Core concepts

Core concepts

Understand how BlackNoise works


This page defines the objects you work with when building and running attack simulations, from the smallest unit, an event, up to a full simulation, plus the two components that carry attacks out.


The simulation model

Event

A single technical action that reproduces an adversary behavior: a port scan, an attempt to gain unauthorized access to an account, the execution of a system command, a connection to a cloud service, and so on.
Every BlackNoise event is mapped to the MITRE ATT&CK framework, with a tactic and a technique ID.

Scenario

An ordered sequence of events that emulates a series of actions carried out by an attacker. A scenario can reproduce a complete attack pattern or a focused set of behaviors (APT, data breach, ransomware, etc.).
Catalog scenarios are built by the BlackNoise R&D team from real observed threats and a range of CTI sources. Beyond the catalog, you can build your own scenarios from the event library to match your environment or a specific threat, when this feature is included in your subscription.

Campaign

The application of a chosen scenario to a specific scope. The scenario acts as a template that generates the ordered list of events to run.
A campaign can contain several simulations. Its events and scope are fixed when the campaign is created and stay unchanged across all its simulations, so every replay tests exactly the same thing.

Simulation

A single execution of all the events in a campaign. Each simulation has its own parameters: which Attack Vector runs the events, an immediate or scheduled start, automatic or manual sequencing, and an optional delay between events.
Running several simulations in the same campaign lets you replay the identical test over time and track how your defenses evolve.



Execution components

Attack Vector

The component that executes the events (the offensive actions). It is deployed on your information system and carries out the technical actions within the campaign scope, following the configured settings.
It comes in two formats, software (a Docker container) or physical (the Stormblaster box), both operated from the web app, and it can run in varied environments: legacy infrastructure, cloud, industrial networks, and so on.

System Target

The machine that receives events executed at OS level: a physical or virtual server or workstation running Windows, Linux or macOS.
You create System Targets in the web app and assign them to a campaign, keeping full control over the test scope. During a simulation, the Attack Vector connects to each System Target to run the commands, programs or tools that reproduce attacker behavior.
For meaningful results, a System Target should be representative of your real defenses (EDR, antivirus, SIEM integration, etc.).
Full control, no silent propagation. System Targets ensure you keep complete control over the potential impact of executed events. Attacks never propagate automatically or without your control: the most sensitive operations run only against the machines you explicitly designate in the campaign scope.


Technical diagram of the platform



Learn more

  • How the campaign perimeter is defined — see the  FAQ .
  • How the Attack Vector connects to System Targets to execute events — see the  FAQ .
  • How to enable and test WinRM or WMI access to a Windows System Target — see  Add a System Target.