MITRE Caldera Adversary Emulation Platform

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Automated adversary emulation, ready in minutes

MITRE Caldera is an open source adversary emulation platform maintained by MITRE. It automates the work of a red team: you choose an adversary profile built from a library of abilities mapped to MITRE ATT&CK, Caldera plans the sequence, deploys agents to the hosts in scope, executes the steps and collects the results, giving security teams a repeatable way to test detection and response. Blue team plugins support the defensive side of the same exercise.

This image delivers Caldera fully installed and configured, so you have a working platform within minutes of launch instead of assembling a Python environment, the plugin set, the Go toolchain the agent compiler needs and a reverse proxy by hand.

## What ships in the image

• MITRE Caldera pinned to a release tag, with the stockpile ATT&CK mapped ability library and the prebuilt VueJS console
• A dedicated Python virtual environment and the Go toolchain the sandcat agent compiler requires
• An nginx reverse proxy on port 80 with HTTP Basic Authentication, and an unauthenticated health endpoint for load balancer probes
• systemd management for automatic restarts and clean logging, with unattended OS security updates enabled

## Hardened by default, because this is command and control

Caldera is command and control infrastructure: the server issues instructions that agents execute on target hosts. This image therefore ships closed. Upstream publishes default logins and API keys in its sample configuration; none of them exists in this image, and the platform will not accept any of them. On the first boot of every instance a one shot service generates seven fresh secrets unique to that instance, covering the reverse proxy gate, the red and blue accounts, both REST API keys, the encryption key and the salt, and writes them to a root only file. HTTP Basic Authentication is enforced at the reverse proxy across the console, the REST API, agent tasking, ability execution and file upload, so an unauthenticated visitor cannot reach the platform at all.

To keep offensive tooling out of the shipped image, the bundled precompiled attack payloads are removed for marketplace compliance; the full ability library, adversary profiles and on demand agent compilation are unaffected, and you can add your own payloads and abilities.

## No published command and control port

Caldera normally publishes six agent contact listeners on all interfaces. In this image every one of them is bound to the loopback interface, so a newly launched instance publishes no command and control port. Opening a contact for a real engagement is a deliberate, documented step, and the paired deployment guide covers it.

## Authorised use only

Use this platform only against systems you are explicitly authorised to test, and restrict the security group to your own source address before first use.

24/7 cloudimg support is included.

This is a repackaged open source software product with additional charges for cloudimg support services. Caldera and ATT&CK are trademarks of The MITRE Corporation. cloudimg is not affiliated with or endorsed by the Caldera project, MITRE, or their authors. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.