Unlike the other projects here, this repo's README is documentation-only — architecture diagrams and API references, no UI screenshots. The numbers below are real and pulled directly from the repository's own conformance tests, not marketing copy.
What it answers
A purple-team emulation range that replays real adversary playbooks so you can answer the only question that matters: would we actually have caught this? It loads ATT&CK-mapped TTPs, runs scenario DAGs through a FastAPI orchestrator and beaconing agents, and exports Sigma coverage, telemetry fixtures, and SIEM-ready payloads.
Project scale
Scenario library composition
| Source | Count |
|---|---|
| Classic YAML scenarios | 11 |
| Generated YAML scenarios | 2,500 |
| Emulation-plan scenarios (Atomic Red Team-derived) | 11 |
| Validated actor-chain scenarios (fixture-backed, with SOC golden events) | 1,000 |
| SOC golden event rows | 2,000 |
| Generable scenario variant space | 15,680,015,680 |
Architecture
Scenario YAML or a generated variant flows through a loader, into a DAG-aware planner, onto a SQLite execution queue with a signed task descriptor. A beacon agent or local runner executes the registered TTP simulation, producing synthetic telemetry and markers, mapped to Sigma/ECS/OCSF and SIEM query exports. The planner also writes a hash-chained audit log for every action, and the queue tracks cleanup and retry state independently.
Safety model
- Dry-run parameters enabled by default for generated scenarios.
- Marker-only TTPs produce benign telemetry and cleanup metadata — nothing destructive.
- A central safety policy blocks higher-risk modes unless explicitly allowed.
- The orchestrator has a killswitch endpoint and a file-based stop condition.
- Public SIEM URLs require an explicit
allow_external=trueflag — localhost and private-network lab URLs are allowed by default, nothing external by accident.
Enterprise readiness surfaces
Beyond the core simulation engine, the project also models what it would take to run this in a real organization: 11 lab validation tracks (Windows AD, Linux fleet, AWS, Azure, GCP, Kubernetes, SaaS/Identity, Splunk, Elastic, Sentinel, Chronicle), 8 hardening areas (TTP quality, fleet ops, import fidelity, cloud sandbox, secret backends, performance, compliance, public proof), OIDC/JWKS RBAC with viewer/operator/admin roles, and a 25-area Platform Readiness scorecard with a downloadable benchmark bundle.
Testing discipline
Conformance tests assert exact counts, not approximations: TTP count is exactly 5,064, loaded scenario count exactly 3,522, ATT&CK tactic coverage exactly 15/15 with drift-sync status checked — the README's own numbers are tested against the running implementation, not just written down.