CALDERA

Throughout the Threat Emulation Module, we have discussed and learned the fundamentals of threat emulation, from the core concepts to the execution of adversarial use cases. In this room, we will introduce an alternative tool for Atomic Red Team: CALDERA.

Learning Objectives

This room's main objective is to learn utilising the Caldera Framework from the perspective of Blue Teamers, understanding how exactly threat actors run their Tactics, Techniques and Procedures (TTPs) and how significant it is to see it in action. In addition, we will tackle topics such as the following throughout the room:

• Breakdown of CALDERA's core terminologies and functionalities.
• Application of planning and grouping of adversarial use cases.
• Automation of Incident Response via CALDERA.
  
• Implications of threat emulation to detection engineering.

Room Prerequisites

It is suggested to clear the following rooms first before proceeding with this room:

• Introduction to Threat Emulation
• Atomic Red Team
• Windows Event Logs
• Aurora

Now, let's start emulating threats using CALDERA!