Apache Caldera (Incubating)

Caldera provides a modular platform for modeling, scripting, and executing adversary behavior. It allows users to construct emulation plans, provides agents for communicating with the command and control server, and enables users to evaluate security detections in a structured, scalable, and repeatable way. With the use of plug-ins and community-contributed features, Caldera supports a range of use cases including adversary emulation, purple teaming, detection engineering, and continuous security validation. Using Caldera, defenders can emulate known threat actor behavior and perform other red team activity to evaluate their organization’s defensive capabilities, test analytics, and find detection gaps. As a modular tool based on the MITRE ATT&CK framework, Caldera is designed to be extensible, intelligence-driven, and automation-friendly.