Caldera

What it is

A platform that runs scripted adversary behavior through lightweight agents and a command server, so a team can replay known attacker techniques on a schedule.

What it helps with

- Building emulation plans from ATT&CK techniques and running them automatically
- Testing whether detections, logging, and response hold up against known behavior
- Extending the core with plugins for agents, reporting, and technique collections

Who it's for

Red teams, purple teams, and defenders emulating adversaries on networks they own or are authorized to assess.

Worth knowing

The core runs on Linux or macOS and serves a web console, with agents deployed to the hosts under test. The project moved to the Apache Incubator in 2026 and is now developed as Apache Caldera.

Can I drive it from other tools?
Yes. It exposes a REST API alongside the web interface.

Is there a hands-on way to learn it?
Yes. A built-in training plugin walks through a capture-the-flag style course.

Does it cover operational technology?
Yes. A plugin adds capabilities focused on ICS and OT environments.