Caldera cheatsheet

MITRE Caldera is an open-source adversary emulation platform used for automated red team operations, blue team defense testing, and purple team exercises. It maps every action to MITRE ATT&CK techniques, making it ideal for structured security assessments.

• Runs autonomous adversary operations end-to-end
• Plugin-based architecture - extend with custom abilities, agents, and planners
• Provides a REST API for full programmatic control
• Supports Windows, Linux, and macOS targets
• Built-in reporting tied to ATT&CK navigator layers

# Clone and run with Docker
git clone https://github.com/mitre/caldera.git --recursive
cd caldera

# Build and start (includes all default plugins)
docker build -t caldera .
docker run -d -p 8888:8888 -p 7010:7010 -p 7012:7012 \
  --name caldera caldera

# Default credentials
# UI: http://localhost:8888
# Red:  admin / admin
# Blue: blue  / admin

# Verify server is running
curl -s http://localhost:8888/api/v2/health \
  -H "KEY:ADMIN123"

# Clone with all submodules (plugins)
git clone https://github.com/mitre/caldera.git --recursive
cd caldera

# Python 3.8+ required
pip install -r requirements.txt

# Start the server
python server.py --insecure --build

# Custom config: edit conf/local.yml
# Change default API keys, port, users

# conf/local.yml - key settings
port: 8888
api_key_red: ADMIN123
api_key_blue: BLUE123
users:
  admin:
    password: admin
  blue:
    password: admin
plugins:
  - stockpile
  - compass
  - sandcat
  - manx
  - response

• MITRE Caldera GitHub
• Caldera Documentation
• MITRE ATT&CK
• Caldera Training Plugin
• Stockpile Plugin
• ATT&CK Navigator

• Atomic Red Team (Unit test library for ATT&CK)
• Velociraptor (DFIR and threat hunting)
• Sigma (Detection rule standard)
• MITRE ATT&CK (Framework reference)
• Purple Team Toolkit (Purple team tools overview)
• Metasploit (Exploitation framework)