Skip to content

MITRE Caldera

MITRE Caldera is MITRE's open-source automated adversary-emulation platform. It lets authorised teams run controlled ATT&CK-aligned behaviours, observe how security controls respond, and preserve evidence for improvement and retesting.

Use only in an isolated, authorised environment

A MITRE Caldera ability executes a real command through an agent. Review every command, payload, target, privilege, cleanup action, and stop condition before starting an operation.

What MITRE Caldera does

1ConnectEnrol an authorised agent 2DesignSelect safe abilities 3EmulateRun a scoped operation 4ValidateCompare expected and actual evidence

An agent represents a connected test endpoint. An ability defines a platform-specific action. An adversary profile orders abilities, and an operation applies that profile to an explicitly selected agent group.

Choose your journey

01 · PrepareInstall MITRE Caldera

Choose a supported release, build the server, record credentials, and verify the web interface.

 02 · ConnectDeploy an agent

Generate a Sandcat command, enrol one authorised endpoint, and verify its status and executors.

 03 · DesignBuild a safe profile

Review abilities, executors, ATT&CK mappings, cleanup, and adversary ordering.

 04 · ValidateRun and explain an operation

Scope the target, observe links and output, export results, and document limitations.

How an operation moves through this lab

MITRE Caldera server Sandcat agent Approved ability Adversary profile Scoped operation Result evidence Improve and retest

Before you begin

  • Use dedicated virtual machines and an isolated network.
  • Snapshot the server and clients before installing agents.
  • Pin a supported MITRE Caldera release instead of cloning a moving branch.
  • Keep generated credentials and API tokens out of screenshots and notes.
  • Begin with harmless discovery actions such as hostname or process queries.
  • Never assume bundled or community abilities are safe for your environment.

Tested-guide boundary

The preserved screenshots demonstrate an earlier MITRE Caldera interface. Current releases may move controls or rename navigation items, but the core objects and workflow remain recognisable. Follow the official installation documentation for release-specific dependencies and compare your interface with the outcome described at each checkpoint.

Lab setup for proof of concept

MITRE Caldera proof-of-concept topology showing the server and authorised Linux and Windows clients

System Suggested role Starting allocation
Ubuntu server MITRE Caldera server and web interface 2 vCPU, 4 GB RAM, 40 GB disk
Ubuntu client Authorised Linux agent 2 vCPU, 4 GB RAM, 40 GB disk
Windows client Authorised Windows agent 2 vCPU, 4 GB RAM, 40 GB disk

Start with the server and one client. Add the second client only after the first agent, ability, operation, report, cleanup, and recovery checks succeed.

Where to go next

Continue learning