AttackIQ CLI

attackiq run --scenario <s>

Executes an AttackIQ (BAS) scenario on the agents, validating detection coverage with the breach and attack simulation platform.

Run it in the purple team lab when you want validation with the BAS platform: AttackIQ launches the scenarios (ATT&CK techniques with their variations) on the deployed agents and measures coverage — detected, not detected, blocked — with per-technique detail. It's scale validation with the commercial platform: adversary scenarios executed and the coverage metric. In purple teaming, AttackIQ (and BAS in general) automate continuous validation: scenarios run periodically and coverage is measured without the manual effort of atomics.

Don't use it without the deployment: AttackIQ needs agents on endpoints and the platform — infrastructure is the requirement (and the license cost). The scenarios generate real techniques: the lab (or test segment) is the place. And watch out: the platform measures coverage of what it executes — library scenarios cover documented techniques; environment-specific ones require custom scenarios. The platform metric (the score) is interpreted with context: a blocked technique and a detected one are different coverages. For a reduced budget, open-source alternatives (Atomic, CALDERA, Prelude) cover the same ground.