Conversation
There was a problem hiding this comment.
Pull request overview
This PR standardizes and expands the repository README to provide clearer context, installation steps, requirements, and basic usage guidance for the Atomic Caldera plugin.
Changes:
- Replaces the prior short README with expanded sections (overview, limitations, install, requirements, getting started).
- Adds step-by-step installation instructions and dependency notes.
- Adds UI/usage guidance and an additional note about
$PathToAtomicsFolderhandling.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| After clicking yes, it will then take some time for the abilities to complete reloading. NOTE: It is necessary to restart Caldera to view the new abilities. At the moment there is no way to force Chain to reload its database from the GUI. | ||
|
|
||
| ### Additional Note | ||
| - When importing tests from Atomic Red Team, this plugin also catches `$PathToAtomicsFolder` usages pointing to an existing file. It then imports the files as payloads and fix path usages. Note other usages are not handled. If a path with `$PathToAtomicsFolder` points to an existing directory or an unexisting file, we will not process it any further and ingest it "as it is". Examples of such usages below: |
There was a problem hiding this comment.
Typo: "unexisting file" should be "nonexistent file".
| - When importing tests from Atomic Red Team, this plugin also catches `$PathToAtomicsFolder` usages pointing to an existing file. It then imports the files as payloads and fix path usages. Note other usages are not handled. If a path with `$PathToAtomicsFolder` points to an existing directory or an unexisting file, we will not process it any further and ingest it "as it is". Examples of such usages below: | |
| - When importing tests from Atomic Red Team, this plugin also catches `$PathToAtomicsFolder` usages pointing to an existing file. It then imports the files as payloads and fix path usages. Note other usages are not handled. If a path with `$PathToAtomicsFolder` points to an existing directory or a nonexistent file, we will not process it any further and ingest it "as it is". Examples of such usages below: |
| After clicking yes, it will then take some time for the abilities to complete reloading. NOTE: It is necessary to restart Caldera to view the new abilities. At the moment there is no way to force Chain to reload its database from the GUI. | ||
|
|
||
| ### Additional Note | ||
| - When importing tests from Atomic Red Team, this plugin also catches `$PathToAtomicsFolder` usages pointing to an existing file. It then imports the files as payloads and fix path usages. Note other usages are not handled. If a path with `$PathToAtomicsFolder` points to an existing directory or an unexisting file, we will not process it any further and ingest it "as it is". Examples of such usages below: |
There was a problem hiding this comment.
Grammar: "It then imports the files as payloads and fix path usages" should use consistent verb agreement (e.g., "...and fixes path usages").
| - When importing tests from Atomic Red Team, this plugin also catches `$PathToAtomicsFolder` usages pointing to an existing file. It then imports the files as payloads and fix path usages. Note other usages are not handled. If a path with `$PathToAtomicsFolder` points to an existing directory or an unexisting file, we will not process it any further and ingest it "as it is". Examples of such usages below: | |
| - When importing tests from Atomic Red Team, this plugin also catches `$PathToAtomicsFolder` usages pointing to an existing file. It then imports the files as payloads and fixes path usages. Note other usages are not handled. If a path with `$PathToAtomicsFolder` points to an existing directory or an unexisting file, we will not process it any further and ingest it "as it is". Examples of such usages below: |
| -- https://github.com/redcanaryco/atomic-red-team/blob/a956d4640f9186a7bd36d16a63f6d39433af5f1d/atomics/T1022/T1022.yaml#L99 | ||
| -- https://github.com/redcanaryco/atomic-red-team/blob/ab0b391ac0d7b18f25cb17adb330309f92fa94e6/atomics/T1056/T1056.yaml#L24 No newline at end of file |
There was a problem hiding this comment.
