DOCSEARCHbyAlgolia
Submit Docs

OpenAEV Platform Documentation

repository·main·Indexed 22 days ago

https://github.com/openaev-platform/openaev

An open-source platform for planning and conducting cyber adversary simulations, training, and exercises. OpenAEV integrates with OpenCTI for threat intelligence and features various communication injectors (Email, SMS via OVHCloud, Manual, Channel, and Challenge) to simulate real-world attack scenarios. The platform includes specialized collectors for vulnerability and expectation management, as well as integrations with CrowdStrike, Splunk, Microsoft Sentinel, and Microsoft Defender.

Tokens
101.9K
Snippets
127
Records
468
Agent score
82%

What's inside OpenAEV

  1. Overview of OpenAEV Platform

    main

    OpenAEV is an open-source platform designed for planning, scheduling, and conducting cyber adversary simulation campaigns and tests. It supports various simulation types, training, and exercises ranging from technical to strategic levels.

    Key capabilities include:

    • Simulation Modules: Scenarios, teams, simulations, verification of communication means, encryption, and more.
    • Threat Intelligence Integration: Provides security gap analysis using knowledge from the OpenCTI platform.
    • Collaborative Features: Real-time monitoring, statistics, and feedback management.
    • Inject Support: Integrates with various communication channels such as email, SMS, social media, and alarm systems via the OpenAEV ecosystem.

  2. Understand the OpenAEV Home screen overview

    main

    The Home screen in the OpenAEV platform provides a real-time snapshot of live activity and global security posture. It is composed of several widgets that visualize platform metrics, simulation history, and security coverage:

    • Metric cards: Displays counts of platform objects (e.g., simulations) created over the last 180 days (large metric) and the last 30 days (small metric).
    • Performance overview: Visualizes simulation inject expectations across three categories: prevention, detection, and human response.
    • Simulations: A bar chart showing simulation volume grouped by week based on start dates.
    • Top simulation categories: A polar chart aggregating simulations by their assigned categories.
    • Top attack patterns: A horizontal bar chart showing the most frequent attack patterns based on the number of associated injects.
    • Last simulations: A list of the six most recent simulations, sorted by start date.
    • MITRE ATT&CK Coverage: A matrix visualization showing which MITRE ATT&CK tactics and techniques have been covered by your simulation inject expectations.

  3. Enterprise Edition Features: Generative AI and Remediation

    main

    OpenAEV EE provides advanced capabilities for content generation and automated response:

    • Generative AI: Enables AI-driven content generation for tasks such as drafting emails or media pressure articles.
    • Remediations in CVES: Provides remediation capabilities integrated with CVES (Common Vulnerabilities and Exposures) and the Findings view.
    • Detection Remediation: Supports detection remediations within Threat Arsenal Actions and Injects and Atomic testing remediations.

  7. What is the Threat Arsenal?

    main

    The Threat Arsenal is the central management section in OpenAEV used to manage all Actions available for building injects.

    An Action defines the specific operation executed on a target, such as a shell command, an executable, a file drop, or a DNS resolution. Actions unify the concepts of Payloads and Injector Contracts into a single interface.

    Actions are categorized by their source:

    • User-created: Built from scratch via the Threat Arsenal interface (supported by the OpenAEV Implant Injector).
    • Injector-provided: Automatically inserted by integrated injectors (e.g., Nuclei). Users can only edit domains, attack patterns, and tags.
    • Collector-provided: Inserted by collectors (e.g., Atomic Red Team). These are read-only and managed entirely by the collector.

  8. What is the OpenAEV Agent?

    main

    The OpenAEV Agent is a Rust-based application designed to facilitate the enrollment of an Asset on the OpenAEV platform. Its primary responsibilities include:

    1. Asset Enrollment: Registering an Asset with the platform.
    2. Job/Script Retrieval: Fetching jobs or scripts that need to be executed.
    3. Instruction Transmission: Passing retrieved information to Implants for execution on the host Asset.

    Important Note: The Agent does not perform direct actions on the Asset. This design ensures neutrality regarding antivirus solutions and guarantees the full execution of simulations by delegating actual execution to Implants.

  9. What is the OpenAEV Integration Manager?

    main

    The OpenAEV Integration Manager is a deployment tool designed to simplify the management and deployment of external collectors, injectors, and executors within the platform.

    It is important to distinguish between connector types:

    • Built-in connectors: Natively integrated into the core platform.
      • Auto-start connectors: Automatically started and cannot be managed via the UI.
      • Standard built-in connectors: Automatically started but can be started or stopped by the user through the UI.
    • External connectors: These are deployed and configured by the user. The Integration Manager is specifically used to manage these external components.

  10. Organize assets using Asset Groups

    main

    Asset groups allow you to organize endpoints into logical segments based on shared characteristics. Groups are constructed using filters that define membership criteria.

    Supported Filters

    Currently, you can filter by:

    • Platform type
    • Hostname
    • IP addresses

    Administrators can specify these filters when creating a new asset group to automatically include or exclude endpoints.

  12. How OpenAEV handles database migrations

    main

    OpenAEV uses Flyway to manage database schema changes.

    • First-time setup: On the initial application boot, OpenAEV automatically creates the schema by executing all migration classes found in openaev-api/src/main/java/io/openaev/migration in lexicographical order.
    • Schema updates: To apply changes to an existing schema, you must add a new migration class that follows the lexicographical order (ranked at the end of the existing list).