- Home
- Breach and Attack Simulation Software
- MITRE Caldera
MITRE Caldera
What it is
MITRE Caldera, also called Apache Caldera, is a free, open-source framework for automating adversary emulation and routine cybersecurity assessments. Built on MITRE ATT&CK, it uses adversary profiles to exercise defenses and train blue teams. Listed uses include autonomous emulation, detection and response platform testing, manual red-team work, and red-versus-blue research. Its core combines an asynchronous command-and-control server, REST API and web interface; plugins add capabilities such as Atomic Red Team techniques, operational technology support, ATT&CK visualizations, incident response, reporting and training. The default Sandcat agent is written in Go and supports cross-platform deployment, beaconing, instruction execution, payload downloads and file uploads. Caldera can be installed from source or deployed through Docker, including full and slim container variants, for on-premises use. The project lists Linux or macOS and Python 3.10 or later with pip, and recommends at least 8 GB RAM and 2 CPUs for the core framework. It advises running Caldera in a secure environment or network because the web interface has basic security features and is not hardened or thoroughly penetration-tested. Container data is ephemeral by default, and the Builder plugin does not work in Docker.
For and against
For
- Built on MITRE ATT&CK with adversary profiles
- Includes REST API and web interface
- Plugins cover OT, response, reporting and training
- Supports source installation and Docker deployment
- Free under Apache License 2.0
Against
- Web interface is not hardened or thoroughly penetration-tested
- Docker container data is ephemeral by default
- Builder plugin does not work in Docker
- Core requirements include Linux or macOS and Python 3.10+
The verdict
Caldera provides a plugin-based framework for emulation and assessment workflows, with source and Docker deployment options. Its security guidance and container limitations should factor into deployment planning.
Who it suits
It suits cybersecurity teams conducting adversary emulation, red-team work, detection and response testing, or blue-team training. Its deployment requirements and security caveats are important considerations.
Plans and prices
Apache Caldera
Open-source cybersecurity framework · Apache License 2.0
Read 5 Oct 2026 · caldera.apache.org
On the record
- Agent
- The default Sandcat agent is written in Go and supports cross-platform deployment, beaconing, instruction execution, payload downloads, and file uploads.caldera.readthedocs.io · read 5 Oct 2026
- Architecture
- The core includes an asynchronous command-and-control server, a REST API, and a web interface, with plugins that add functionality.github.com · read 5 Oct 2026
- ATT&CK
- Caldera is built on the MITRE ATT&CK framework and can use adversary profiles to test defenses and train blue teams.caldera.apache.org · read 5 Oct 2026
- Authentication
- Caldera supports login through its internal user mapping or LDAP, and its configuration can specify a custom login handler.caldera.readthedocs.io · read 5 Oct 2026
- Deployment
- The project documents installation from source and Docker deployment, including full and slim container variants.github.com · read 5 Oct 2026
- Host requirements
- The repository lists Linux or macOS, Python 3.10 or later with pip, and recommends at least 8 GB RAM and 2 CPUs for the core framework.github.com · read 5 Oct 2026
- Integrations
- The Atomic plugin imports tests from the open-source Red Canary Atomic tests repository.caldera.readthedocs.io · read 5 Oct 2026
- Notable limits
- The repository states that the Builder plugin does not work in Docker and that Caldera container data is ephemeral by default.github.com · read 5 Oct 2026
- OT support
- Caldera for OT plugins add support for common industrial protocols through collections of protocol-specific abilities.caldera.readthedocs.io · read 5 Oct 2026
- Plugins
- Team-maintained plugins include Atomic Red Team TTPs, Caldera for OT, ATT&CK visualizations, incident response, reporting, and training.github.com · read 5 Oct 2026
- Purpose
- Apache Caldera automates adversary emulation and routine cybersecurity assessments.caldera.apache.org · read 5 Oct 2026
- Security
- The project recommends running Caldera in a secure environment or network and says its web interface is not hardened or thoroughly penetration-tested and has only basic security features.github.com · read 5 Oct 2026
- Support and learning
- The project links to documentation, training, use cases, tutorial videos, a blog, Discord, and GitHub discussions.github.com · read 5 Oct 2026
- Use cases
- The project describes autonomous adversary emulation, detection and response platform testing, manual red-team engagements, and red-versus-blue research as use cases.caldera.apache.org · read 5 Oct 2026
