splunk/attack_range

Health v2 · maintenance only

Adoption not part of the score

2545 stars · 418 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Splunk Attack Range is a tool that builds instrumented, vulnerable lab environments in the cloud (AWS, Azure, GCP) or locally using Terraform and Ansible, then simulates adversary attacks with tools like Atomic Red Team. The generated security telemetry is collected into Splunk for detection development, testing, and validation.

Use cases

• build a splunk lab environment in aws for detection engineering
• simulate mitre att&ck techniques and collect telemetry into splunk
• test and validate security detections against real attack data
• spin up a vulnerable windows and linux range for purple team exercises
• automate attack simulation in ci pipelines via rest api
• share a security lab with teammates over wireguard vpn
• generate realistic endpoint and network logs for detection rule tuning

When to choose

• you develop or test Splunk detections and need realistic attack telemetry
• you want a reproducible, production-like security lab without manual setup
• you run purple team exercises with Atomic Red Team simulations
• you need to validate detection rules before deploying them to production

When to avoid

• you need a general-purpose penetration testing lab without Splunk integration
• you cannot or do not want to incur cloud provider costs for lab infrastructure
• you only need attack simulation without log collection and detection testing
• you need a lightweight local sandbox rather than a full multi-server environment

Facets

application · maturity active

simulation security infrastructure-as-code deployment cli monitoring security penetration-testing cloud-computing self-hosted cloud windows python cli attack-simulation detection-engineering splunk atomic-red-team cyber-range terraform ansible purple-team telemetry lab-environment devops docker linux web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="splunk/attack_range")