Core concepts
Understand how BlackNoise works
This page defines the objects you work with when building and running attack simulations, from the smallest unit, an event, up to a full simulation, then the connectors that bring detection data back, and the components that run attacks and receive them.
The simulation model
Event
A single technical action that reproduces an adversary behavior: a port scan, an attempt to gain unauthorized access to an account, the execution of a system command, a connection to a cloud service, and so on.
Every BlackNoise event is mapped to the MITRE ATT&CK framework, with a tactic and a technique ID.
Scenario
An ordered sequence of events that emulates a series of actions carried out by an attacker. A scenario can reproduce a complete attack pattern or a focused set of behaviors (APT, data breach, ransomware, etc.).
Catalog scenarios are built by the BlackNoise R&D team from real observed threats and a range of CTI sources. Beyond the catalog, you can build your own scenarios from the event library to match your environment or a specific threat, when this feature is included in your subscription.
Campaign
The application of a chosen scenario to a specific scope. The scenario acts as a template that generates the ordered list of events to run.
A campaign can contain several simulations. Its events and scope are fixed when the campaign is created and stay unchanged across all its simulations, so every replay tests exactly the same thing.
Simulation
A single execution of all the events in a campaign. Each simulation has its own parameters: which Attack Vector runs the events, an immediate or scheduled start, automatic or manual sequencing, and an optional delay between events.
Running several simulations in the same campaign lets you replay the identical test over time and track how your defenses evolve.
Connector
A connector is an optional module that links BlackNoise to one of your security tools (EDR, NDR, SIEM, etc.) to bring back what that tool detected while a simulation was running. The Attack Vector carries out the attacks; a connector observes how your defenses reacted.
You configure a connector once, then select it when you create a campaign. For each event, it provides a link that opens the tool pre-filtered on that event. For the connectors that support it, it also retrieves through the tool's API the detections recorded for the event. Depending on the detection qualification mode of the campaign, you use this data to qualify the detection yourself, or BlackNoise fills it in automatically. See Connectors for the available tools and how to configure them.
Execution components
Attack Vector
The component that executes the events (the offensive actions). It is deployed on your information system and carries out the technical actions within the campaign scope, following the configured settings.
It comes in two formats, software (a Docker container) or physical (the Stormblaster box), both operated from the web app, and it can run in varied environments: legacy infrastructure, cloud, industrial networks, and so on.
System Target
The machine that receives events executed at OS level: a physical or virtual server or workstation running Windows, Linux or macOS.
You create System Targets in the web app and assign them to a campaign, keeping full control over the test scope. During a simulation, the Attack Vector connects to each System Target to run the commands, programs or tools that reproduce attacker behavior.
For meaningful results, a System Target should be representative of your real defenses (EDR, antivirus, SIEM integration, etc.).
Full control, no silent propagation. System Targets ensure you keep complete control over the potential impact of executed events. Attacks never propagate automatically or without your control: the most sensitive operations run only against the machines you explicitly designate in the campaign scope.
Cloud Target
The cloud environment that receives events executed against cloud services. A Cloud Target is a Cloud environment, identified by its tenant and its subscription. It is the target of cloud scenarios, as System Targets are for system scenarios.
You create Cloud Targets in the web app, from the Cloud Targets page of the Resources section. During a simulation, the Attack Vector connects to the Cloud Target over HTTPS, with the identity of your tenant, and runs the cloud events there.
Technical diagram of the platform
With an on-premise deployment, the X-Engine runs inside the customer's information system.
Learn more
- How the campaign perimeter is defined — see the FAQ .
- How the Attack Vector connects to targets to execute events — see the FAQ .
- How to enable and test SSH, WinRM or WMI access to a Windows System Target — see Add a System Target.
- How to create a Cloud Target — see Add a Cloud Target .