#PurpleTeamSummit

Описание: The Splunk Attack range framework provides different tools to allow security analysts to test network, host and applications against a number of known adversarial TTPs based on MITRE ATT&CK framework. The Splunk Attack Range framework allows the security analyst to quickly and repeatedly replicate and generate data as close to "ground truth" as possible, in a format that allows the creation of detections, investigations, knowledge objects, and playbooks in Splunk Phantom.

This 2 hour workshop will provide attendants with access to Splunk Attack Ranges containing adversarial emulation engines (Caldera, Atomic Red Team), target machines and a Splunk server receiving attack data. Instructors will provide step by step instructions on where to get the code for the framework, how to build it and how to use it to simulate attacks, create detections and defense artifacts.

Class Format: Speaker will be on video, audio, and chat through Zoom.

Required Materials: Linux Distro - Kali Linux and your own computer with Virtual Machine Software to learn how to build your own attack range using your local systems, with scripts and extensive library, vagrant, ansible, terraform and more.

Speaker: Jose Hernandez
Speaker: Rod Soto

https://www.splunk.com/en_us/blog/sec...