Automating Adversary Emulation with MITRE Caldera

[@pdath]

Love the new video format!

[@cloudnsec]

Cheers Phil!

[@Fanis_Theomak]

very interesting video, nice explanation. thank you.

[@cloudnsec]

Glad you liked it!

[@Fanis_Theomak]

@@cloudnsec i am trying to crate a custom ability and use the ability's output in a fact , how can i do that ? i scratched a little bit the parsers but i could not understand how they work , can you show a small briefing on how to generate a fact from a custom ability to use it in the next one in the operation ? thanks in advance

[@jayjoshi3853]

Thanks for the pretty detailed video.. I tried the same stuff on my side but for some reason my agent keeps showing me Dead,Trusted.. Checked the timezone for both the server and agent but same... Any reasons?

[@cloudnsec]

Unsure, it could be connectivity limitations or maybe something in the device hindering components from the agent?

[@jayjoshi3853]

@@cloudnsecChecked everything but unsure what was the issue. Ended up setting up new server in cloud and it worked like a charm. Thanks

[@amitshukla-ox1yt]

are there chances that some of the results were false positives too,,,if so how can we able to remove such false positives

[@cloudnsec]

The chance of getting false positives will always exist, and that's where our expertise comes in to help remove them! Tweaking and improving algorythms such as Machine Learning and other methods applied helps reduce false positives at the source.

[@umerfarooq-u2g]

best