Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/administration/enterprise.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ specified in the GitHub license file:

- The OpenAEV Community Edition is licensed under the Apache License, Version 2.0 (the “Apache License”).
- The OpenAEV Enterprise Edition is licensed under the OpenAEV Enterprise Edition License (the “Enterprise Edition
Licensee”).
License”).

The source files in this repository have a header indicating which license they are under. If no such header is
provided, this means that the file belongs to the Community Edition under the Apache License, Version 2.0.
Expand All @@ -30,7 +30,7 @@ can [generate a trial license](https://filigran.io/enterprise-editions-trial/).
As a reminder:

- Filigran is the only company producing and providing OpenAEV Enterprise Edition license keys.
- Filigran can provide free-to-use OpenAEV Enterprise Edition licenses for development and research purposes (e.g. connector development purposes, integrations with technical partners, etc...) as well as for non-governmental charity organizations.
- Filigran can provide free-to-use OpenAEV Enterprise Edition licenses for development and research purposes (e.g. connector development, integrations with technical partners, etc...) as well as for non-governmental charity organizations.
- OpenAEV Enterprise Edition licenses are automatically provided to all Filigran SaaS customers.
- **For all other usages including On-Premise deployments, OpenAEV Enterprise Edition is reserved to organizations that have signed a Filigran Enterprise agreement.**

Expand Down
2 changes: 1 addition & 1 deletion docs/administration/taxonomies.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ and responding to threats.

OpenAEV supports the following kill chain models:

- **MITRE ATT&CK Framework (Entreprise, PRE, Mobile and ICS)**
- **MITRE ATT&CK Framework (Enterprise, PRE, Mobile and ICS)**

You can add, edit, or delete kill chain phases in the settings page, and assign them to attack patterns in the platform.
Additionally, you can filter data by kill chains phases, visualize relationships between kill chain phases and
Expand Down
4 changes: 2 additions & 2 deletions docs/deployment/authentication.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,15 +12,15 @@ This documentation provides details on setting up and utilizing the authenticati

### Local users

OpenAEV use this strategy as the default, but it's not the one we recommend for security reasons.
OpenAEV uses this strategy as the default, but it's not the one we recommend for security reasons.

| Parameter | Environment variable | Default value | Description |
|:--------------------------|:--------------------------|:----------------------|:--------------------------------------------------------------|
| openaev.auth-local-enable | OPENAEV_AUTH-LOCAL-ENABLE | true | Set this to `true` to enable username/password authentication. |

### OpenID

This method allows to use the [OpenID Connect Protocol](https://openid.net/connect) to handle the authentication.
This method allows using the [OpenID Connect Protocol](https://openid.net/connect) to handle the authentication.

| Parameter | Environment variable | Default value | Description |
|:-------------------------------|:---------------------------|:----------------------|:--------------------------------------------------------------|
Expand Down
4 changes: 2 additions & 2 deletions docs/deployment/configuration.md
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ certificates in the folder are public PEM-armoured (*.pem), DER-encoded X509 cer
|:------------------------------------|:------------------------------------|:--------------|:--------------------------------------------------------------------------------------------------------------------------------------|
| openaev.xtm.opencti.enable | OPENAEV_XTM_OPENCTI_ENABLE | false | Enable integration with OpenCTI |
| openaev.xtm.opencti.url | OPENAEV_XTM_OPENCTI_URL | | OpenCTI URL |
| openaev.xtm.opencti.api_url | OPENAEV_XTM_OPENCTI_API_URL | | OpenCTI API URL, it will completly override the OpenCTI URL, otherwise the default url will be `openaev.xtm.opencti.url` + '/graphql' |
| openaev.xtm.opencti.api_url | OPENAEV_XTM_OPENCTI_API_URL | | OpenCTI API URL, it will completely override the OpenCTI URL, otherwise the default url will be `openaev.xtm.opencti.url` + '/graphql' |
| openaev.xtm.opencti.token | OPENAEV_XTM_OPENCTI_TOKEN | | OpenCTI token |
| openaev.xtm.opencti.disable-display | OPENAEV_XTM_OPENCTI_DISABLE-DISPLAY | `false` | Disable OpenCTI in the UI |