The example links are prefixed with --, which won’t render as a Markdown list. Use a single - (or number them) so the examples are formatted consistently with the rest of the README.
| -- https://github.com/redcanaryco/atomic-red-team/blob/a956d4640f9186a7bd36d16a63f6d39433af5f1d/atomics/T1022/T1022.yaml#L99 | |
| -- https://github.com/redcanaryco/atomic-red-team/blob/ab0b391ac0d7b18f25cb17adb330309f92fa94e6/atomics/T1056/T1056.yaml#L24 | |
| - https://github.com/redcanaryco/atomic-red-team/blob/a956d4640f9186a7bd36d16a63f6d39433af5f1d/atomics/T1022/T1022.yaml#L99 | |
| - https://github.com/redcanaryco/atomic-red-team/blob/ab0b391ac0d7b18f25cb17adb330309f92fa94e6/atomics/T1056/T1056.yaml#L24 |
| ## Overview: | ||
|
|
||
| ## Details | ||
| The Atomic plugin converts Red Canary’s Atomic Red Team tests from their open-source GitHub repository into CALDERA abilities for granular ATT&CK simulation. |
There was a problem hiding this comment.
PR description marks this as a "New feature", but the diff only changes README content. Please update the PR type/checklist to reflect that this is documentation/standardization work (or add the corresponding code changes if a feature is intended).
| 1. Clone the repository to MITRE's Caldera "plugins" folder: | ||
| `cd <path to caldera/plugins>` | ||
| `git clone https://github.com/xenoscr/atomiccaldera.git` | ||
| 2. Change directories: | ||
| `cd atomiccaldera` | ||
| 3. Install required Python modules: | ||
| `pip install -r requirements.txt` | ||
| 4. Clone the Red Canary Atomic Red Team repository: | ||
| `git clone https://github.com/redcanaryco/atomic-red-team.git` | ||
| 5. Clone the MITRE CTI repository: | ||
| `git clone https://github.com/mitre/cti.git` | ||
| 6. Edit the `conf/artconf.yml` file to update the paths to point to your Atomic Red Team and CTI repositories. | ||
| 7. Edit Caldera's `local.yml` file and add `atomiccaldera` to the plugins section. |
There was a problem hiding this comment.
Installation instructions reference cloning xenoscr/atomiccaldera, cd atomiccaldera, and enabling atomiccaldera in Caldera, but this repository’s code uses the plugin path/name atomic (e.g., plugins/atomic/... in hook/tests). As written, users following these steps will likely enable the wrong plugin name or end up with the plugin in the wrong folder—please align the README commands and the local.yml plugin entry with the actual plugin directory/name used by this repo.
| `cd <path to caldera/plugins>` | ||
| `git clone https://github.com/xenoscr/atomiccaldera.git` | ||
| 2. Change directories: | ||
| `cd atomiccaldera` | ||
| 3. Install required Python modules: | ||
| `pip install -r requirements.txt` | ||
| 4. Clone the Red Canary Atomic Red Team repository: | ||
| `git clone https://github.com/redcanaryco/atomic-red-team.git` | ||
| 5. Clone the MITRE CTI repository: | ||
| `git clone https://github.com/mitre/cti.git` |
There was a problem hiding this comment.
The shell commands under the numbered Installation steps aren’t indented as part of the list items, so Markdown renderers will often break/reset the numbering. Consider formatting each step’s commands as an indented code block (or a fenced code block nested under the list item) so they render consistently.
| `cd <path to caldera/plugins>` | |
| `git clone https://github.com/xenoscr/atomiccaldera.git` | |
| 2. Change directories: | |
| `cd atomiccaldera` | |
| 3. Install required Python modules: | |
| `pip install -r requirements.txt` | |
| 4. Clone the Red Canary Atomic Red Team repository: | |
| `git clone https://github.com/redcanaryco/atomic-red-team.git` | |
| 5. Clone the MITRE CTI repository: | |
| `git clone https://github.com/mitre/cti.git` | |
| ```sh | |
| cd <path to caldera/plugins> | |
| git clone https://github.com/xenoscr/atomiccaldera.git |
-
Change directories:
cd atomiccaldera -
Install required Python modules:
pip install -r requirements.txt
-
Clone the Red Canary Atomic Red Team repository:
git clone https://github.com/redcanaryco/atomic-red-team.git
-
Clone the MITRE CTI repository:
git clone https://github.com/mitre/cti.git
|
|
||
| ## Dependencies/Requirements: | ||
|
|
||
| 1. Python 3.6.8+ with the following libraries installed: |
There was a problem hiding this comment.
