the scenario.</p> <p>Once you've finalized the scenario, you can schedule your simulation as you would for any other scenario. The overall results of the simulation will also be available directly within OpenCTI, providing insights into the threat context upon which the scenario is based.</p>"},{"location":"usage/overview/","title":"Overview","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/payloads/","title":"Payloads","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/personas/","title":"Personas","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/playing/","title":"Playing","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/reports/","title":"Reports","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/scenario/","title":"Scenario","text":"<p>When clicking on Scenarios in the left menu, you access to the list of all Scenarios defined in the platform. Scenarios act as templates that translate threat contexts into meaningful events to simulate.</p> <p>Scenarios can be grouped by defining categories, main focus, severity and tags. It is then possible to filter the Scenarios list based on these attributes. Quick filters are available by default at the top of the screen to filter Scenario on most used categories.</p> <p>It is also possible to search Scenarios by their names using the search bar.</p>"},{"location":"usage/scenario/#create-a-scenario","title":"Create a scenario","text":"<p>To create a scenario, hit the + button on the bottom right of the screen and define general metadata that make sense for you. </p> <p>Once done, the scenario is accessible in the list. Click on it to see its details and define them.</p>"},{"location":"usage/scenario/#scenario-overview","title":"Scenario overview","text":"<p>The overview provides comprehensive information for evaluating your security posture against the threat context over time. It displays the scenario's context along with the results of the simulations played from it. Additionally, the list of these simulations is shown, allowing easy access to their specific details and results.</p> <p>If the scenario has never been simulated, the results' widget contains an example of how results will be displayed, and the list of simulations is replaced with an invitation to generate one.</p>"},{"location":"usage/scenario/#defining-a-scenario","title":"Defining a Scenario","text":"<p>To define the scenario, navigate to the \"Definition\" and \"Injects\" tabs.</p> <p>In the \"Definition\" tab, you can add various elements to construct events:</p> <ul> <li>Teams and Players involved in the scenario,</li> <li>Custom variables for simplifying injects' customization,</li> <li>Articles that you might use to simulate media pressure,</li> <li>Challenges designed for including Capture The Flag elements in your scenario.</li> </ul> <p>Once you have added all the elements you need, you can go to the \"Injects\" tab to begin to create the chain of events that will shape your scenario.</p> <p>By clicking on the + button at the bottom right of the screen, you enter the inject creation workflow.</p>"},{"location":"usage/scenario/#launching-a-simulation-of-the-scenario","title":"Launching a simulation of the scenario","text":"<p>Once you've finished defining your scenario, it's time to simulate it and evaluate your security posture!</p> <p>To do so, click the \"Simulate now\" button. You can choose to simulate this scenario as a one-time evaluation, scheduling it for a specific date and time. Additionally, you can set it to simulate recurrently to assess your posture over time. The results of each simulation will populate your scenario overview.</p> <p>A visual indication, located to the right of the scenario's title, provides a quick way to know if the scenario is currently being simulated.</p>"},{"location":"usage/scenario/#export-your-scenario","title":"Export your scenario","text":"<p>You can export your carefully crafted scenario as a JSON file by clicking the three-dots button at the top right of the scenario screen. This allows you to share it with others, or store it outside the platform.</p>"},{"location":"usage/scenarios_and_simulations/","title":"Scenarios and Simulations","text":"<p>In OpenBAS, the core concept to simulate attacks is based on the duo Scenario &amp; Simulation.</p>"},{"location":"usage/scenarios_and_simulations/#scenarios","title":"Scenarios","text":"<p>Scenario enable to translate a threat context, such as an attack or even a threat actor, into a meaningful sequence of events (referred to as injects), which can be technical or non-technical. This chronology of events can be enriched with associated documents or media articles to simulate the environment surrounding them.</p> <p>Within Scenarios, you also specify who participates, whether actual people (referred to as Players) or endpoints (referred to as Assets). They will be the targets of the events representing the threat.</p> <p>In order to translate real threats into Scenarios, it is possible to create them from OpenCTI data, such as Reports.</p>"},{"location":"usage/scenarios_and_simulations/#simulations","title":"Simulations","text":"<p>If a Scenario translates threat context into meaningful events, a Simulation serves as a means to evaluate your security posture against this threat context. </p> <p>By simulating a scenario with recurrence, you can evaluate your security posture over time in response to a threat context. Since simulations are always linked to their parent scenario, even if it evolves, you can: - assess your risk against evolving threats, - evaluate the effectiveness of your security governance in addressing your most relevant threats.</p>"},{"location":"usage/simulation/","title":"Simulation","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p> <p>When clicking on Simulations in the left menu, you access to the list of all Simulations ever launched in the platform. You can filter by tag (for example to only display simulation related to a specific threat actor) and sort them (chronologically, by status, etc.).</p> <p>From this screen, you can easily see last global scores and access ongoing Simulations at platform level.</p>"},{"location":"usage/simulation/#creating-a-simulation","title":"Creating a Simulation","text":"<p>The best practice to create a Simulation is to do it from a Scenario in order to evaluate your security posture over time against a specific threat context.</p> <p>But you can create directly a Simulation if you want, by hitting the + button on the bottom right of the screen. You will have similar definition options as in Scenario creation.</p>"},{"location":"usage/simulation/#simulation-overview","title":"Simulation overview","text":"<p>The Overview regroups everything you need to know to follow your Simulation by its Results. Results are broken down into 3 main metrics:</p> <ul> <li>Prevention: the ability of your security posture to prevent the simulated scenario's events to happen</li> <li>Detection: the ability of your security posture to detect the simulated scenario's events</li> <li>Human response: the ability of your security teams to react as intended facing the simulated scenario</li> </ul> <p>The top of the Simulation screen give you the ability to Start, stop and Reset the Simulation, delay the launch time.</p>"},{"location":"usage/simulation/#overriding-the-scenario-definition","title":"Overriding the Scenario definition","text":"<p>In a Simulation, you can see and modify all elements defining it: Teams and Players, Variables, Media pressure, Challenges, Injects. Modifying the Simulation definition allows you to customize it to adapt a singular play to some temporary changes. For example, change an email address into Variables to be used in email-related injects, change a playing team, etc.</p>"},{"location":"usage/simulation/#animating-a-simulation","title":"Animating a Simulation","text":"<p>The Animation screen of a Simulation is the place to follow the Simulation execution, especially if you are conducting simulation at strategical level (heavily relying on interactions with Teams and Players, manual validations of expectations) for training your organization on all aspects of a cyber crisis.</p> <p>The Timeline screen is the overview of the Animation tab, to see ongoing injects.</p> <p>The Mails screen is a way to manage email interaction with Players into the OpenBAS platform.</p> <p>The Validation screen is the place to manually validate expectations of the Simulation to consolidate Results.</p> <p>The Simulation logs is an interface for the animation team to collaborate during the Simulation.</p>"},{"location":"usage/simulation/#lessons-learned","title":"Lessons learned","text":"<p>In the Lesson Learned tab of a Simulation, you can manage the collection and concatenation of customizable surveys. It helps you in conducting the most underestimated part of a Breach and Attack simulation involving real people, by automating it and complete your Simulation's Results with qualitative feedback.</p>"},{"location":"usage/skills/","title":"Skills","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/systems/","title":"Systems","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/targets/","title":"Targets","text":"<p>When you are using an Inject, whether for Atomic testing, Scenario or Simulation, it's necessary to define the recipients, known as \"targets\", which could include Players, Teams, Assets (endpoints) or/and Asset groups it will be sent to. They are called \"targets\" of the inject.</p> <p>Note that certain injects can't target assets, while others can't target players. For instance, the \"Send individual mails\" inject can only target players and teams, not assets. </p> <p>Target selection is performed during inject creation or update.</p>"},{"location":"usage/targets/#selecting-players-and-teams","title":"Selecting Players and Teams","text":"<p>Directly targeting a player isn't yet possible. Instead, you must target a team. In scenarios or simulations, the team must be included in the scenario or simulation to be selectable. However, when creating atomic testing, all teams in the platform are selectable.