Expand Down Expand Up @@ -108,7 +108,7 @@ certificates in the folder are public PEM-armoured (*.pem), DER-encoded X509 cer
| engine.engine-selector | ENGINE_ENGINE_SELECTOR | elk | Engine to use for storage and search (`elk` for ElasticSearch and `opensearch` for OpenSearch) |
| engine.url | ENGINE_URL | http://localhost:9200 | URL of the ElasticSearch database |
| engine.username | ENGINE_USERNAME | | This parameter is optional. Login for the database |
| engine.password | ENGINE_PASSWORD | | This parameter is optional. Password for the dat |
| engine.password | ENGINE_PASSWORD | | This parameter is optional. Password for the database |

If you switch your engine selector, you’ll need to delete the `indexing_status` table in PostgreSQL to trigger a full
reindex.
Expand Down
2 changes: 1 addition & 1 deletion docs/deployment/ecosystem/collectors.md
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ $ docker compose up
```

### Manual deployment
If you want to manually launch collector without docker, you just have to install Python 3 and pip3 for dependencies:
If you want to manually launch a collector without docker, you just have to install Python 3 and pip3 for dependencies:

```
$ apt install python3 python3-pip
Expand Down
2 changes: 1 addition & 1 deletion docs/deployment/ecosystem/executors.md
Original file line number Diff line number Diff line change
Expand Up @@ -395,7 +395,7 @@ Endpoint on the OpenAEV endpoint page.
---
## Caldera Agent

The Caldera agent can be leveraged to execute implants as detached processes that will the execute payloads according to
The Caldera agent can be leveraged to execute implants as detached processes that will then execute payloads according to
the [OpenAEV architecture](https://docs.openaev.io/latest/deployment/overview/#architecture).

!!! note "Caldera already installed"
Expand Down
4 changes: 2 additions & 2 deletions docs/deployment/ecosystem/injectors.md
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ For instance, to enable the HTTP query injector, you can add a new service to yo
Note: Injector images and available versions can be found on Docker Hub.

##### Launch a standalone collector
To launch standalone injector, you can use the `docker-compose.yml` file of the injector itself. Just download the latest [release](https://github.com/OpenAEV-Platform/injectors/releases) and start the injector:
To launch a standalone injector, you can use the `docker-compose.yml` file of the injector itself. Just download the latest [release](https://github.com/OpenAEV-Platform/injectors/releases) and start the injector:

```
$ wget https://github.com/OpenAEV-Platform/injectors/archive/{RELEASE_VERSION}.zip
Expand Down Expand Up @@ -111,7 +111,7 @@ $ python3 openaev_http.py

#### Configuration

All external injectors have to be able to access the OpenAEV API. To allow this connection, they have 2 mandatory configuration parameters, the `OPENAEV_URL` and the `OPENAEV_TOKEN`. In addition to these 2 parameters, injectors have other mandatory parameters that need to be set in order to get them work.
All external injectors have to be able to access the OpenAEV API. To allow this connection, they have 2 mandatory configuration parameters, the `OPENAEV_URL` and the `OPENAEV_TOKEN`. In addition to these 2 parameters, injectors have other mandatory parameters that need to be set in order to make them work.

!!! info "Injector tokens"

Expand Down
4 changes: 2 additions & 2 deletions docs/deployment/ecosystem/integration-manager/overview.md
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ To learn more about Xtm Composer architecture, refer to the [dedicated documenta

- **Built-in connectors**: Connectors which are internally implemented.
This category includes:
- **Auto-start connectors**, which are natively integrated into the core platform no additional deployment required. These connectors are automatically started and cannot be managed on the UI, even though they are still visible in the dedicated pages.
- **Auto-start connectors**, which are natively integrated into the core platform no additional deployment required. These connectors are automatically started and cannot be managed on the UI, even though they are still visible in the dedicated pages.
- **Standard built-in connectors**, which are also automatically started but can be started and stopped by the user through the UI.
- **External connectors**: These are deployed and configured by the user.
In the catalog, only external connectors can be retrieved. The following sections focus on how to deploy, configure, and manage these **external** connectors.
Expand Down Expand Up @@ -74,7 +74,7 @@ To learn more about Xtm Composer architecture, refer to the [dedicated documenta

- Different injector, collector or executor types are identified in the catalog:
- External : Injector, collector or executor managed by the integration manager
- built-in : Injector, collector or executor natively integrated into the core platform no additional deployment required
- built-in : Injector, collector or executor natively integrated into the core platform no additional deployment required
- Instances statuses:
- Managed instances: *Started* or *Stopped*.
- Only **managed instances** can be started/stopped from the UI. They are also the only ones that provide logs in the interface.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -331,6 +331,6 @@ If you continue to experience issues:
1. **Check the logs** with debug level enabled
2. **Review the configuration** for any misconfigurations
3. **Verify network connectivity** between all components
4. **Consult the openAEV community** for additional support
4. **Consult the OpenAEV community** for additional support

For bug reports and feature requests, visit the [GitHub repository](https://github.com/FiligranHQ/xtm-composer.git).
2 changes: 1 addition & 1 deletion docs/deployment/installation.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ manual [installation packages](https://github.com/OpenAEV-Platform/openaev/relea
---

Deploy OpenAEV using Docker and the default `docker-compose.yml` provided
in the [docker](https://github.com/OpenAEV-Platform/docker).
in the [docker repository](https://github.com/OpenAEV-Platform/docker).

[:octicons-arrow-right-24:{ .middle } Setup](#using-docker)

Expand Down
2 changes: 1 addition & 1 deletion docs/development/collectors.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@

### Introduction

This guide explains how to implement an **OpenAEV collector for a EDR/XDR**, to retrieve security events and compare
This guide explains how to implement an **OpenAEV collector for an EDR/XDR**, to retrieve security events and compare
them against injected expectations in OpenAEV.

### Prerequisites
Expand Down
2 changes: 1 addition & 1 deletion docs/development/injectors.md
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ internally to access the parameter values.
#### 2. Define the internal logic

The next step is to implement the internal logic based on the parameters defined in the contract.
When the inject executes an inject based on its contract, it will retrieve the parameters provided by the end user and
When the injector executes an inject based on its contract, it will retrieve the parameters provided by the end user and
use them within its internal logic to perform the necessary actions.

### Use it
Expand Down
2 changes: 1 addition & 1 deletion docs/development/translations.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ You can find translations management scripts in the package.json file.
- extract-translation : will fetch all the files and add new translations keys in en.json
- auto-translation:fr : will translate all the elements of the en.json in french and add them in the fr.json
- auto-translation:cn : will translate all the elements of the en.json in chinese and add them in the zh.json
- auto-translation: all : will translate all the elements of the en.json in all the app's supoorted languages and add them in the respective files
- auto-translation:all : will translate all the elements of the en.json in all the app's supported languages and add them in the respective files
- sort-translation : will sort the translation files

You can generate your subscription key on Deepl and add it in the configurations of your scripts in your IDE. You need to add the subscription key for auto-translation:all, auto-translation:fr and auto-translation:cn.
Expand Down
2 changes: 1 addition & 1 deletion docs/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ Welcome to the OpenAEV Documentation space. Here you will be able to find all do

## Introduction

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests.
OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaigns and tests.

!!! tip "Docker deployment of the full XTM suite (OpenCTI - OpenAEV - OpenGRC)"

Expand Down
3 changes: 1 addition & 2 deletions docs/reference/apis/filters.md
Original file line number Diff line number Diff line change
Expand Up @@ -39,8 +39,7 @@ click, changing the logic of your filtering.

## Filters format

The OpenAEV platform uses a filter format called `FilterGroup`. The `FilterGroup` model enables
to do complex filters imbrication with different boolean operators, which extends greatly the filtering capabilities in
The OpenAEV platform uses a filter format called `FilterGroup`. The `FilterGroup` model enables complex filter nesting with different boolean operators, which extends greatly the filtering capabilities in