README states Python 3.6.8+, but the repo’s CI/tox configuration runs on Python 3.8 (py38). Please update the documented minimum supported Python version to match what’s actually tested/supported (or adjust CI/tox if 3.6 is still intended to be supported).
| 1. Python 3.6.8+ with the following libraries installed: | |
| 1. Python 3.8+ with the following libraries installed: |
| Selecting an Ability | ||
| To select an ability: | ||
| 1. First select a tactic "Select ATT&CK tactic" drop down. | ||
| 2. Next select the ability from the "Select ability" drop down. | ||
|
|
||
| After you have selected an ability you can use the left and right arrows to quickly move through the list of available abilities related to the selected tactic. | ||
| Saving an Ability | ||
| If you have made changes to an ability and wish to save them: | ||
| 1. Click the "Save Ability" button. | ||
|
|
||
| Saving Variables | ||
| If you have made changes to variables and wish to save them: | ||
| 1. Click the "Save Variables" button. | ||
|
|
||
| Export a Single Ability | ||
| If you wish to export the selected ability only to Stockpile: | ||
| 1. Click the Export Ability button. | ||
|
|
||
| Export All Abilities | ||
| If you wish to export all of the abilities from Atomic Caldera to Stockpile: | ||
| 1. Click the Export All Abilities button. | ||
|
|
||
| Reloading Data (i.e. Start over) | ||
| If you wish to delete everything that has been imported and wish to start over, do so by: | ||
| 1. Click the Reload Abilities button | ||
| 2. Click the Yes button. |
There was a problem hiding this comment.
The Getting Started section uses literal tab characters after the list numbers (e.g., 1. First ...). Tabs can render inconsistently in Markdown; replace them with normal spaces and consider making "Selecting an Ability" a proper sub-heading for readability.
| Selecting an Ability | |
| To select an ability: | |
| 1. First select a tactic "Select ATT&CK tactic" drop down. | |
| 2. Next select the ability from the "Select ability" drop down. | |
| After you have selected an ability you can use the left and right arrows to quickly move through the list of available abilities related to the selected tactic. | |
| Saving an Ability | |
| If you have made changes to an ability and wish to save them: | |
| 1. Click the "Save Ability" button. | |
| Saving Variables | |
| If you have made changes to variables and wish to save them: | |
| 1. Click the "Save Variables" button. | |
| Export a Single Ability | |
| If you wish to export the selected ability only to Stockpile: | |
| 1. Click the Export Ability button. | |
| Export All Abilities | |
| If you wish to export all of the abilities from Atomic Caldera to Stockpile: | |
| 1. Click the Export All Abilities button. | |
| Reloading Data (i.e. Start over) | |
| If you wish to delete everything that has been imported and wish to start over, do so by: | |
| 1. Click the Reload Abilities button | |
| 2. Click the Yes button. | |
| ### Selecting an Ability | |
| To select an ability: | |
| 1. First select a tactic "Select ATT&CK tactic" drop down. | |
| 2. Next select the ability from the "Select ability" drop down. | |
| After you have selected an ability you can use the left and right arrows to quickly move through the list of available abilities related to the selected tactic. | |
| ### Saving an Ability | |
| If you have made changes to an ability and wish to save them: | |
| 1. Click the "Save Ability" button. | |
| ### Saving Variables | |
| If you have made changes to variables and wish to save them: | |
| 1. Click the "Save Variables" button. | |
| ### Export a Single Ability | |
| If you wish to export the selected ability only to Stockpile: | |
| 1. Click the Export Ability button. | |
| ### Export All Abilities | |
| If you wish to export all of the abilities from Atomic Caldera to Stockpile: | |
| 1. Click the Export All Abilities button. | |
| ### Reloading Data (i.e. Start over) | |
| If you wish to delete everything that has been imported and wish to start over, do so by: | |
| 1. Click the Reload Abilities button | |
| 2. Click the Yes button. |
Description
read me standardization and updates
Type of change
Please delete options that are not relevant.
How Has This Been Tested?
Please describe the tests that you ran to verify your changes.
Checklist: