This page defines the objects you work with when building and running attack simulations, from the smallest unit, an event, up to a full simulation, plus the two components that carry attacks out.
A single technical action that reproduces an adversary behavior: a port scan, an attempt to gain unauthorized access to an account, the execution of a system command, a connection to a cloud service, and so on.
Every BlackNoise event is mapped to the framework, with a tactic and a technique ID.
An ordered sequence of events that emulates a series of actions carried out by an attacker. A scenario can reproduce a complete attack pattern or a focused set of behaviors (APT, data breach, ransomware, etc.).
Catalog scenarios are built by the BlackNoise R&D team from real observed threats and a range of CTI sources. Beyond the catalog, you can build your own scenarios from the event library to match your environment or a specific threat, when this feature is included in your subscription.
The application of a chosen scenario to a specific scope. The scenario acts as a that generates the ordered list of events to run.
A campaign can contain several simulations. Its events and scope are fixed when the campaign is created and stay unchanged across all its simulations, so every replay tests exactly the same thing.
A single execution of all the events in a campaign. Each simulation has its own parameters: which Attack Vector runs the events, an immediate or scheduled start, automatic or manual sequencing, and an optional delay between events.
Running several simulations in the same campaign lets you replay the identical test over time and track how your defenses evolve.
This sketch cannot currently be displayed in exports
The component that (the offensive actions). It is deployed on your information system and carries out the technical actions within the campaign scope, following the configured settings.
It comes in two formats, software (a Docker container) or physical (the Stormblaster box), both operated from the web app, and it can run in varied environments: legacy infrastructure, cloud, industrial networks, and so on.
The machine that : a physical or virtual server or workstation running Windows, Linux or macOS.
You create System Targets in the web app and assign them to a campaign, keeping full control over the test scope. During a simulation, the Attack Vector connects to each System Target to run the commands, programs or tools that reproduce attacker behavior.
For meaningful results, a System Target should be (EDR, antivirus, SIEM integration, etc.).
System Targets ensure you keep complete control over the potential impact of executed events. Attacks never propagate automatically or without your control: the most sensitive operations run only against the machines you explicitly designate in the campaign scope.
This sketch cannot currently be displayed in exports
High level diagram for the SaaS BlackNoise infra
- How the campaign perimeter is defined — see the FAQ .
- How the Attack Vector connects to System Targets to execute events — see the FAQ .
- How to enable and test WinRM or WMI access to a Windows System Target — see Add a System Target.