Attack Range Config

attack_range.yml

attack_range.yml is the configuration file for Attack Range. Attack Range reads first the default configuration file located in configs/attack_range_default.yml and then the attack_range.yml (or the config which you specify with the -c parameter). The parameters in attack_range.yml override the parameters in configs/attack_range_default.yml.

attack_range_default.yml

The attack_range_default.yml defines all default values for the Attack Range. The following file contains some comments to describe the different parameters:

general:
  attack_range_password: "Pl3ase-k1Ll-me:p"
# Attack Range Master Password for all accounts in Attack Range.

  cloud_provider: "aws"
# Cloud Provider: aws/azure/local

  key_name: "attack-range-key-pair"
# The key name is the name of the AWS key pair and at the same time an unique identifier for Attack Ranges.

  attack_range_name: "ar"
# Attack range Name let you build multiple Attack Ranges by changing this parameter.

  ip_whitelist: "0.0.0.0/0"
# Blocks from which Attack Range machines can be reached.
# This allow comma-separated blocks
# ip_whitelist = 0.0.0.0/0,35.153.82.195/32

  version: "3.0.0"
# The current released version of Attack Range.

  use_prebuilt_images_with_packer: "0"
# Enable/Disable usage of packer to create pre-built images by setting this to 1 or 0.

  crowdstrike_falcon: "0"
# Enable/Disable Crowdstrike Falcon by setting this to 1 or 0.

  crowdstrike_agent_name: "WindowsSensor.exe"
  crowdstrike_customer_ID: ""
  crowdstrike_logs_region: ""
  crowdstrike_logs_access_key_id: ""
  crowdstrike_logs_secret_access_key: ""
  crowdstrike_logs_sqs_url: ""
# All these fields are needed to automatically deploy a Crowdstrike Agent and ingest Crowdstrike Falcon logs into the Splunk Server.
# See the chapter Crowdstrike Falcon in the docs page Attack Range Features.

  carbon_black_cloud: "0"
# Enable/Disable VMWare Carbon Black Cloud by setting this to 1 or 0.

  carbon_black_cloud_agent_name: "installer_vista_win7_win8-64-3.8.0.627.msi"
  carbon_black_cloud_company_code: ""
  carbon_black_cloud_s3_bucket: ""
# All these fields are needed to automatically deploy a Carbon Black Agent and ingest Carbon Black logs into the Splunk Server.
# See the chapter Carbon Black in the docs page Attack Range Features.

  install_contentctl: "0"
# Install contentctl packages on linux hosts

aws:
  region: "us-west-2"
# Region used in AWS. This should be the same as the region configured in AWS CLI.

  private_key_path: "~/.ssh/id_rsa"
# Path to your private key. This needs to match the public key uploaded to AWS.

  cloudtrail: "0"
# Enable/Disable collection of Cloudtrail logs by setting this to 1 or 0.

  cloudtrail_sqs_queue: "https://sqs.us-west-2.amazonaws.com/111111111111/cloudtrail-cloud-attack-range"
# Cloudtrail SQS queue. See the chapter AWS Cloudtrail in the docs page Attack Range Cloud.

  use_elastic_ips: "1"
# Enable/disable usage of Elastic IPs by setting this to 1 or 0.

azure:
  location: "West Europe"
# Region used in Azure.

  subscription_id: "xxx"
# Azure subscription ID.

  private_key_path: "~/.ssh/id_rsa"
# Path to your private key.

  public_key_path: "~/.ssh/id_rsa.pub"
# Path to your public key.

  azure_logging: "0"
# Enable/Disable Azure logs and onboard them into the Splunk Server by setting this to 1 or 0.

  client_id: "xxx"
  client_secret: "xxx"
  tenant_id: "xxx"
  event_hub_name: "xxx"
  event_hub_host_name: "xxx"
# All these fields are needed to configure the Azure logs. See the chapter Azure Logs in the docs page Attack Range Cloud.

local:
  provider: "Virtual Box"
# Attack Range Local used Virtualbox and Vagrant to build the Attack Range.

splunk_server:
  splunk_image: "splunk-v3-0-0"
# Name of the image of the Splunk Server. Packer is used to build this image.

  install_es: "0"
# Enable/Disable Enterprise Security by setting this to 1 or 0.

  splunk_es_app: "splunk-enterprise-security_701.spl"
# File name of the Enterprise Security spl file. Needs to be located in the apps folder.

  s3_bucket_url: "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com"
# S3 bucket containing the Splunk Apps which will be installed in Attack Range.