every part of the platform.

### Structure
Expand Down
8 changes: 4 additions & 4 deletions docs/usage/atomic.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
When clicking on Atomic testing in the left menu, you access to the list of all atomic testings ever launched in the
platform.

Atomic testing is a great way to simulate a singular attack technique you are particulary interested in, and test
Atomic testing is a great way to simulate a singular attack technique you are particularly interested in, and test
immediately your capability to prevent and detect it.

The presented list allows you to easily see global scores of all your recent atomic testings.
Expand All @@ -20,12 +20,12 @@ Assets, Assets Group) with assorted expectations.

By clicking on the + button at the bottom right of the screen, you enter the atomic testing creation workflow.

On the left of the creation screen is the list of all available Inject you can play for atomic testing. Logos on the
On the left of the creation screen is the list of all available injects you can play for atomic testing. Logos on the
left of each line indicates which Injector is associated with each inject.

Depending on your integrations, this list can be long. You can filter the list by kill chain phase, injector, compatible
platforms or Mitre Att&ck tactics.By clicking on the "Att&CK" logo near the search bar, you can also filter by selecting
a precise Mitre Att&ck techniques.
platforms or MITRE ATT&CK tactics. By clicking on the "Att&CK" logo near the search bar, you can also filter by selecting
a precise MITRE ATT&CK techniques.

When selecting an inject on the left, the form on the right populates itself with a by-default title and propose you to
define when the inject should be played after the launch of the atomic testing. You can keep it to 0.
Expand Down
4 changes: 2 additions & 2 deletions docs/usage/components/channels.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,11 @@ It helps give shape to your Scenario context and events.

First step is to click on the + button at the bottom right and give your new Channel a type (Newspaper, Microblogging, TV Channel), a name and a subtitle.

Once done, click on the Channel in the list to access its overview. Here you can define how media content associated to this Chennel will be displayed to Players.
Once done, click on the Channel in the list to access its overview. Here you can define how media content associated to this Channel will be displayed to Players.

You can define primary and secondary colors, choose logos and define how the header is presented.

On the right, a mock up of the overview is displayed to give you the look and fill of it.
On the right, a mock up of the overview is displayed to give you the look and feel of it.

![Channel creation](./assets/channel-update.png)

Expand Down
6 changes: 3 additions & 3 deletions docs/usage/components/media-pressure.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@
!!! tip "Under construction"

We are doing our best to complete this page.
If you want to participae, dont hesitate to join the [Filigran Community on Slack](https://community.filigran.io)
If you want to participate, don't hesitate to join the [Filigran Community on Slack](https://community.filigran.io)
or submit your pull request on the [Github doc repository](https://github.com/OpenAEV-Platform/docs).


Media pressure are Articles or web contents you create to give more shape to your Scenario, or to simulate contextual pressure on your Teams and Players.
Media pressure consists of articles or web contents you create to give more shape to your Scenario, or to simulate contextual pressure on your Teams and Players.

For example, you can create an Article about the data leakage your organization is said to be affected by during the Scenario, and simulate its publishing by a large coverage media outlet with a "Publish channel pressure" inject.

Expand All @@ -23,7 +23,7 @@ A media pressure Article is defined by:
- To simulate social network engagement, you can define number of comments, Shares and Likes of the Articles.
- Documents: you can attach file to the Article. It can be useful if you want to simulate the publication of a large report you don't want to craft inside OpenAEV, like a pdf security report for example.

Once created, Articles appears as cards in the definition screen of the Scenario or Simulation they have been created into. Note that if an article is not yet used in the Scenario or Simulation (probably because it does not have been used in a "Publish channel pressure" inject), it is mentioned into the Article's card.
Once created, Articles appears as cards in the definition screen of the Scenario or Simulation they have been created into. Note that if an article is not yet used in the Scenario or Simulation (probably because it has not been used in a "Publish channel pressure" inject), it is mentioned into the Article's card.

<!-- Capture of the Article creation screen -->

Expand Down
4 changes: 2 additions & 2 deletions docs/usage/dashboards/custom-dashboards/custom-dashboards.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ From the left menu, you can choose the custom dashboards option to see all the c

**Actions panel**

You can realise actions on a dashboard using the button located at the end of each line:
You can perform actions on a dashboard using the button located at the end of each line:

- update
- delete
Expand Down Expand Up @@ -68,5 +68,5 @@ last year. The default value for this parameter is **last three months**.

!!! note

When the **All time** time range is set, datas are displayed without any time limit. When the **Custom range** is set,
When the **All time** time range is set, data is displayed without any time limit. When the **Custom range** is set,
two more pickers are displayed, allowing the user to choose a start date and an end date.
2 changes: 1 addition & 1 deletion docs/usage/dashboards/widgets/widgets.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ Parameters allow further customization of your widget. Based on the selected vis
- Set the widget title
- Choose which elements to display from the filtered dataset
- Select the data reference date
- Select a time range for the datas
- Select a time range for the data
- Configure additional settings specific to each visualization type

Two mode are available:
Expand Down
2 changes: 1 addition & 1 deletion docs/usage/getting-started.md
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ Imagine you deployed an OpenAEV agent on a Linux endpoint named `endpoint-lin-01

```
echo "OpenAEV Atomic Test"
````
```

### Step 2 — Build the inject

Expand Down
2 changes: 1 addition & 1 deletion docs/usage/inject-overview.md
Original file line number Diff line number Diff line change
Expand Up @@ -235,7 +235,7 @@ compute the agent status.

**Alert Details**

Once an inject have been executed, it is possible to access the alerts' details on the different security platforms
Once an inject has been executed, it is possible to access the alerts' details on the different security platforms
(SIEM or EDR) linked to the EDRs present on the tested assets.

![Inject execution traces details](assets/inject-expectation-traces-1.png)
Expand Down
Loading