Prelude Operator

operator → chain execute

Executes an attack chain with Prelude Operator (open-source BAS), validating detection coverage with the autonomous simulation platform.

Run it in the purple team lab when you want validation with the open-source BAS platform: Prelude Operator (from Prelude) launches attack chains (ATT&CK procedures with their variations) on agents and measures coverage — detected, not detected, blocked — with per-step detail. It's the open-source alternative to commercial BAS: adversary chains executed and coverage metric. In purple teaming, Prelude Operator is the autonomous validation platform: chains run, coverage is measured, and gaps are worked — without the commercial BAS license.

Don't use it without deployment: Prelude requires the server (Docker) and agents on endpoints — infrastructure is the requirement. Chains generate real attacks: the lab is the place. And note: the platform measures coverage of its procedures — environment-specific ones are defined in custom chains. The metric (detected vs. blocked) is interpreted with context. For individual validation, Atomic Red Team; Prelude Operator for the autonomous chain with the platform.