  splunk_url: "https://download.splunk.com/products/splunk/releases/9.0.2/linux/splunk-9.0.2-17e00c557dc1-Linux-x86_64.tgz"
# Url to download Splunk Enterprise.

  splunk_uf_url: "https://download.splunk.com/products/universalforwarder/releases/9.0.2/linux/splunkforwarder-9.0.2-17e00c557dc1-linux-2.6-amd64.deb"
# Url to download Splunk Universal Forwarder Linux.

  splunk_uf_win_url: "https://download.splunk.com/products/universalforwarder/releases/9.0.2/windows/splunkforwarder-9.0.2-17e00c557dc1-x64-release.msi"
# Url to download Splunk Universal Forwarder Windows.

  byo_splunk: "0"
# Enable/Disable Bring your own Splunk by setting this to 1 or 0.

  byo_splunk_ip: ""
# Specify Splunk IP address when you enable BYO Splunk.

  ingest_bots3_data: "0"
# Ingest BOTS data to Attack Range.

  install_dltk: "0"
# Install Deep Learning Toolkit.

phantom_server:
  phantom_server: "0"
# Enable/Disable Phantom Server by setting this to 1 or 0.

  phantom_image: "phantom-v3-0-0"
# name of the image of the Phantom Server. Packer is used to build this images.

  phantom_community_username: user
# Specify the username needed to login to my.phantom.us to download Phantom.
# This must be changed to a real username.
# You can register at https://www.splunk.com/en_us/download/soar-free-trial.html.

  phantom_community_password: password
# Specify the password used to login to my.phantom.us to download Phantom.
# This must be changed to a real password.
# You can register at https://www.splunk.com/en_us/download/soar-free-trial.html.

  phantom_repo_url: https://repo.phantom.us/phantom/5.2/base/7/x86_64/phantom_repo-5.2.1.78411-1.x86_64.rpm
# Specify the Phantom install RPM.

  phantom_version: "5.2.1.78411-1"
# Fields the Phantom Version.

  phantom_byo: "0"
# Enable/Disable Bring your own Phantom by setting this to 1 or 0.

  phantom_byo_ip: ""
# Specify Phantom IP address when you enabled byo Phantom.

  phantom_byo_api_token: ""
# Phantom Api Token.

windows_servers_default:
  hostname: ar-win
# Define the hostname for the Windows Server.

  windows_image: windows-2016-v3-0-0
# name of the image of the Windows Server. Packer is used to build this images.

  create_domain: "0"
# Create Domain will turn this Windows Server into a Domain Controller. Enable by setting this to 1.

  join_domain: "0"
# Join a domain by setting this to 1 or 0.

  win_sysmon_config: "SwiftOnSecurity.xml"
# Specify a Sysmon config located under configs/ .

  install_red_team_tools: "0"
# Install different read team tools by setting this to 1 or 0.

  bad_blood: "0"
# Install Bad Blood by setting this to 1 or 0.
# More information in chapter Bad Blood under Attack Range Features.

linux_servers_default:
  hostname: ar-linux
# Define the hostname for the Linux Server.

  linux_image: linux-v3-0-0
# Name of the image of the Linux Server. Packer is used to build this image.

  sysmon_config: "SysMonLinux-CatchAll.xml"
# Specify a Sysmon config located under configs/ .

kali_server:
  kali_server: "0"
# Enable Kali Server by setting this to 1.

nginx_server:
  nginx_server: "0"
# Enable Nginx Server by setting this to 1.

  hostname: "nginx"
# Specify the image used for Nginx Server.

  nginx_image: nginx-web-proxy-v3-0-0
# name of the image of the Web proxy. Packer is used to build this images.

  proxy_server_ip: "10.0.1.12"
# Specify what ip to proxy.

  proxy_server_port: "8000"
# Specify what port to proxy.

zeek_server:
  zeek_server: "0"
# Enable Zeek Server by setting this to 1.

  zeek_image: "zeek-v3-0-0"
# Specify the image used for Zeek Server.

simulation:
  atomic_red_team_repo: redcanaryco
# Specify the repository owner for Atomic Red Team.

  atomic_red_team_branch: master
# Specify the branch for Atomic Red Team.

  prelude: "0"
# Install Prelude by setting this to 1. 

  prelude_operator_url: "https://download.prelude.org/latest?arch=x64&platform=linux&variant=zip&edition=headless"
# Specify where to download Prelude Operator from.

  prelude_account_email: "test@test.com"
# Email account login into a Prelude Operator UI.
# Required for connecting to redirector, can be found on the GUI under connect -> deploy manual redirector -> accountEmail.