</p> <p>Note that visibility of teams and players is limited by the organization's segregation.</p> <p>When selecting a team as the target, all players within that team will be targeted by the inject. Each player will have to complete expectations.</p>"},{"location":"usage/targets/#selecting-assets-endpoints-and-asset-groups","title":"Selecting Assets (endpoints) and Asset groups","text":"<p>You can target assets (endpoints) directly or asset groups. In the dedicated dialog, only assets compatible with the inject are listed by default.</p> <p>When selecting an asset group to target, all assets (endpoints) within the group will be targeted by the inject. Each one will have to complete expectations.</p>"},{"location":"usage/teams_and_players_and_organizations/","title":"Players, Teams and Organizations","text":"<p>Breach and Attack Simulation involves testing your security posture, and people are an essential part of it!</p> <p>Players, teams, and organizations are where you organize the human aspect of your security posture within OpenBAS (in the \"People\" section). These entities are the targets for injects during your simulations and atomic testings.</p> <p></p>"},{"location":"usage/teams_and_players_and_organizations/#players","title":"Players","text":"<p>Players are the users that may take part into your scenarios, to be tested against attack or contextual events (i.e. injects).</p> <p>Players can be created manually with the + button at the bottom right, but we encourage you to activate an integration allowing to import them from your IT environment, like with Microsoft Entra integration.</p> <p>Players are defined by:</p> <ul> <li>Email address,</li> <li>First name,</li> <li>Last name,</li> <li>Organization: to link a player to an organization (see below),</li> <li>Country,</li> <li>Phone number: necessary if you want to play SMS injects,</li> <li>PGP public key: necessary if you want to play encrypted email injects,</li> <li>Tags: if you want to sort them by custom categories.</li> </ul> <p>This list of players can be exported by clicking on the export button, at the top right of the players screen.</p>"},{"location":"usage/teams_and_players_and_organizations/#teams","title":"Teams","text":"<p>Teams group players into units that can be targeted by injects during simulations or atomic testing. They serve as a way to represent different security teams (e.g., CSIRT, SOC, VOC) and other relevant teams that might be involved into your scenario (e.g., legal department, communication department).</p> <p>Teams are defined by:</p> <ul> <li>Name,</li> <li>Description,</li> <li>Organization: to link a team to an organization (see below),</li> <li>Tags: if you want to sort them by custom categories.</li> </ul> <p>From the teams list, you can manage players by clicking on the three-dots inline button on the right and selecting \"Manage players.\" From there, you can view, update, or delete all the team's players and see their communication channels' state.</p> <p></p>"},{"location":"usage/teams_and_players_and_organizations/#organizations","title":"Organizations","text":"<p>Organization provides a straightforward method to segregate players and teams within the platform. A player associated with an organization, even with the required rights to animate and planned scenarios and simulations, will never see players and teams from other organizations.</p> <p>This feature can be particularly useful if you are using OpenBAS to plan and execute simulations for various companies or subsidiaries.</p>"},{"location":"usage/testing/","title":"Testing","text":"<p>Under construction</p> <p>We are doing our best to complete this page. If you want to participate, don't hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.</p>"},{"location":"usage/variables/","title":"Variables","text":""},{"location":"usage/variables/#built-in-variables","title":"Built-In Variables","text":"<p>Within certain injects, users can leverage a set of predefined built-in variables to dynamically customize content. These variables are designed to streamline the process of personalizing messages. Examples of built-in variables include but not limited to :</p> <ul> <li>${user.email}: Represents the email of the target user</li> <li>${exercise.name}: Represents the name of the current exercise</li> <li>${player_uri}: Represents the player interface platform link</li> </ul>"},{"location":"usage/variables/#custom-variables","title":"Custom Variables","text":"<p>In addition to the built-in variables, users can define their own variables within an exercise.</p> <p>To define custom variables :</p> <ol> <li>Select an exercise</li> <li>Navigate to the Definition tab</li> <li>Navigate to the Variables section</li> </ol> <p>In this section, users can create, update or delete custom variables. </p>"},{"location":"usage/variables/#limitation","title":"Limitation","text":"<p>To create custom variables, consider the following limitation:</p> <ul> <li>Only lowercase characters and <code>_</code> are authorized for the key value</li> <li>Variable value can only be string</li> </ul>"},{"location":"usage/variables/#use-variables","title":"Use Variables","text":"<p>These variables can be used to enhance personalization of certain stimuli within an exercise. Here is a non-exhaustive list of concerned stimuli : - Email sending - Sms sending</p> <p></p>"}]}
