CALDERA operation

caldera → operation Run

Launches an autonomous operation in CALDERA, executing the adversary profile on deployed agents to validate detection coverage.

Use it in the purple team lab when you want to validate detection with a full operation: CALDERA (from MITRE) deploys agents (sandcat) on endpoints and the operation executes the adversary profile (the sequence of techniques with their variations) against them — the team verifies what was detected for each step. It is automated validation: the full adversary operation (access, execution, movement, persistence) in one pass, with telemetry logged per step. In purple teaming, CALDERA is the operations framework: the profile is chosen, the operation is launched, and coverage is measured per technique.

Do not use it without deployment: CALDERA needs agents on endpoints and the server — without the agent, there is no operation. The operation with default profiles (APT29, etc.) executes real techniques: the lab is the place. And note: the operation is automated — scope control (profile techniques, hosts) is defined beforehand; a broad profile on many hosts generates noise and load. Step-by-step verification requires telemetry to the SIEM. CALDERA validates detection, not prevention: a step executed without an alert is a valid result. Clean up agents and artifacts when finished.