# uber-common/metta

An information security preparedness tool to do adversarial simulation.

Repository: https://github.com/uber-common/metta
Canonical: https://ross.abutalabs.com/products/metta
Language: Python
License: MIT
License Family: permissive
Topics: uber, vagrant, yaml, celery, python, redis, virtualbox, infosec, security, network, networking, adversarial, simulation
Last push: 2019-04-01T06:34:25+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3227, "days_push": 2711, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1145, forks 160 (observed 2026-08-28T04:03:45.599107+00:00)

## What it is
Metta is an information security preparedness tool that runs adversarial simulations to test host-based and network detection instrumentation. It parses YAML action files, queues commands via Redis/Celery, and executes them sequentially on Vagrant/VirtualBox VMs matched by OS.

## Use cases
- simulate adversarial attack techniques to test my host-based detection instrumentation
- run MITRE ATT&CK technique simulations against Windows and Linux VMs
- validate whether my EDR or SIEM detects common discovery and persistence commands
- build purple team exercises from YAML-defined action sequences
- test network-based detection and controls with simulated attack traffic
- queue and execute security test actions one at a time without interaction

## When to choose
- you want to test host-based detection instrumentation against real adversarial commands
- you need MITRE ATT&CK-aligned simulation scenarios for purple team exercises
- you prefer declarative YAML action files that can be extended with your own scenarios
- you already use Vagrant/VirtualBox and want automated command execution across OS-specific VMs
- you want queued, sequential execution of security actions without manual interaction

## When to avoid
- you need a modern, actively maintained adversary emulation framework - the latest release is from 2019
- you want a full C2 or agent-based red team platform rather than simple command execution
- you cannot run Vagrant/VirtualBox or manage the Redis/Celery infrastructure it depends on
- you need stealthy or evasive execution - commands are run plainly and are easy to observe
- you require cloud-native or containerized deployment without virtualization

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, simulation, workflow-automation, cli, parser
- domain: security, penetration-testing, developer-tools
- platform: python, windows, self-hosted
- tags: adversarial-simulation, mitre-attack, purple-team, red-team, detection-testing, vagrant, celery, redis, virtualbox, infosec, yaml-actions, host-based-instrumentation, security-preparedness, automation, linux, macos, docker

## Member repositories
- uber-common/metta (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:45.599107+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:34:41.115179+00:00, confidence not recorded.
  - readme: https://github.com/uber-common/metta (fetched 2026-08-28T04:03:45.599107+00:00, sha 15e89baacf19)
- Data as of 2026-08-30T08:39:29.467469+00:00.