\ No newline at end of file
diff --git a/1.0.X/sitemap.xml b/1.0.X/sitemap.xml
index af68817..8b716b2 100755
--- a/1.0.X/sitemap.xml
+++ b/1.0.X/sitemap.xml
@@ -2,277 +2,277 @@
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
     <url>
          <loc>https://docs.openbas.io/latest/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/administration/enterprise/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/administration/introduction/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/administration/parameters/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/administration/policies/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/administration/users/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/deployment/authentication/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/deployment/clustering/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/deployment/collectors/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/deployment/configuration/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/deployment/injectors/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/deployment/installation/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/deployment/integrations/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/deployment/overview/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/deployment/resources/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/deployment/troubleshooting/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/deployment/upgrade/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/development/api-usage/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/development/environment_ubuntu/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/development/environment_windows/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/development/injectors/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/development/platform/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/assets/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/atomic/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/challenges/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/channels/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/collector-caldera/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/collectors/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/components/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/documents/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/expectations/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/exports/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/getting-started/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/inject-caldera/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/injectors/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/injects/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/injects_and_expectations/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/injects_builtin/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/media_pressure/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/mitigations/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/opencti_scenario/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/overview/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/payloads/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/personas/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/playing/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/reports/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/scenario/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/scenarios_and_simulations/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/simulation/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/skills/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/systems/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/targets/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/teams_and_players_and_organizations/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/testing/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://docs.openbas.io/latest/usage/variables/</loc>
-         <lastmod>2024-05-24</lastmod>
+         <lastmod>2024-05-28</lastmod>
          <changefreq>daily</changefreq>
     </url>
 </urlset>
\ No newline at end of file
diff --git a/1.0.X/sitemap.xml.gz b/1.0.X/sitemap.xml.gz
index 47b35dd1c362581e5515fc1d0f412a463d8c2d5f..9f20688d88567b6dace2ac1d62addb205712e587 100755
GIT binary patch
delta 126
zcmV-^0D=Gg1pNdDABzYGU;<T<2Oa~l0o{=(K3e<b<L<+@l^|FbIyuS1@>pyBIt=IY
zc`Z~iLY6g`aS(UZ2N_<3!)E<ux%;rtYf><euGcoO+f7<T)p&NgJYzb5tciyJ6{QZ_
gVVZQi2Bb#zySvTZr`6{3vB0$f2peXcd1xg7049PvNdN!<

delta 126
zcmV-^0D=Gg1pNdDABzYGV7yO}2Oa~_0o#!%K3dPq$K8i*D?zX>baIl1<+0ZMbr{a)
z^IE84ge+?=;~?&+4>G(6ht2xSa`$1O*Q8(`U9W9mx0|$xs`2b}dB$`ASrZQdDoP!;
g!!+r34M>gbcXyk+`_<;tvB0$f2(p+Tf@mcG0QWXMHUIzs